Real-time identification method and device for black and grey production drainage gang

Abstract

The embodiment of the invention provides a black-grey production drainage gang real-time identification method and device, and the method comprises the steps: constructing a heterogeneous graph model which comprises four types of entity nodes and six types of edge relationships, calculating an edge weight in real time according to a time sequence attenuation factor lambda, and dynamically updating the attributes of the entity nodes and edges; carrying out text adversarial enhancement, image adversarial processing and cross-modal alignment on the heterogeneous graph model through an adversarial multi-modal encoder on the basis of cross-modal camouflage characteristics of black and grey production; carrying out weight adaptive stratified sampling on the heterogeneous graph model to obtain a final training set; and based on the training set, training by adopting a hierarchical graph attention network to obtain a black-grey production drainage gang identification model, outputting node risk scores based on the black-grey production drainage gang identification model, performing forbidding on nodes of which the node risk scores are greater than or equal to a predetermined threshold, and generating a cross-platform evidence chain.

Description

Technical Field

[0001] This document relates to the field of computer technology, and in particular to a method and device for real-time identification of black and gray industry traffic-driving gangs. Background Technology

[0002] Cybercrime gangs leverage internet technology to conduct large-scale illegal and criminal activities. Their online assets exhibit significant cross-platform and cross-regional collaborative characteristics, forming a complete criminal chain from information collection and communication to fund transfers, posing a systemic threat to digital ecosystem security. Encrypted social platforms, such as Telegram, offer multiple advantages for cybercrime gangs, including data anonymity, identity spoofing, and behavioral obfuscation, thanks to their end-to-end encrypted communication protocol (MTProto), anonymous channel functions, and slang terminology. Cybercrime referral groups account for nearly 20% to 40% of all cybercrime gangs, actively conducting their activities on encrypted social platforms like Telegram. Monitoring systems on traditional social platforms (such as WeChat) primarily rely on three technical approaches: 1) keyword filtering based on regular expressions (e.g., sensitive words like "transfer" and "personal shopping agent"); 2) community discovery algorithms based on user relationship graphs (e.g., Louvain modularity optimization); and 3) rule engines based on account attributes (e.g., transaction frequency thresholds for newly registered accounts). However, the above methods have fundamental flaws when facing Telegram's encrypted communication scenarios: keyword detection is completely ineffective due to end-to-end encryption; the anonymous account system (supporting multiple registration methods such as mobile phone number, email, and random ID) leads to the distortion of relationship graph construction; and flash groups (average survival time <2 hours) render time window-based statistical features ineffective. There is an urgent need to develop encrypted data governance technologies that integrate protocol reverse engineering, dynamic behavior modeling, and cross-modal correlation analysis.

[0003] Existing technologies struggle to address the issue of anonymous identity association. Because Telegram users frequently change usernames and use virtual information, illicit groups often employ strategies such as "flash groups" (rapid creation and disbandment) and multi-account time-sharing operations. Traditional static analysis models struggle to capture dynamic behavior, rendering traditional ID tracking ineffective. Furthermore, illicit activities involve multi-source data, including text (encrypted slang), images (QR codes / codes), transaction records (cryptocurrencies), and device fingerprints. Existing technologies often analyze these data fragmentedly. Encrypted slang (e.g., "spinach" = gambling) and metaphorical content (e.g., using tea images to represent drugs) require domain-specific NLP models; general-purpose models perform poorly in recognizing them.

[0004] In the existing technology, the technical solutions to the above problems mainly include the following three categories: 1. Heterogeneous Graph-Based Encrypted Social Network Gang Modeling Black market groups use groups, private messages, and cryptocurrency addresses to form covert networks on Telegram, requiring the modeling of complex user-group-transaction relationships. A heterogeneous graph is constructed, with node types including users, groups, and cryptocurrency addresses, and edge types including message interaction (user ↔ group), fund transfer (user ↔ address), and cross-group association (user in multiple groups simultaneously). A graph neural network (GNN) is used to aggregate neighborhood information and identify anomalous users (such as high-frequency traders) through node classification, enabling the initial capture of the topological relationships between users and groups.

[0005] 2. A knowledge graph visualization method based on force-oriented layout Force-Directed Layout (FDR) is a graph visualization method based on a physical mechanics model. It transforms complex network structures into intuitive 2D / 3D representations by simulating the balance of "attraction" and "repulsion" forces between nodes. Spatial layout employs classic force-directed algorithms (such as Spring Embedder and FR) to lay out the network asset graph, aiding users in observing the topology. The three core principles are: node repulsion (avoiding node overlap), edge attraction (bringing adjacent nodes closer together), and energy minimization (stabilizing the total system energy through iterative optimization). The method optimizes the layout through iterative calculation of attraction and repulsion forces between nodes, using a Barnes-Hut quadtree approximation to accelerate repulsion calculations.

[0006] 3. Community Detection and Core Asset Identification Methods Based on Single Indicators Core assets are identified using centrality metrics (such as degree centrality and random walk centrality), and the community structure is detected using the LFM algorithm. Core assets (such as Cert nodes with high connectivity) are filtered by node degree values. The community boundary is expanded from seed nodes using a greedy strategy. In dynamically changing social networks (such as Telegram flash groups), the evolution of community structure is detected in real time, user behavior is correlated across groups, and hidden criminal gangs are identified.

[0007] However, the above technical solution has the following technical problems: 1. A static network asset integration method based on knowledge graphs.

[0008] Existing methods rely on periodic batch data updates (such as daily DNS record crawling), while black market assets can change at hourly rates (such as "flash domains"), leading to update delays and weak dynamic update capabilities: they cannot capture real-time dynamic changes in black market assets (such as rapid domain name changes and IP address migrations). Furthermore, traditional knowledge graph construction primarily relies on structured data (such as Whois information) and does not integrate natural language processing (NLP) and image analysis technologies, making it unable to parse encrypted messages or shared image content (such as gambling advertisement screenshots) within black market groups. Therefore, multimodal data is lacking: unstructured data such as text semantics and image fingerprints are not integrated.

[0009] 2. A knowledge graph visualization method based on force-oriented layout.

[0010] The time complexity of classic force-guided algorithms (such as the FR algorithm) is such that when the number of nodes N exceeds 10,000, the computation time for a single iteration increases exponentially, consuming large amounts of hardware resources and resulting in low computational efficiency: the layout of tens of thousands of nodes takes more than minutes, which cannot meet the needs of real-time interaction. Traditional algorithms assume a fixed graph structure and do not introduce a temporal weight decay mechanism (such as edge weight decaying with activity time), which means that dynamic changes (such as node addition / deletion) require recalculation of the entire graph, resulting in poor dynamic topology adaptation: it is difficult to represent the dynamic evolution of the asset graph (such as group disbanding / reconstruction).

[0011] 3. A method for community detection and core asset identification based on a single indicator.

[0012] This method suffers from several drawbacks. Relying solely on single metrics (such as node degree or betweenness centrality) to reflect only local network characteristics leads to inaccurate assessments due to the limitations of multidimensional metrics. For instance, when using node degree, bridging nodes (low degree but high betweenness) connecting multiple communities are easily overlooked. Furthermore, it exhibits poor adaptability to adversarial behavior. Black market actors can manipulate single-metric calculations through multi-account time-sharing operations and injecting noisy edges (such as fake transactions). For example, if a group controls 100 low-degree accounts to disperse funds, a single betweenness metric cannot identify it. Moreover, this method is highly threshold-dependent, relying on manually set thresholds (e.g., betweenness > 0.1) for core asset identification, lacking a dynamic adjustment mechanism, resulting in a high false positive rate. Core addresses in small money laundering networks may be mistakenly identified as ordinary nodes. Summary of the Invention

[0013] The purpose of this invention is to provide a method and apparatus for real-time identification of black and gray industry traffic-generating groups, aiming to solve the above-mentioned problems in the prior art.

[0014] This invention provides a method for real-time identification of black and gray market traffic-generating groups, including: A heterogeneous graph model including four types of entity nodes and six types of edge relationships is constructed. The edge weights are calculated in real time based on the time decay factor λ, and the attributes of entity nodes and edges are dynamically updated. Based on the cross-modal spoofing characteristics of black and gray industries, the heterogeneous graph model is enhanced with text adversarial capabilities, processed with image adversarial capabilities, and aligned across modalities using an adversarial multimodal encoder. The heterogeneous graph model is subjected to weighted adaptive hierarchical sampling to obtain the final training set. Based on the training set, a hierarchical graph attention network is used for training to obtain a black and gray industry traffic acquisition gang identification model. Based on the black and gray industry traffic acquisition gang identification model, a node risk score is output, and nodes with a risk score greater than or equal to a predetermined threshold are blocked, and a cross-platform evidence chain is generated.

[0015] This invention provides a real-time identification device for black and gray industry referral groups, comprising: The dynamic multimodal heterogeneous graph modeling module is used to construct a heterogeneous graph model that includes four types of entity nodes and six types of edge relationships. It calculates edge weights in real time based on the time decay factor λ and dynamically updates the attributes of entity nodes and edges. The multimodal adversarial feature fusion module is used to perform text adversarial enhancement, image adversarial processing, and cross-modal alignment on the heterogeneous graph model based on the cross-modal spoofing characteristics of black and gray industries through an adversarial multimodal encoder. The hierarchical adaptive sampling strategy module is used to perform weighted adaptive hierarchical sampling on the heterogeneous graph model to obtain the final training set. The hierarchical graph attention network module is used to train a hierarchical graph attention network based on the training set to obtain a black and gray market traffic acquisition gang identification model. Based on the black and gray market traffic acquisition gang identification model, it outputs node risk scores, blocks nodes with node risk scores greater than or equal to a predetermined threshold, and generates a cross-platform evidence chain.

[0016] This invention also provides an electronic device, including: a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the steps of the above-described method for real-time identification of black and gray market traffic-generating groups.

[0017] This invention also provides a computer-readable storage medium storing an information transmission implementation program, which, when executed by a processor, implements the steps of the above-described method for real-time identification of black and gray industry traffic-driving gangs.

[0018] This invention employs multi-dimensional dynamic modeling of black and gray market traffic-driving behaviors, breakthroughs in efficiency of large-scale graph computation, and closed-loop response of real-time countermeasure strategies. Compared to the static analysis framework and single-modal processing mode of existing technologies, this invention achieves generational differences in data correlation, computational efficiency, and real-time performance through systematic reconstruction, realizing high-efficiency and high-accuracy real-time identification of black and gray market traffic-driving groups. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in one or more embodiments of this specification or in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this specification. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0020] Figure 1 This is a flowchart of the real-time identification method for black and gray industry traffic-generating groups according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the real-time identification method for black and gray industry traffic-generating groups according to an embodiment of the present invention; Figure 3 This is a flowchart of the dynamic multimodal heterogeneous graph modeling process according to an embodiment of the present invention; Figure 4 This is a flowchart of the multimodal adversarial feature fusion module according to an embodiment of the present invention; Figure 5 This is a flowchart of the hierarchical adaptive sampling strategy module according to an embodiment of the present invention; Figure 6 This is a flowchart of the HGAT module of the hierarchical graph attention network according to an embodiment of the present invention; Figure 7 This is a flowchart of the real-time streaming processing architecture module according to an embodiment of the present invention; Figure 8 This is a schematic diagram of the real-time identification device for black and gray industry traffic diversion groups according to an embodiment of the present invention; Figure 9 This is a schematic diagram of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0021] To enable those skilled in the art to better understand the technical solutions in one or more embodiments of this specification, the technical solutions in one or more embodiments of this specification will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this specification, and not all of the embodiments. Based on one or more embodiments of this specification, all other embodiments obtained by those skilled in the art without creative effort should fall within the protection scope of this document.

[0022] First, the technologies involved in the technical solutions of the embodiments of the present invention will be described.

[0023] 1. Dynamic heterogeneous graph modeling.

[0024] Dynamic graph data sampling and representation learning. Design a dynamic hierarchical sampling strategy based on temporal weight decay, combine the node dynamic camouflage coefficient (such as nickname / avatar modification frequency) and the cross-group propagation topological feature (cascade path depth), oversample short-term surviving accounts (surviving < 1 hour) (weight increased by 3 times), and filter low-active noise nodes at the same time. Solve the sample selection bias of traditional sampling methods in dynamic camouflage networks and improve the coverage ability of key drainage nodes (such as high-frequency robot accounts, cross-group forwarding hubs).

[0025] 2. Multi-modal adversarial learning and robust classification.

[0026] Cross-modal semantic alignment and adversarial defense. Build an improved CLIP architecture, align the embedding spaces of text (BERT variant word detection), image (forged logo recognition), and behavior (jump path) through triplet contrast loss, and inject 20% adversarial samples (such as disassembled text "薇亻言", local image mosaics) for training. Use gradient masking technology to prevent the model from over-relying on single-modal features and solve the semantic fragmentation induced by text-image combinations and variant content interference.

[0027] 3. Real-time dynamic graph computing and incremental update.

[0028] Streaming graph data processing and temporal decay modeling. Build a streaming multi-modal data pipeline based on the Telegram Bot API, design a dual-time-scale decay model (short-term λ = 0.1 / minute, long-term λ = 0.01 / hour), and dynamically adjust the node activity weight. Through the local re-layout trigger mechanism (group speech frequency > 10 times / minute), only update the affected area, and the computing resource consumption is greatly reduced to cope with the real-time tracking failure caused by the hourly dynamic changes of flash groups.

[0029] 4. Design of high-performance graph neural network architectures.

[0030] Large-scale graph computing and sparse attention optimization. Propose a hierarchical sparse attention mechanism (HGAT). The local layer uses multi-head graph attention (GAT) to capture user-group interactions, and the global layer introduces sparse Transformer to model cross-group cascade paths of more than 3 hops. The computational complexity is reduced from to . Combine the CUDA-accelerated Barnes-Hut quadtree layout algorithm to achieve a 5-fold increase in the inference speed in the scenario of millions of nodes, and solve the efficiency-accuracy contradiction in local neighborhood aggregation and global long-range propagation path modeling.

[0031] 5. Modeling of cybercrime countermeasure strategies and dynamic scoring.

[0032] Robust anomaly detection and dynamic scoring mechanism. Build a multi-dimensional dynamic scoring model ( ), combined with Granger causality test to verify the time-series propagation logic. Design an adversarial training framework, inject 30% noisy accounts (low-degree, short-term survival) and forged edges, and filter out high-risk misjudgments with confidence <0.7 through Monte Carlo Dropout to resist model misjudgments caused by sub-account strategies and noise injection.

[0033] The problems solved by the technical solutions of the embodiments of the present invention are described below.

[0034] The embodiments of the present invention focus on the core challenges of the covert propagation behavior of black and gray production drainage gangs in the Telegram platform, and mainly solve the following technical problems: in scenarios with extremely strong dynamics (such as hourly replacement of "flash groups" and frequent account disguises), complex multi-modal drainage content (variant texts, forged images, cross-group propagation links), demanding computational efficiency (real-time tracking of millions of nodes), and adversarial interference (false accounts, noise content injection), the deficiencies of traditional methods in dynamic sampling, cross-modal association, and long-range path modeling. Specific problems include: 1. The lack of representation of drainage nodes caused by sample selection bias. Traditional methods ignore the dynamic disguise characteristics of the drainage network (such as the average daily modification of account nicknames / avatars > 5 times) and the cross-group propagation topology (such as cascade forwarding paths), resulting in training samples unable to cover key drainage nodes (such as "robot accounts" that frequently send induced messages and cross-group forwarding hubs). The omission of sampling for low-frequency but high-risk short-term survival accounts (survival < 1 hour) further causes the lack of induced behavior patterns, affecting the model's ability to detect covert drainage links.

[0035] 2. Semantic fragmentation and adversarial interference of multi-modal drainage content. Existing technologies process text (such as variant words "WeChat ID"), images (forged event posters), and behavioral data (user jump paths) in isolation, unable to analyze the implicit associations induced by the combination of text and images (such as the semantic consistency between the text "Scan the code to receive a red envelope" and the forged WeChat payment screenshot). At the same time, traditional NLP models have insufficient coverage in identifying variant induced words and lack an adversarial training mechanism, making them vulnerable to new obfuscation means (such as text disassembling, image mosaics), resulting in a relatively high miss rate of drainage content.

[0036] 3.失效实时追踪动态伪装与快闪群组。传统静态图谱更新机制(如每日批量爬取)无法应对引流团伙的小时级动态变化(如群组存活周期<3小时、账号伪装频率>5次 / 天),数据时效性误差高达4-6小时,关键传播路径(如临时群组内的爆发式转发)漏检率较高。现有方法未引入时序衰减权重,过期节点(如已解散群组)持续占用计算资源,进一步降低实时分析效率。

[0037] 4. Inefficiency in fusing local and global information.

[0038] Existing graph neural networks (such as GCN) rely excessively on local neighborhood aggregation, making it difficult to capture the long-range propagation path of traffic-driving content across groups (e.g., advertising text covering hundreds of groups through forwarding chains of more than 3 hops); while global attention mechanisms (such as graph transformers) have high computational complexity ( Traditional methods cannot be directly applied to large-scale traffic redirection networks (millions of nodes + billions of edges). The lack of modeling for the time-series propagation logic (such as the forwarding order of A→B→C) in traditional methods further leads to an increased false path misjudgment rate (such as mistakenly associating accidental forwarding of unrelated groups as cascading links).

[0039] 5. The robustness of the account splitting strategy and noise injection is insufficient.

[0040] Traffic-driving groups spread their message by manipulating hundreds of low-level accounts (each account sending less than 10 messages per day) and injecting noisy content (such as irrelevant chat text), resulting in a high misjudgment rate for single metrics (such as node degree and betweenness). Traditional threshold settings (such as betweenness > 0.1) ignore small core nodes (such as cross-platform redirect hubs) and lack a dynamic scoring mechanism, making them unable to adapt to the rapid evolution of adversarial strategies.

[0041] Method Implementation Examples According to embodiments of the present invention, a method for real-time identification of black and gray industry traffic-driving groups is provided. Figure 1 This is a flowchart of the real-time identification method for black and gray industry traffic-driving groups according to an embodiment of the present invention, such as... Figure 1 As shown, the real-time identification method for black and gray industry referral groups according to an embodiment of the present invention specifically includes: Step S101 involves constructing a heterogeneous graph model comprising four types of entity nodes and six types of edge relationships, calculating edge weights in real time based on the time-series decay factor λ, and dynamically updating the attributes of entity nodes and edges; specifically including: The behavior of black and gray market traffic generation is modeled as a heterogeneous graph model G(t)=(V(t), E(t)), which includes four types of nodes (users, groups, content, and devices) and six types of edge relationships (speech, forwarding, login, cross-group propagation, device association, and semantic association). Here, G(t) represents the heterogeneous graph model at time t, V(t) represents the set of entity nodes at time t (including the four types of nodes: users, groups, content, and devices), and E(t) represents the set of entity nodes at time t. The set of edge relationships includes six types: speaking, forwarding, login, cross-group propagation, device association, and semantic association. User node attributes include: recorded device fingerprint, nickname modification trajectory, and cross-group behavior density. Group node attributes include: recorded embedded lifespan prediction value, member growth rate, and sensitive word coverage. Content node attributes include: recorded fused text variant word detection vector, image fingerprint, and propagation path index. Device node attributes include: recorded associated geographical location jump frequency, device model fingerprint, and login time distribution. Edge relationships include: user and group, user and content, group and content, user and device, content and content, and group and group. Based on Formula 1, edge weights are calculated in real time according to the time-series decay factor λ, and the attributes of edges and entity nodes are dynamically updated according to Formula 2: Formula 1; Formula 2; Where λ = 0.1 / minute is the time-series decay factor. It is a multi-mode encoder. Represents the set of edge relationships at time t (including six types of edge relationships: speaking, forwarding, logging in, cross-group propagation, device association, and semantic association). This represents the increment of the newly added edge weight. This indicates the time interval between two consecutive updates. This represents the dynamically updated attributes (embedding vector / features) of node v at time t. The text features representing node v Represents the image features of node v. This represents the behavioral characteristics of node v.

[0042] Step S102, based on the cross-modal camouflage characteristics of black and gray market activities, performs text adversarial enhancement, image adversarial processing, and cross-modal alignment on the heterogeneous graph model using an adversarial multimodal encoder; specifically including: We construct an obfuscation library containing variant words, use GPT to generate semantically preserving adversarial examples, and introduce glyph decomposition features to enhance variant word detection; By constructing a joint OCR-object detection model, we can identify inducement images containing payment QR codes. During the training phase of the images, we can add adversarial noise with a PSNR of 25dB through a pre-built adaptive noise injection module. A shared embedding space is constructed based on the improved CLIP architecture, and cross-modal similarity is calculated according to Formula 3: Formula 3; like and This was determined to be cross-modal camouflage behavior. in, , Represents a text embedding vector. This represents the image embedding vector, where N represents the number of negative samples. Represents the natural exponential function. This represents the text-image cross-modal similarity (the similarity calculated according to Formula 3). Represents image-behavior cross-modal similarity.

[0043] Step S103 involves performing weighted adaptive hierarchical sampling on the heterogeneous graph model to obtain the final training set; specifically including: Dynamic weights are calculated for the heterogeneous graph model according to Formula 4: Formula 4; in, Indicates cross-group coverage rate within 10 minutes. This represents the induced probability value within the interval 0-1. / This indicates the number of times the nickname / avatar has been changed. Indicates survival time; Based on the calculated dynamic weights, a three-level sampling process is performed, specifically including: selecting core users with a node degree > 50 as the initial seed set; discarding groups with a survival time < 1 hour with probability; expanding the neighborhood using the weighted random walk (WRW) algorithm; and calculating the transition probability according to Formula 5 to obtain the final training set. Formula 5; in, This represents the transition probability from node u to node v. This represents the dynamic weight of node v (the weight W calculated according to Formula 4). This represents the distance between nodes u and v. This represents the set of neighboring nodes of node u. This represents the dynamic weight of the neighboring node k. This represents the time decay factor (used for transition probability calculation).

[0044] Step S104: Based on the training set, a hierarchical graph attention network is used for training to obtain a black market traffic acquisition gang identification model. Based on this model, a node risk score is output, and nodes with risk scores greater than or equal to a predetermined threshold are blocked, generating a cross-platform evidence chain. Specifically, this includes: Based on the training set, an 8-head graph attention network (GAT) is used to aggregate 1-hop neighborhood features, with subgraph node features as input. 8 sets of independent calculations , , The matrix outputs concatenated features, and parallel judgment is performed using a CUDA kernel. Filter out more than 70% of edges, perform dynamic pruning, retain the top √N edges based on edge weight sorting, apply exponential decay to historical edge weights to enhance recent propagation behavior, and use the loss function as follows: Inject 20% noisy nodes and fake edges, where, Represents the node classification loss. Indicates the loss from edge reconstruction. Indicates the resistance regularization term. This represents the attention weights from node i to node j in the k-th attention head. Represents the Query linear transformation matrix. Represents the linear transformation matrix of Key. Value represents the linear transformation matrix, and N represents the number of nodes.

[0045] Preferably, in this embodiment of the invention, a distributed Telegram Bot cluster is deployed, and a long connection channel is established based on the MTProto2.0 protocol for data collection; an Apache Flink is used to build a processing pipeline to implement a stream processing engine; the Barnes-Hut quadtree optimization algorithm is implemented based on CUDA, and GPU acceleration is achieved by using mixed precision training of FP16+FP32.

[0046] As can be seen from the above technical solution, to solve the problems of cross-platform identity association and dynamic disguise cracking of anonymous drainage gangs, the embodiment of the present invention proposes a temporal heterogeneous graph learning method based on enhanced induced propagation graphs, modeling the Telegram drainage network as a multi-modal heterogeneous graph including users (promotion accounts), drainage content nodes (advertising texts / phishing links), target groups, and devices. The edge relationships mainly define induced message reach (such as mass private messages, @all notifications), cross-group content propagation paths (cascading forwarding links of advertising texts), and device fingerprint associations (multiple accounts controlled by the same device to batch add groups). By designing drainage-specific temporal centrality metrics - including diffusion speed (cross-group coverage rate of content within 10 minutes), semantic induction intensity (detecting risk terms such as "part-time brush orders" and "scan the code to receive benefits" based on the BERT-RoBERTa fusion model), and disguise fluctuation coefficient (average daily modification frequency of account nicknames / avatars), a dynamic hierarchical sampling strategy is constructed: for accounts that frequently modify their identities and send the same type of content across groups, perform weighted doubling sampling (weight = diffusion speed × semantic induction intensity), and at the same time, probabilistically discard temporary accounts with a survival period less than 1 hour (discard rate ≥ 70%), so as to achieve millisecond-level positioning of key drainage paths in a graph with a scale of billions of edges.

[0047] In the feature fusion layer, design an adversarial multi-modal encoder: for the text modality, extract the adversarial embedding representations of variant induced words (such as glyph decomposition variants like "薇亻言" and "釒戔"); for the image / video modality, identify brand trademark infringement features in forged payment QR codes and false activity posters through the OCR-object detection joint model; for the behavior modality, construct a funnel-shaped propagation model of user-group, quantifying the abnormal conversion rate from "message reach" to "external jump" (normal user conversion rate < 5%, drainage account association conversion rate > 35%). To solve the limitations of traditional GNNs in modeling long-range propagation paths, improve the message passing mechanism of the graph neural network, and introduce a temporal decay-reinforcement factor: assign a weight of 2.6 times to cross-group forwarding behaviors added in the last 24 hours, exponentially decay historical behaviors over 72 hours, and at the same time add an adversarial perturbation regularization term to enable the model to recognize new types of drainage materials that have been mosaicked and text screenshots imageified.

[0048] Based on the above challenges, the method combining hierarchical multi-modal sampling and improved GNN has become a new direction for analyzing black and gray production drainage gangs. This method dynamically adjusts the sampling weights to ensure that the training data covers core black production behavior patterns (such as gambling promotion, money laundering links), while filtering low-correlation noise nodes (such as short-term anonymous accounts), significantly improving the accuracy of anonymous user cross-group association and the integrity of multi-modal evidence chains.

[0049] The above technical solutions of the embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0050] This invention addresses the core challenges of Telegram black market traffic acquisition groups, including their dynamic camouflage, multimodal correlation, and large-scale propagation, by constructing a five-layer collaborative architecture for real-time identification. It captures the complex network of user-group-device relationships through dynamic heterogeneous graph modeling, integrates cross-modal features of text, images, and behavior, constructs three types of nodes (users, groups, and content) and six types of relational edges, updates node attributes and edge weights in real time, performs cross-modal alignment of text, image, and behavioral features, generates joint embedding vectors, and improves computational efficiency through a hierarchical sampling strategy. High-risk users and groups are identified through a hierarchical attention network, and accurate classification is achieved using an improved graph neural network. The classification results are then pushed to a visualization platform and an interception system.

[0051] The embodiments of this invention mainly include five core modules: such as Figure 2 As shown, the module includes a dynamic multimodal heterogeneous graph modeling module, a multimodal adversarial feature fusion module, a hierarchical adaptive sampling strategy module, a hierarchical graph attention network (HGAT) module, and a real-time streaming processing architecture module. Each module achieves millisecond-level response through the streaming processing framework, making it particularly suitable for identifying complex black and gray market traffic-driving gangs in Telegram.

[0052] The following describes each module and its technical implementation from an overall perspective.

[0053] 1. Dynamic multimodal heterogeneous graph modeling This module constructs a heterogeneous graph model containing four types of entity nodes (users, groups, devices, and content) and six types of relation edges (speaking, propagating, logging in, forwarding, associating, and sharing origin), breaking through the semantic limitations of traditional isomorphic graphs. Core technical implementations include: Node dynamic attribute design: User nodes: record device fingerprints, nickname modification trajectories (similarity calculated based on the Longest Common Subsequence (LCS) algorithm), and cross-group behavior density (number of times a user joins / leaves a group per unit time).

[0054] Group nodes: embedded lifecycle prediction (based on LSTM time series model, prediction error <15 minutes) and sensitive word coverage (through TF-IDF weighted statistics).

[0055] Content nodes: fused text variant word detection vector (768-dimensional vector output by BERT-wwm full word masking model) and image fingerprint (128-bit SimHash generated by reducing the 1024-dimensional features extracted by ResNet-18 to 64-dimensional using PCA).

[0056] Device node: Associated geographical location change frequency (calculated by resolving the IP2Location database to determine the number of IP changes per hour).

[0057] Edge weight dynamic update mechanism: Define the time-series decay factor λ = 0.1 / minute and calculate the edge weight in real time:

[0058] Implement enhanced decay (λ = 0.2 / minute) for forwarding edges to quickly eliminate short-term propagated content.

[0059] Model the black and gray production drainage behavior as a time-series heterogeneous graph G(t)=(V(t),E(t)) containing four types of nodes (users, groups, content, devices) and six types of edge relationships (speech, forwarding, login, cross-group propagation, device association, semantic association), where the attributes of nodes and edges are dynamically updated over time and satisfy:

[0060] where λ = 0.1 / minute is the time-series decay factor, is a multi-modal encoder.

[0061] The dynamic multi-modal heterogeneous graph modeling process is as follows Figure 3 shown. Data acquisition layer: The Telegram Bot API monitors the target groups in real time and captures the following data streams: User nodes: user ID, nickname modification record, device fingerprint (parsed through the MTProto protocol) Content nodes: text (including variant words), pictures (including OCR recognition results), links (including jump path tracking) Edge relationships: user speech → group, user forwarding → content, device → user login relationship Multi-modal feature encoding Text modality: Adopt the BERT-wwm model with adversarial training, and pre-load a mapping table of 57,000 groups of variant words in the embedding layer (such as "薇 → 亻+薇").

[0062] Output a 256-dimensional semantic vector , focusing on detecting risk words such as "part-time brush orders" and "scan the code to receive benefits".

[0063] Image modality: OCR-object detection joint model: Detect forged LOGOs through YOLOv5 and OCR-recognize the induced information in the screenshot (such as false payment amounts).

[0064] Output 128-dimensional visual features , combined with SimHash to generate image fingerprints.

[0065] Behavior modality: Funnel Model for Quantifying User Behavior Chain: Message Reach Rate , click-through rate , external jump rate .

[0066] Abnormal Judgment Rule: If > 35% and the survival time T < 2 hours, it is marked as a high-risk node.

[0067] 2. Multimodal Adversarial Feature Fusion As Figure 4 shown, for the cross-modal camouflage characteristics of black and gray production (such as text variant words, image QR code nesting, behavior pattern imitation), design an adversarial multimodal encoder (AME): Text Adversarial Enhancement: Construct a confusion library containing 57,000 groups of variant words (such as "WeChat → 薇亻言"), and use GPT to generate adversarial samples with semantic retention; introduce glyph decomposition features (Unicode encoding difference degree, stroke editing distance) to enhance variant word detection.

[0068] Image Adversarial Processing: Develop an OCR-object detection joint model to identify induced pictures containing payment QR codes; at the same time, design an adaptive noise injection module to add adversarial noise with PSNR = 25dB during the training phase Cross-modal Alignment: Construct a shared embedding space based on the improved CLIP architecture to calculate cross-modal similarity:

[0069] Define the abnormal association threshold: If and it is determined as a cross-modal camouflage behavior.

[0070] Theoretical Model: Based on dynamic weights , design a three-level sampling mechanism: Seed Screening Layer: Select core user nodes with degree > 50 ; Survival Filtering Layer: Discard nodes with survival < 1 hour with a probability of 70%; Neighborhood Expansion Layer: Perform weighted random walk according to the transition probability to generate a training subgraph.

[0071] Technical Implementation Scheme: Dynamic Weight Calculation Module Input: The number of cross-groups of user nodes , BERT risk probability , camouflage coefficient; Output: Normalized weight ∈[0,1], updated 100,000 times per second.

[0072] Stratified sampling execution First layer: Based on real-time Elasticsearch retrieval of nodes with a degree > 50, a seed pool is built; The second layer: quickly determines the node's lifespan using a Bloom filter and discards short-term noise; The third layer: Transition probabilities are computed in parallel on NVIDIA CUDA to generate a subgraph covering the core path (size ≈ ). ).

[0073] 3. Stratified adaptive sampling strategy. like Figure 5 As shown, to address the computational efficiency problem of large-scale graphs, a weighted adaptive hierarchical sampling (WAHS) strategy is proposed: Dynamic weight calculation:

[0074] Definitions: Cross-group coverage rate within 10 minutes (number of groups / total number of groups) The induced probability value (0-1 interval) output by the BERT model. / Number of times nickname / avatar has been changed Three-level sampling mechanism: Seed layer: Select core users with a node degree > 50 as the initial seed set. Filtering layer: Probabilistically discard groups with a survival time of less than 1 hour (dropout rate ≥ 70%). Expansion Layer: The neighborhood is expanded using a weighted random walk (WRW) algorithm, with transition probabilities as follows:

[0075] 4. Hierarchical Graph Attention Network (HGAT) like Figure 6 As shown, an improved graph neural network architecture is designed to solve the oversmoothing problem of traditional GNNs: Local attention layer: An 8-head graph attention network (GAT) is used to aggregate 1-hop neighborhood features. Attention coefficients are calculated as follows:

[0076] Dynamic pruning mechanism: Discard weakly related edges with attention weights < 0.1.

[0077] Global propagation layer: Introduction Sparse attention, only retaining the top-ranked items by weight. The edges are involved in the calculation.

[0078] Constructing indicators of the importance of transmission paths:

[0079] Joint loss function:

[0080] Node classification loss (cross-entropy) Edge reconstruction loss (mean squared error) : Adversarial regularization term (KL divergence) Theoretical model: HGAT consists of a two-level attention structure: local and global. Local attention layer: 8-head GAT aggregates 1-hop neighborhood information and performs pruning. Weak edges; Global Propagation Layer: Sparse Transformer Modeling Critical path, time decay factor .

[0081] Technical Implementation Solution: Local GAT layer: Input: Subgraph node features ; Multi-head calculation: 8 independent groups , , Matrix, output spliced ​​features; Dynamic pruning: Parallel decision-making in the CUDA kernel Filtering over 70% of edges.

[0082] Global Transformer layer: Critical path selection: Based on edge weight sorting, retain the top √N edges (e.g., retain 10,000 edges when N=100 million). Temporal decay weighting: Applying exponential decay to the weights of historical edges to strengthen recent propagation behavior.

[0083] Joint optimization: Loss function: ; Adversarial training: Injecting 20% ​​noisy nodes and fake edges to improve model robustness.

[0084] 5. Real-time streaming architecture like Figure 7As shown, a three-stage pipeline is constructed to achieve millisecond-level response (end-to-end latency <500ms): Data Acquisition Layer: Deploy a distributed Telegram bot cluster (≥50 nodes), establish long-lived connection channels based on the MTProto2.0 protocol, with a message capture capacity of 100,000 messages / second at peak speed and a packet parsing latency of <50ms. Stream processing engine: The processing pipeline is built using Apache Flink.

[0085] GPU acceleration module: The Barnes-Hut quadtree optimization algorithm was implemented based on CUDA, reducing the layout time for tens of thousands of nodes from 15 seconds to 2.3 seconds; mixed precision training (FP16+FP32) was adopted, significantly reducing memory usage.

[0086] The processing steps for real-time identification of black and gray market traffic-driving groups in this embodiment of the invention are as follows: Real-time data injection: Capture user messages, images, and group joining events via the Telegram Bot API, and complete feature encoding within 5 seconds; Dynamic graph update: Update node attributes and edge weights in Neo4j to trigger time-series decay calculation; Stratified sampling: Generate high-risk subgraphs based on the HAS engine (covering the core propagation path); HGAT Inference: Risk score of output node in local-global attention network; Real-time blocking: Ban accounts / groups with a risk score > 0.9 and generate a cross-platform evidence chain.

[0087] In summary, this invention addresses the core issues of highly dynamic camouflage by black and gray market traffic-generating groups, complex multimodal information associations, and low real-time identification efficiency. By constructing a dynamic multimodal heterogeneous graph model, a hierarchical attention network, and a streaming processing architecture, it significantly surpasses existing technologies in multiple dimensions, including detection accuracy, computational efficiency, and real-time performance. Compared to traditional static single-modal analysis methods, this solution achieves, for the first time, deep association modeling across text, image, and behavioral data, and innovatively combines temporal decay mechanisms with sparse attention computation, solving the industry challenge of real-time computation of large-scale dynamic graphs. This provides a feasible technical path for platform-level black and gray market governance. The following details the main advantages of this invention and its beneficial effects from the perspective of specific technical implementation: 1. Cross-modal dynamic fusion technology.

[0088] This invention significantly improves the recognition accuracy of complex spoofing behaviors through dynamic multimodal heterogeneous graph modeling technology. Existing technologies typically analyze text, image, or user behavior data independently, making it difficult to capture hidden cross-modal associations (such as the collaborative propagation of variant words and fake payment codes). This solution innovatively incorporates four types of nodes—users, groups, content, and devices—into a unified heterogeneous graph model and designs a multimodal adversarial encoder (AME) to achieve cross-modal feature alignment. Specifically, the text modality uses an adversarially trained BERT-wwm model, combined with a library of 57,000 obfuscated characters to enhance the robustness of variant word detection; the image modality uses an OCR-object detection joint model to identify deepfake content, supplemented by SimHash to generate image fingerprints; and the behavior modality constructs a funnel model to quantify jump rate anomalies. This multimodal deep fusion mechanism significantly improves the system's accuracy on test data compared to traditional single-modal methods, especially demonstrating significant advantages in complex scenarios such as cross-platform jumps and coded transactions.

[0089] 2. Hierarchical sparse computing technology.

[0090] The hierarchical dynamic sampling strategy, combined with the improved HGAT network, achieves a breakthrough in computational efficiency. Existing graph neural networks generally suffer from memory overflow and response latency issues when processing real-time data with hundreds of millions of edges. This solution, through the hierarchical sampling strategy (WAHS), reduces computational complexity from... Down to Specifically, the dynamic weight calculation module integrates diffusion speed, semantic inducement strength, and camouflage fluctuation coefficient to prioritize the screening of high-risk nodes and key propagation paths; in the HGAT network, the local attention layer employs 8-head independent computation and dynamic pruning techniques to filter weakly related edges with weights below 0.1, while the global propagation layer... The sparse attention mechanism retains only the most representative propagation paths. Actual deployment data shows that this design significantly reduces inference time for tens of thousands of nodes while decreasing memory usage, making large-scale real-time analysis feasible.

[0091] 3. Flow-based accelerated response technology.

[0092] Leveraging a streaming architecture and GPU-accelerated real-time response capabilities, this solution addresses the industry pain point of dynamic escape by black market groups. Traditional batch processing systems often suffer from "detection becoming outdated" due to data update delays. This solution, however, utilizes Apache Flink to build a streaming pipeline, implementing dynamic incremental graph updates via a 5-second rolling window and introducing a time decay factor (λ=0.1 / minute) to automatically discard expired interactive data. At the hardware level, the CUDA-accelerated Barnes-Hut algorithm parallelizes layout computation, and combined with mixed-precision training (FP16+FP32) reduces memory consumption. This results in a stable end-to-end processing latency of less than 500 milliseconds, supporting real-time updates of 100,000 edges per second, significantly improving throughput compared to existing streaming graph computation frameworks. Furthermore, the visualization engine, through HSV chroma mapping and LOD hierarchical rendering technology, achieves minute-level situational awareness of high-risk nodes, providing dynamic interception decision support for platform operators.

[0093] 4. Dynamic incremental pre-training technology.

[0094] To address the model lag issue caused by the high-frequency evolution of black market strategies (e.g., over 5000 new variant words added daily), this solution designs a lightweight incremental pre-training framework (DIPT). Through a streaming data-driven parameter fine-tuning mechanism, combined with an adversarial sample generator (ASG), novel attack samples (such as character decomposition and semantically obfuscated text) are synthesized in real time. The model can achieve hourly iterative updates using only 5% of computational resources without requiring full retraining. The key innovation lies in the use of dual-channel feature distillation: the teacher model (full training) and the student model (incremental training) run in parallel, achieving knowledge transfer through KL divergence loss; and an adversarial sample cache pool: dynamically storing recent attack samples (capacity 100,000+), weighted by threat level to enhance training. In practical applications, this technology enables the variant word recognition model to maintain an extremely high recall rate for 30 days, significantly improving upon traditional monthly update models.

[0095] 5. Multi-level countermeasures and defense technology.

[0096] To counter interference attacks from malicious actors that inject noise (such as spoofing user behavior or creating fake forwarding paths), this solution constructs a three-tiered defense system: Input layer defense: An abnormal traffic detection module based on GAN filters injected noisy accounts in real time; Feature layer defense: By using gradient masking and feature randomization (FRN), adversarial examples can be blocked from causing targeted interference to the model's decision-making. Output layer defense: Monte Carlo Dropout uncertainty assessment, with a manual review mechanism initiated for high-risk predictions with a confidence level <0.7. In adversarial testing, the system maintained a high F1 score even with 30% noisy data injected, demonstrating a significant robustness advantage over traditional models.

[0097] The core of this invention focuses on three major technical directions: the construction method of dynamic multimodal graph neural networks, the hierarchical sparse computational architecture, and the streaming incremental learning mechanism. Its innovation lies in the multi-dimensional dynamic modeling of black and gray market behavior, the efficiency breakthrough in large-scale graph computation, and the closed-loop response of real-time adversarial strategies. Compared to the static analysis framework and single-modal processing mode of existing technologies, this invention achieves generational differences in data correlation, computational efficiency, and real-time performance through a systematic reconstruction of technical means.

[0098] 1. Dynamic multimodal heterogeneous graph modeling method.

[0099] Existing technologies typically employ static knowledge graphs to construct user-group relationships, relying on periodic batch data updates (such as daily crawling), which fails to capture the hourly dynamic changes of "flash groups." This invention constructs a heterogeneous graph containing four types of nodes—users, groups, content, and devices—through a streaming multimodal data pipeline (real-time acquisition via Telegram Bot API), and innovatively defines six dynamic edge relationships (such as cross-group propagation paths and device fingerprint associations). This scheme introduces a temporal decay factor (λ=0.1 / minute) to dynamically adjust node weights, combined with an adversarial multimodal encoder (AME) to achieve deep feature alignment across text, image, and behavioral data. Real-world testing data shows that this technology significantly improves the accuracy of dynamic group survival period detection compared to traditional methods, and supports minute-level graph updates, improving real-time performance by two orders of magnitude compared to existing technologies (update delay of 4-6 hours).

[0100] 2. Layered sparse attention computing architecture.

[0101] Traditional graph neural networks (such as GCN and GAT) suffer from computational complexity exceeding one billion edges due to the aggregation of fully connected neighborhoods. This approach struggles to meet real-time requirements. This invention proposes a Hierarchical Graph Attention Network (HGAT), employing multi-head GAT (8 heads computed independently) and dynamic pruning (threshold α < 0.1) in the local layers to filter over 70% of weakly related edges; the global layer... Sparse attention filters critical propagation paths, compressing computational complexity to a minimum. Comparative experiments show that, under the same hardware conditions, this solution significantly improves the inference speed for millions of nodes compared to the traditional GAT, while greatly reducing memory usage. Furthermore, the random sampling strategy used in existing technologies results in a critical path miss rate as high as 35%, while this solution, through a dynamic weight model considering diffusion speed and semantic induction strength, significantly improves the high-risk path capture rate.

[0102] 3. Streaming incremental learning and adversarial defense system.

[0103] Existing solutions rely on fixed threshold rules and periodic full-scale model training. When faced with the rapid evolution of black market strategies (e.g., 5000+ new variant words added daily), model performance degrades significantly within 7 days. This invention constructs a lightweight incremental pre-training framework (DIPT), employing dual-channel feature distillation (teacher-student model) and an adversarial example caching pool (100,000+ samples). This allows for hourly model iterations with minimal computational resources, maintaining a consistently high recall rate for variant word recognition. Furthermore, existing defense techniques using a single anomaly detection module suffer from a sharp drop in F1-score when 30% noise is injected. In contrast, this solution designs a multi-layered adversarial defense system (input layer GAN filtering, feature layer gradient masking, and output layer uncertainty assessment), maintaining a high F1-score even under the same attack intensity.

[0104] Device Example 1 According to embodiments of the present invention, a real-time identification device for black and gray industry referral groups is provided. Figure 8 This is a schematic diagram of a real-time identification device for black and gray industry referral groups according to an embodiment of the present invention, such as... Figure 8 As shown, the real-time identification device for black and gray industry referral groups according to an embodiment of the present invention specifically includes: The dynamic multimodal heterogeneous graph modeling module 80 is used to construct a heterogeneous graph model that includes four types of entity nodes and six types of edge relationships. It calculates edge weights in real time based on the time decay factor λ and dynamically updates the attributes of entity nodes and edges. The multimodal adversarial feature fusion module 82 is used to perform text adversarial enhancement, image adversarial processing, and cross-modal alignment on the heterogeneous graph model based on the cross-modal camouflage characteristics of black and gray industries through an adversarial multimodal encoder. The hierarchical adaptive sampling strategy module 84 is used to perform weighted adaptive hierarchical sampling on the heterogeneous graph model to obtain the final training set. The hierarchical graph attention network module 86 is used to train a hierarchical graph attention network based on the training set to obtain a black and gray industry traffic acquisition gang identification model. Based on the black and gray industry traffic acquisition gang identification model, it outputs node risk scores, blocks nodes with node risk scores greater than or equal to a predetermined threshold, and generates a cross-platform evidence chain.

[0105] The above-mentioned device may further include: The real-time streaming architecture module is used to deploy a distributed Telegram Bot cluster. It establishes long-connection channels for data acquisition based on the MTProto2.0 protocol. It uses Apache Flink to build a processing pipeline to implement the streaming engine. It implements the Barnes-Hut quadtree optimization algorithm based on CUDA and uses mixed precision training of FP16+FP32 to achieve GPU acceleration.

[0106] The embodiments of the present invention are device embodiments corresponding to the above method embodiments. The specific operation of each module can be understood with reference to the description of the method embodiments, and will not be repeated here.

[0107] Device Example 2 This invention provides an electronic device, such as... Figure 9 As shown, it includes: a memory 90, a processor 92, and a computer program stored in the memory 90 and executable on the processor 92, wherein the computer program, when executed by the processor 92, performs the steps as described in the method embodiment.

[0108] Device Example 3 This invention provides a computer-readable storage medium storing an information transmission implementation program, which, when executed by a processor 92, performs the steps described in the method embodiment.

[0109] The computer-readable storage media described in this embodiment include, but are not limited to, ROM, RAM, disk, or optical disk.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for real-time identification of black and gray industry traffic-generating gangs, characterized in that, include: A heterogeneous graph model including four types of entity nodes and six types of edge relationships is constructed. The edge weights are calculated in real time based on the time decay factor λ, and the attributes of entity nodes and edges are dynamically updated. Based on the cross-modal spoofing characteristics of black and gray industries, the heterogeneous graph model is enhanced with text adversarial capabilities, processed with image adversarial capabilities, and aligned across modalities using an adversarial multimodal encoder. The heterogeneous graph model is subjected to weighted adaptive hierarchical sampling to obtain the final training set. Based on the training set, a hierarchical graph attention network is used for training to obtain a black and gray industry traffic acquisition gang identification model. Based on the black and gray industry traffic acquisition gang identification model, a node risk score is output, and nodes with a risk score greater than or equal to a predetermined threshold are blocked, and a cross-platform evidence chain is generated.

2. The method according to claim 1, characterized in that, A heterogeneous graph model is constructed, comprising four types of entity nodes and six types of edge relationships. Edge weights are calculated in real-time based on a time-series decay factor λ, and the attributes of entity nodes and edges are dynamically updated. Specifically, this includes: The behavior of black and gray market traffic is modeled as a heterogeneous graph model G(t)=(V(t), E(t)), which includes four types of nodes (users, groups, content, and devices) and six types of edge relationships (speech, forwarding, login, cross-group propagation, device association, and semantic association), where G(t) represents time t. The heterogeneous graph model is described, where V(t) represents the set of entity nodes at time t (including four types of nodes: users, groups, content, and devices), and E(t) represents the set of edge relationships at time t, including six types of edge relationships: speaking, forwarding, logging in, cross-group propagation, device association, and semantic association. The attributes of user nodes include: recording device fingerprints, nickname modification trajectories, and cross-group behavior density. The attributes of group nodes include: recording embedded lifecycle prediction values, member growth rates, and sensitive word coverage. The attributes of content nodes include: recording fused text variant word detection vectors, image fingerprints, and propagation path indexes. The attributes of device nodes include: recording associated geographical location jump frequency, device model fingerprints, and login time distribution. The edge relationships include: user and group, user and content, group and content, user and device, content and content, and group and group. Based on Formula 1, edge weights are calculated in real time according to the time-series decay factor λ, and the attributes of edges and entity nodes are dynamically updated according to Formula 2: Formula 1: Formula 2: Where λ = 0.1 / minute is the time-series decay factor. It is a multi-mode encoder. This represents the weight of edge (u,v) at time t. This represents the increment of the newly added edge weight. This indicates the time interval between two consecutive updates. This represents the dynamically updated attributes (embedding vector / features) of node v at time t. The text features representing node v Represents the image features of node v. This represents the behavioral characteristics of node v.

3. The method according to claim 2, characterized in that, Based on the cross-modal camouflage characteristics of black and gray market activities, the heterogeneous graph model is enhanced with text adversarial capabilities, processed with image adversarial capabilities, and aligned across modalities using an adversarial multimodal encoder. Specifically, this includes: We construct an obfuscation library containing variant words, use GPT to generate semantically preserving adversarial examples, and introduce glyph decomposition features to enhance variant word detection; By constructing a joint OCR-object detection model, we can identify inducement images containing payment QR codes. During the training phase of the images, we can add adversarial noise with a PSNR of 25dB through a pre-built adaptive noise injection module. A shared embedding space is constructed based on the improved CLIP architecture, and cross-modal similarity is calculated according to Formula 3: Formula 3: like and This was determined to be cross-modal camouflage behavior. in, , Represents a text embedding vector. This represents the image embedding vector, where N represents the number of negative samples. This represents the natural exponential function. This represents the text-image cross-modal similarity, i.e., the similarity calculated according to Formula 3. Represents image-behavior cross-modal similarity.

4. The method according to claim 1, characterized in that, The heterogeneous graph model is subjected to weighted adaptive hierarchical sampling to obtain the final training set, which specifically includes: Dynamic weights are calculated for the heterogeneous graph model according to Formula 4: Formula 4: in, Indicates cross-group coverage rate within 10 minutes. This represents the induced probability value within the interval 0-1. / This indicates the number of times the nickname / avatar has been changed. Indicates survival time; Based on the calculated dynamic weights, a three-level sampling process is performed, specifically including: selecting core users with a node degree > 50 as the initial seed set; discarding groups with a survival time < 1 hour with probability; expanding the neighborhood using the weighted random walk (WRW) algorithm; and calculating the transition probability according to Formula 5 to obtain the final training set. Formula 5: in, This represents the transition probability from node u to node v. This represents the dynamic weight of node v, i.e., the weight W calculated according to formula 4. This represents the distance between u and v. Let u be the set of its neighboring nodes. This represents the dynamic weight of the neighboring node k. This represents the time decay factor used for calculating the transition probability.

5. The method according to claim 1, characterized in that, Based on the training set, a hierarchical graph attention network is used for training to obtain a black and gray market traffic acquisition gang identification model, which specifically includes: Based on the training set, an 8-head graph attention network (GAT) is used to aggregate 1-hop neighborhood features, with subgraph node features as input. 8 sets of independent calculations , , The matrix outputs concatenated features, and parallel judgment is performed using a CUDA kernel. Filter out more than 70% of edges, perform dynamic pruning, retain the top √N edges based on edge weight sorting, apply exponential decay to historical edge weights to enhance recent propagation behavior, and use the loss function as follows: Inject 20% noisy nodes and fake edges, where, Represents the node classification loss. Indicates the loss from edge reconstruction. Indicates the resistance regularization term. This represents the attention weights from node i to node j in the k-th attention head. Represents the Query linear transformation matrix. Represents the linear transformation matrix of Key. Value represents the linear transformation matrix, and N represents the number of nodes.

6. The method according to claim 1, characterized in that, The method further includes: Deploy a distributed Telegram Bot cluster and establish long-connection channels for data collection based on the MTProto2.0 protocol; use Apache Flink to build a processing pipeline to implement a stream processing engine; implement the Barnes-Hut quadtree optimization algorithm based on CUDA and use mixed precision training of FP16+FP32 to achieve GPU acceleration.

7. A real-time identification device for black and gray industry referral groups, characterized in that, include: The dynamic multimodal heterogeneous graph modeling module is used to construct a heterogeneous graph model that includes four types of entity nodes and six types of edge relationships. It calculates edge weights in real time based on the time decay factor λ and dynamically updates the attributes of entity nodes and edges. The multimodal adversarial feature fusion module is used to perform text adversarial enhancement, image adversarial processing, and cross-modal alignment on the heterogeneous graph model based on the cross-modal spoofing characteristics of black and gray industries through an adversarial multimodal encoder. The hierarchical adaptive sampling strategy module is used to perform weighted adaptive hierarchical sampling on the heterogeneous graph model to obtain the final training set. The hierarchical graph attention network module is used to train a hierarchical graph attention network based on the training set to obtain a black and gray market traffic acquisition gang identification model. Based on the black and gray market traffic acquisition gang identification model, it outputs node risk scores, blocks nodes with node risk scores greater than or equal to a predetermined threshold, and generates a cross-platform evidence chain.

8. The apparatus according to claim 7, characterized in that, The device further includes: The real-time streaming architecture module is used to deploy a distributed Telegram Bot cluster. It establishes long-connection channels for data acquisition based on the MTProto2.0 protocol. It uses Apache Flink to build a processing pipeline to implement the streaming engine. It implements the Barnes-Hut quadtree optimization algorithm based on CUDA and uses mixed precision training of FP16+FP32 to achieve GPU acceleration.

9. An electronic device, characterized in that, include: The memory, the processor, and the computer program stored in the memory and executable on the processor, wherein the computer program, when executed by the processor, implements the steps of the real-time identification method for black and gray industry traffic-generating groups as described in any one of claims 1 to 6.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores an information transmission implementation program, which, when executed by a processor, implements the steps of the real-time identification method for black and gray industry referral groups as described in any one of claims 1 to 6.

Images