A cross-platform dark web intelligence dynamic tracking method based on federated learning

Abstract

The application discloses a cross-platform dark web intelligence dynamic tracking method based on federal learning, relates to the technical field of intelligence tracking, and comprises the following steps: a federal server performs weighted average aggregation on encrypted local model parameter gradients, generates a global model update gradient, distributes the global model update gradient to each federal learning client, each federal learning client updates a local model after decryption, and obtains a new generation of global model; when any federal learning client finds a suspicious target, each federal learning client uses the new generation of global model and a local multi-modal feature vector to perform joint reasoning calculation, generates cross-platform related intelligence, and writes the cross-platform related intelligence into a blockchain as a notarization record. The application improves the accuracy of dark web entity correlation, the model convergence speed and the generalization ability through an integrated intelligence tracking method, and also solves the core pain points in the previous methods, such as multi-source information fragmentation, high privacy leakage risk and difficult intelligence solidification.

Description

Technical Field

[0001] This invention relates to the field of intelligence tracking technology, and in particular to a cross-platform dynamic tracking method for dark web intelligence based on federated learning. Background Technology

[0002] Cross-platform intelligence tracking has become an important research direction in the fields of cybersecurity and law enforcement. In recent years, the development of methods such as multi-source heterogeneous data fusion, graph neural networks (GNN), and federated learning has provided new possibilities for achieving efficient and privacy-preserving intelligence analysis. Especially in the dark web monitoring scenario, intelligence sources cover multiple modalities such as dark web forum text, instant messaging images, and blockchain transaction records. There is an urgent need to build an intelligent analysis framework that can collaboratively process multi-modal heterogeneous data. At the same time, federated learning, as a distributed machine learning paradigm, can achieve collaborative model training without sharing the original data, which meets data privacy compliance requirements and has shown advantages in fields such as financial risk control and medical diagnosis.

[0003] Nevertheless, existing methods for tracking dark web intelligence still have room for improvement. First, they are limited to a single data source and lack the ability to jointly model multimodal information such as text, images, and transaction graphs. Second, they generally lack collaborative reasoning and result solidification mechanisms after the discovery of suspicious targets, making it impossible to form a legally valid cross-platform chain of evidence. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a cross-platform dark web intelligence dynamic tracking method based on federated learning to solve the problem of the inability to form a cross-platform related evidence chain.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] This invention provides a cross-platform dynamic tracking method for dark web intelligence based on federated learning, which includes:

[0008] On each federated learning client, a local model is pre-configured, and raw data is collected from a heterogeneous data platform and converted into local multimodal feature vectors;

[0009] After calculating the federated alignment loss function using local multimodal feature vectors, the gradients of the local model parameters for each federated learning client are calculated.

[0010] Each federated learning client uses the Paillier encryption algorithm to encrypt the gradients of its local model parameters before uploading them to the federated server.

[0011] The federated server performs a weighted average aggregation of the encrypted local model parameter gradients to generate the global model update gradient.

[0012] The global model update gradient is distributed to each federated learning client. Each federated learning client decrypts the gradient and updates its local model to obtain the next generation of the global model.

[0013] When any federated learning client discovers a suspicious target, each federated learning client uses a new generation global model and local multimodal feature vectors to perform joint inference calculations, generate cross-platform related intelligence, and write the cross-platform related intelligence as evidence records into the blockchain.

[0014] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, the step of pre-setting a local model on each federated learning client specifically involves:

[0015] Construct a multimodal encoder group and a gated graph attention tracking network to form a local model and initialize it;

[0016] The initialized local model is converted into a local model file in binary stream format through serialization.

[0017] The local model files are distributed to each federated learning client via a secure transmission protocol.

[0018] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, the original data includes dark web forum data, instant messaging platform data, and blockchain network data.

[0019] The multimodal encoder group includes a text encoder, an image encoder, and a transaction graph encoder.

[0020] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, the step of converting the original data into a local multimodal feature vector specifically involves:

[0021] After preprocessing the dark web forum data, it is input into the text encoder of the local model to extract text feature vectors;

[0022] The image encoder that inputs data from the instant messaging platform into the local model is compressed by a global average pooling layer and mapped into an image feature vector.

[0023] The blockchain network data is input into the transaction graph encoder of the local model. The transaction graph encoder is based on the GraphSAGE architecture, which constructs a transaction topology graph and outputs transaction chain topology feature vectors.

[0024] Text feature vectors, image feature vectors, and transaction chain topology feature vectors together constitute the local multimodal feature vector.

[0025] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, the step of calculating the local model parameter gradient of each federated learning client after calculating the federated alignment loss function using local multimodal feature vectors specifically involves:

[0026] The text feature vector, image feature vector, and transaction chain topology feature vector are input into the gating graph attention tracking network for forward propagation to obtain cross-platform association prediction results. The task loss term is calculated based on the cross-platform association prediction results.

[0027] The cosine distance between the text feature vector, image feature vector, and transaction chain topology feature vector in the latent space is used as the intermodal alignment term.

[0028] Based on the local multimodal feature vectors of each federated learning client, combined with the global feature distribution template in the federated server, the distribution alignment term is solved.

[0029] The task loss term, inter-modal alignment term, and distribution alignment term are weighted and summed to generate the federated alignment loss function value.

[0030] The backpropagation algorithm is used to automatically differentiate and calculate the partial derivatives of the federated alignment loss function with respect to the text encoder, image encoder, transaction graph encoder, and gated graph attention tracking network, generating local model parameter gradients.

[0031] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, wherein: each federated learning client encrypts the gradient of its local model parameters using the Paillier encryption algorithm before uploading it to the federated server, specifically:

[0032] Each federated learning client serializes the local model parameter gradients into gradient vectors;

[0033] The public key of the Paillier encryption algorithm is used to perform element-wise homomorphic encryption on the values ​​of each dimension in the gradient vector, generating a ciphertext gradient vector.

[0034] Each federated learning client transmits the encrypted gradient vector to the data receiving interface specified by the federated server.

[0035] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, the federated server performs weighted average aggregation of the encrypted local model parameter gradients to generate the global model update gradient. This means that the federated server extracts the ciphertext gradient vectors uploaded by each federated learning client from the queue to be aggregated, and performs weighted summation on the ciphertext gradient vectors to obtain the global model update gradient.

[0036] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, the step of distributing the global model update gradient to each federated learning client, and each federated learning client decrypting and updating its local model to obtain a new generation of global model, specifically involves:

[0037] Use a federated server to distribute global model update gradients to all federated learning clients;

[0038] After receiving the global model update gradient, each federated learning client uses the private key of the Paillier encryption algorithm to decrypt the global model update gradient and restore the global model update gradient in plaintext.

[0039] Each federated learning client adds the global model update gradient in plaintext state to the current parameters of its local model to obtain a new generation of global model.

[0040] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, wherein: when any federated learning client discovers a suspicious target, each federated learning client uses a new generation global model and local multimodal feature vectors to perform joint inference calculations to generate cross-platform related intelligence, specifically:

[0041] The federated learning client that discovers a suspicious target sends a collaborative reasoning request to the other federated learning clients.

[0042] After receiving a collaborative reasoning request, each federated learning client uses a new generation global model to perform forward computation on the local multimodal feature vectors to generate a local association subgraph.

[0043] Each federated learning client encrypts its local associated subgraph and returns it to the federated learning client that initiated the collaborative reasoning request;

[0044] The federated learning client that initiates the collaborative reasoning request aggregates all encrypted local relational subgraphs, decrypts and merges them, and generates cross-platform relational intelligence.

[0045] As a preferred embodiment of the cross-platform dark web intelligence dynamic tracking method based on federated learning described in this invention, the step of writing cross-platform related intelligence as evidence records into the blockchain specifically includes:

[0046] The Federated Learning client serializes cross-platform related intelligence into standardized data and calculates the hash value of the standardized data as a proof digest.

[0047] The Federated Learning client calls the blockchain smart contract's notarization interface, uploads the notarization summary and the Federated Learning client's digital signature to the blockchain. After the smart contract verifies the validity of the digital signature, it writes the notarization summary into a new block and broadcasts it to all nodes in the blockchain network through the consensus mechanism, forming an immutable cross-platform related intelligence notarization record.

[0048] The beneficial effects of this invention are as follows: By constructing a multimodal federated learning architecture that integrates text, images, and transaction graphs, and combining a gated graph attention tracking network with a triple alignment loss function (task, modality, and distribution), efficient collaborative modeling of cross-platform dark web intelligence is achieved without sharing the original data. Paillier homomorphic encryption is used to ensure the privacy and security of gradient transmission and aggregation processes, balancing computational efficiency and compliance. Furthermore, a dynamic collaborative reasoning mechanism is introduced to trigger multi-node joint analysis when a suspicious target is discovered, and the generated cross-platform related intelligence is written into the blockchain in the form of hash digests and digital signatures, forming an immutable and legally valid chain of evidence. This not only improves the accuracy of dark web entity associations, model convergence speed, and generalization ability, but also solves the core pain points of previous methods, such as fragmented multi-source information, high risk of privacy leakage, and difficulty in solidifying intelligence. Attached Figure Description

[0049] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0050] Figure 1 This is a flowchart of a cross-platform dark web intelligence dynamic tracking method based on federated learning.

[0051] Figure 2 A flowchart for generating local multimodal feature vectors.

[0052] Figure 3 A flowchart for generating gradients for local model parameters.

[0053] Figure 4 A flowchart for generating cross-platform related intelligence. Detailed Implementation

[0054] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0055] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0056] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0057] Reference Figures 1-4 This is one embodiment of the present invention, which provides a cross-platform dark web intelligence dynamic tracking method based on federated learning, including the following steps:

[0058] S1. On each federated learning client, a local model is pre-configured, and raw data is collected from a heterogeneous data platform and converted into a local multimodal feature vector.

[0059] S1.1 Construct a multimodal encoder group and a gated graph attention tracking network to form a local model and initialize the local model;

[0060] It should be noted that the text encoder, image encoder, and transaction graph encoder in the multimodal encoder group are instantiated separately, and a gated graph attention tracking network is created simultaneously. Specifically, the gated graph attention tracking network is set to consist of a gate weight matrix and a multi-head attention layer; the sum of the dimensions of the text feature vector, image feature vector, and transaction chain topology feature vector is used as the input dimension of the gate weight matrix, and the output dimension is determined according to the hidden layer dimension of the gated graph attention tracking network. An orthogonal matrix satisfying the orthogonality condition is generated using an orthogonal initialization algorithm, and this orthogonal matrix is ​​set as the initial parameter of the gate weight matrix; the query projection matrix, key projection matrix, and value projection matrix of the multi-head attention layer are constructed and initialized using the He initialization method; the gate weight matrix is ​​then compared with the query projection matrix, The key projection matrix and value projection matrix are hierarchically connected according to the gated graph attention tracking network architecture to form a complete gated graph attention tracking network. The word embedding matrix and Transformer layer weights of the RoBERTa-base model are loaded onto the text encoder, and the kernel parameters and batch normalization layer parameters of all convolutional layers in the EfficientNetV2 model are loaded onto the image encoder. The Xavier uniform initialization method is used to generate the weight tensors and bias vectors of all graph convolutional layers for the GraphSAGE network of the transaction graph encoder. Specifically, for the input and output feature dimensions of each graph convolutional layer in the GraphSAGE network of the transaction graph encoder, the boundary values ​​required for Xavier uniform initialization are calculated, expressed by the formula:

[0061] ;

[0062] in, This represents the boundary values ​​required for uniform Xavier initialization. This indicates the input feature dimension of the graph convolutional layer. This indicates the output feature dimension of the graph convolutional layer;

[0063] Based on the boundary values ​​required for uniform initialization by Xavier, each graph convolutional layer of the GraphSAGE network randomly samples to generate a weight tensor of the corresponding shape, and initializes the bias vector of each graph convolutional layer with zero values; the initialized weight tensor and bias vector are set as parameters of the transaction graph encoder GraphSAGE network; the initialized multimodal encoder group and the gated graph attention tracking network are combined into a complete local model.

[0064] It should also be noted that the word embedding matrix and Transformer layer weights of the RoBERTa-base model, as well as the kernel parameters and batch normalization layer parameters of all convolutional layers in the EfficientNetV2 model, can be obtained through public platforms such as Hugging-Face and TensorFlow.

[0065] The text encoder weight matrix, image encoder convolution kernel parameters, transaction graph encoder GraphSAGE network parameters, and gated graph attention tracking network parameters of the multimodal encoder group are unfolded into a one-dimensional tensor according to the memory layout. Then, the one-dimensional tensor, along with the local model metadata, is encoded into a binary stream using the Google-Protocol-Buffers serialization library. Magic number identifier and version number information are added to the header of the binary stream to generate a local model file with complete parsing information, which is then distributed to each federated learning client through a secure transmission protocol.

[0066] The Federated Learning client accesses dark web forum RSS feeds to obtain dark web forum data by configuring a crawler with dynamic request intervals; it subscribes to specified encrypted channels using a certified Telegram bot token to capture instant messaging platform data; and it calls the blockchain node's JSON-RPC interface to synchronize transaction records in the latest block, thereby obtaining blockchain network data.

[0067] S1.2. After preprocessing the dark web forum data, input it into the local model's text encoder to extract text feature vectors;

[0068] It should be noted that the collected dark web forum data undergoes HTML tag removal and special character filtering. A byte-pair encoding algorithm is used to convert the cleaned dark web forum data into a word sequence. Specifically, using a byte-pair encoding vocabulary, a greedy matching algorithm is applied to the cleaned dark web forum data, merging the character sequences in the data level by level into the highest frequency subwords. According to the mapping rules of the byte-pair encoding vocabulary, the merged subwords are converted into corresponding numeric identifiers. In other words, the dark web forum data is transformed into a word sequence composed of numeric identifiers, completing the conversion from text to numerical representation. The word sequence is padded to a fixed length (e.g., 486) and then input into the local model's text encoder. The RoBERTa-base architecture of the text encoder performs self-attention calculations through 12 Transformer layers, extracting the [CLS]-tagged vector from the last hidden state as the text feature vector.

[0069] A fixed length (e.g., 486) is set based on an optimal balance between the statistical characteristics of the data itself, the structural limitations of the local model, and computational efficiency.

[0070] The process of constructing a byte-pair encoded vocabulary is as follows: prepare a large-scale text corpus, count the frequency of occurrence of all character pairs in the corpus, iteratively merge the most frequent character pairs to form new sub-word units, and update the representation of the text corpus; repeat the merging process, and combine the basic characters, all sub-word units generated by merging, and special tags to form a byte-pair encoded vocabulary.

[0071] S1.3 Input the instant messaging platform data into the local model's image encoder, compress it through a global average pooling layer, and then map it into an image feature vector;

[0072] It should be noted that the images in the instant messaging platform data are input into the EfficientNetV2 architecture of the image encoder. After feature extraction through the backbone convolutional layer, the output feature map is entered into the global average pooling layer for spatial dimension compression to generate channel feature vectors. The channel feature vectors are then mapped to 3D image feature vectors through the fully connected layer.

[0073] S1.4 Input blockchain network data into the transaction graph encoder of the local model. The transaction graph encoder is based on the GraphSAGE architecture, constructs a transaction topology graph and outputs transaction chain topology feature vectors.

[0074] It should be noted that the transaction records in the blockchain network data are parsed into nodes and edges of the transaction topology graph. That is, the input and output addresses in the transaction records are extracted as nodes of the transaction topology graph, and the fund transfer relationships are constructed as directed edges of the transaction topology graph to form the transaction topology graph. The transaction topology graph is input into the GraphSAGE architecture of the transaction graph encoder. The GraphSAGE architecture updates the node representation by sampling neighbor nodes and aggregating the features of neighbor nodes and performing graph convolution operations. After multiple layers of graph convolution, the feature vectors of the nodes in the transaction topology graph are read out to output a 256-dimensional transaction chain topology feature vector.

[0075] The text feature vector, image feature vector, and transaction chain topology feature vector are combined to form the local multimodal feature vector.

[0076] S2. After calculating the federated alignment loss function using local multimodal feature vectors, calculate the gradient of the local model parameters for each federated learning client.

[0077] S2.1 Input the text feature vector, image feature vector and transaction chain topology feature vector into the gated graph attention tracking network for forward propagation to obtain the cross-platform association prediction result. Based on the cross-platform association prediction result, the task loss term is calculated.

[0078] It should be noted that the text feature vector, image feature vector, and transaction chain topology feature vector are input into the local model's gated graph attention tracking network. The gating mechanism of the gated graph attention tracking network assigns weights to the text feature vector, image feature vector, and transaction chain topology feature vector. Specifically, the text feature vector, image feature vector, and transaction chain topology feature vector are concatenated into a fused feature vector, which is then multiplied with the gating weight matrix of the gated graph attention tracking network. The result of the matrix multiplication is added to the bias vector of the gated graph attention tracking network to obtain the initial gating values ​​of the text feature vector, image feature vector, and transaction chain topology feature vector. The initial gating values ​​are compressed to the 0-1 range using the Sigmoid activation function, and the gating weights of the text feature vector, image feature vector, and transaction chain topology feature vector are output respectively. The text feature vector, image feature vector, and transaction chain topology feature vector are then multiplied element-wise with their corresponding gating weights to achieve weighting. The weighted feature vectors are input into the multi-head attention layer to calculate the cross-modal association weights. After the features of neighboring nodes are aggregated by the graph convolutional layer, the dark web entity association probability is output by the fully connected layer as the cross-platform association prediction result.

[0079] The cross-platform association prediction results are compared with the true labels, and the cross-entropy loss function is used to calculate the difference between the distribution of the cross-platform association prediction results and the distribution of the true labels; the difference value is the numerical result of the task loss term, expressed by the formula:

[0080] ;

[0081] in, This represents the numerical result of the task loss item. This represents the total number of samples (i.e., the number of text feature vectors, image feature vectors, transaction chain topology feature vectors, and real labels). This represents the total number of categories in the classification task. This represents the one-hot encoding of the real label. This indicates that the gating graph attention tracking network is focused on samples. Category The predicted probability;

[0082] It should also be noted that the real tags are generated through a three-level progressive annotation process: The first level extracts forum administrator accounts, cryptocurrency addresses, and product lists from publicly available dark web market seizure reports and blockchain forensics analysis reports to construct an initial seed tag set; The second level activates a cross-platform behavioral time-series analysis engine to align new transaction posts on dark web forums, encrypted messages on Telegram channels, and new transaction records on the blockchain in real time. When a transaction address is detected in a forum post, and multiple coin mixing transactions occur at this address within a specific time window, and a corresponding logistics number subsequently appears on the Telegram channel, a high-confidence pseudo-tag is automatically generated; The third level uses an interactive annotation interface deployed locally on the federated learning client to push low-confidence association clues from the gating graph attention tracking network output to compliance auditors. Auditors combine external intelligence to confirm or correct the address-user relationship; Finally, the results of the three levels of annotation are integrated through a weighted voting mechanism to form real tags that include two-way verification relationships. Specifically, low-confidence association cues output by the gated graph attention tracking network refer to those where, after the text feature vector, image feature vector, and transaction chain topology feature vector are computed in the multi-head attention layer of the gated graph attention tracking network, the highest probability value of the output cross-platform association prediction result is lower than a threshold (e.g., 0.85). Such association prediction results are considered low-confidence association cues. These cues require verification by compliance auditors to prevent incorrect labels from interfering with the federated alignment loss function.

[0083] The threshold value of 0.85 is set based on the balance between model performance and business risk; because when the highest probability value of the cross-platform correlation prediction result is lower than the threshold value of 0.85, the false alarm rate increases significantly.

[0084] S2.2 Calculate the cosine distance in the latent space of the text feature vector, image feature vector, and transaction chain topology feature vector as the inter-modal alignment term;

[0085] It should be noted that the text feature vector, image feature vector, and transaction chain topology feature vector are projected onto a latent space of uniform dimension through a fully connected layer; the cosine distance between the text feature vector and the image feature vector, the cosine distance between the text feature vector and the transaction chain topology feature vector, and the cosine distance between the image feature vector and the transaction chain topology feature vector are calculated in the latent space; the arithmetic mean of the three cosine distances is used as the numerical result of the inter-modal alignment term, expressed by the formula:

[0086] ;

[0087] in, This represents the numerical result of the intermodal alignment term. This represents the function for calculating cosine distance. This represents the projection of the text feature vector into the latent space. This represents the projection of the image feature vector into the latent space. This represents the projection of the transaction chain topological feature vector into the latent space;

[0088] S2.3. Based on the local multimodal feature vectors of each federated learning client, and combined with the global feature distribution template in the federated server, solve for the distribution alignment term;

[0089] It should be noted that the federated learning client represents the local multimodal feature vector distribution (the projection distribution of text feature vectors, image feature vectors, and transaction chain topology feature vectors in the latent space) as a kernel mean embedding; the global feature distribution template provided by the federated server is distributed in the form of a reference kernel mean embedding; the federated learning client uses the maximum mean difference algorithm to calculate the distance between the kernel mean embedding of the local multimodal feature vector distribution and the reference kernel mean embedding of the global feature distribution template in the regenerating kernel Hilbert space. The distance result is the numerical solution of the distribution alignment term, expressed by the formula:

[0090] ;

[0091] in, The distance between the kernel mean embedding of the local multimodal feature vector distribution and the reference kernel mean embedding of the global feature distribution template in the reproducing kernel Hilbert space is represented. The first term of the federated learning client One local multimodal feature vector (text, image, and transaction chain topology feature vector). This represents the number of samples in the local multimodal feature vector. This represents the number of samples in the global feature distribution template. This represents the first in the global feature distribution template of the federated server. 1 eigenvector Represents the feature mapping function. Represents the regenerated nucleus Hilbert space;

[0092] The task loss term, inter-modal alignment term, and distribution alignment term are weighted and summed to generate the federated alignment loss function value.

[0093] S2.4. Use the backpropagation algorithm to automatically differentiate and calculate the partial derivatives of the federated alignment loss function with respect to the text encoder, image encoder, transaction graph encoder, and gated graph attention tracking network to generate local model parameter gradients.

[0094] It should be noted that the partial derivatives of the federated alignment loss function value and the cross-platform correlation prediction result are calculated to form the initial gradient, which is expressed by the formula:

[0095] ;

[0096] in, Represents partial derivatives, Represents the partial differential symbol. This represents the value of the federated alignment loss function. This represents the cross-platform association prediction results output by the gating graph attention tracking network;

[0097] After the initial gradient propagates back through the fully connected layer, the multi-head attention layer, and the gating mechanism layer within the gated graph attention tracking network, the partial derivatives of the text feature vector, image feature vector, and transaction chain topology feature vector are calculated using the aforementioned partial derivative calculation formula. The partial derivatives of the text feature vector, image feature vector, and transaction chain topology feature vector are then used as the gradient.

[0098] The gradients of the text feature vector, image feature vector, and transaction chain topology feature vector are backpropagated to the Transformer layer of the text encoder, the convolutional layer of the image encoder, and the GraphSAGE graph convolutional layer of the transaction graph encoder, respectively. Through this chain-like layer-by-layer accumulation, the partial derivatives of the federated alignment loss function value with respect to the weights of the text encoder, image encoder, transaction graph encoder, and gated graph attention tracking network are generated, which together constitute the gradients of the local model parameters.

[0099] It should also be noted that the "weights" in the text encoder weights, image encoder weights, transaction graph encoder weights, and gated graph attention tracking network weights are not numerical values, but rather a huge high-dimensional tensor. For example, the "text encoder weights" include all the knowledge that the RoBERTa model has to understand the semantics of dark web forum texts.

[0100] S3. Each federated learning client uses the Paillier encryption algorithm to encrypt the gradient of the local model parameters before uploading it to the federated server.

[0101] S3.1 Each federated learning client serializes the local model parameter gradients into gradient vectors;

[0102] It should be noted that the weight gradients of the text encoder, image encoder, transaction graph encoder, and gated graph attention tracking network are sequentially expanded into one-dimensional floating-point arrays in the memory of each federated learning client. After the one-dimensional floating-point arrays are encoded into byte stream format through a serialization protocol, the corresponding gradient dimension information is added to form gradient vectors.

[0103] S3.2. Use the public key of the Paillier encryption algorithm to perform element-wise homomorphic encryption on the values ​​of each dimension in the gradient vector to generate the ciphertext gradient vector.

[0104] It should be noted that the federated learning client loads the Paillier encryption algorithm public key, converts each floating-point value in the gradient vector into an integer format supported by the Paillier encryption algorithm, performs modular exponentiation on each integer gradient value using the Paillier encryption algorithm public key to generate the corresponding ciphertext value, and combines all ciphertext values ​​in the original dimension order of the gradient vector to form the ciphertext gradient vector.

[0105] Establish a two-way authenticated TLS secure communication channel between the federated learning client and the federated server; encapsulate the ciphertext gradient vector into a data packet through the TLS secure channel, and send the data packet to the REST API interface address of the federated server.

[0106] S4. The federated server performs a weighted average aggregation of the encrypted local model parameter gradients to generate the global model update gradient.

[0107] It should be noted that the federated server polls the aggregation queue in rounds, extracting the ciphertext gradient vectors corresponding to each federated learning client in the order of receipt; after counting the number of samples from each federated learning client (i.e., the number of text feature vectors, image feature vectors, transaction chain topology feature vectors, and real labels), it sums them to obtain the total number of samples; it calculates the proportion of each federated learning client's sample count in the total number of samples, normalizes the proportion of each federated learning client into a weight coefficient, and ensures that the sum of all weight coefficients is 1. Utilizing the additive homomorphic property of the Paillier encryption algorithm, the ciphertext values ​​of the ciphertext gradient vectors in the federated learning clients are subjected to modular exponentiation with the corresponding weight coefficients, and then element-wise modular multiplication and accumulation are performed on all ciphertext gradient vectors to output the global model update gradient, which is still in the Paillier ciphertext state.

[0108] S5. Distribute the global model update gradient to each federated learning client. Each federated learning client decrypts the gradient and updates its local model to obtain the next generation of global model.

[0109] S5.1 It should be noted that the federated server encapsulates the global model update gradient of the Paillier ciphertext state into a broadcast data packet; the federated server pushes the broadcast data packet in parallel to the communication endpoints of all online federated learning clients through a load balancer; after receiving the broadcast data packet, each federated learning client verifies the data integrity and extracts the global model update gradient from it.

[0110] S5.2 After receiving the global model update gradient, each federated learning client uses the private key of the Paillier encryption algorithm to decrypt the global model update gradient and restore the global model update gradient in plaintext.

[0111] It should be noted that after the federated learning client loads the private key for the Paillier encryption algorithm, it inputs each ciphertext value in the global model update gradient of the Paillier ciphertext state into the Paillier encryption algorithm decryption function; the decryption function performs modular exponentiation to restore each ciphertext value to its corresponding plaintext gradient value, expressed by the formula:

[0112] ;

[0113] in, Represents the plaintext gradient value. This represents the ciphertext value that needs to be decrypted. Operators that represent modulo operations, Represents the modulus of the public key. This represents the private key parameter. Indicates the decryption auxiliary value;

[0114] All decrypted plaintext gradient values ​​are recombined according to their original dimensions to form a global model update gradient.

[0115] It should also be noted that the public key modulus, private key parameters, and decryption auxiliary value are key pairs for the Paillier encryption algorithm, which are automatically and dynamically generated by the federated server through its built-in key management service when a new federated learning task is detected.

[0116] S5.3 Each federated learning client adds the global model update gradient in plaintext state to the current parameters of the local model to obtain the next generation global model;

[0117] It should be noted that the federated learning client expands the global model update gradient in plaintext state into a gradient vector in parameter index order, and simultaneously expands the current parameters of the local model into a parameter vector in the same order; performs element-wise addition on the gradient vector and parameter vector to generate the updated parameter vector; based on the updated parameter vector, extracts the parameter segments of the corresponding text encoder weight dimension according to the preset index segmentation rules and reconstructs them into the Transformer layer weight matrix of the text encoder; extracts the parameter segments of the corresponding image encoder weight dimension and reconstructs them into the convolutional kernel tensor of the image encoder; extracts the parameter segments of the corresponding transaction graph encoder weight dimension and reconstructs them into the GraphSAGE graph convolutional layer parameters of the transaction graph encoder; extracts the parameter segments of the corresponding gated graph attention tracking network weight dimension and reconstructs them into the gated weight matrix and attention parameter tensor; finally, the parameter updates of each component are completed.

[0118] It should also be noted that the preset index segmentation rule refers to recording the starting index position and tensor shape of each parameter block in a fixed order when serializing the local model parameters into gradient vectors, following the text encoder weights, image encoder weights, transaction graph encoder weights, and gated graph attention tracking network weights. This information is stored in a dictionary structure, including four fields: parameter block name, starting index, ending index, and original tensor shape. During deserialization, by querying this index segmentation rule, the position boundary and data structure of each parameter block in the vector can be accurately restored.

[0119] S6. When any federated learning client discovers a suspicious target, each federated learning client uses a new generation global model and local multimodal feature vectors to perform joint inference calculations, generate cross-platform related intelligence, and write the cross-platform related intelligence as evidence records into the blockchain.

[0120] S6.1 The federated learning client that discovers a suspicious target sends a collaborative reasoning request to the other federated learning clients;

[0121] It should be noted that the federated learning client that discovers a suspicious target generates a collaborative inference request data packet including the suspicious target's feature hash and timestamp; the collaborative inference request data packet is broadcast to all online federated learning clients through a federated server relay or peer-to-peer communication channel; after verifying the digital signature and format validity of the collaborative inference request data packet, the receiving federated learning client extracts the suspicious target's feature hash for local inference computation.

[0122] S6.2 After receiving the collaborative inference request, each federated learning client uses the next-generation global model to perform forward computation on the local multimodal feature vectors and generate a local association subgraph.

[0123] It should be noted that the federated learning client loads the gated graph attention tracking network in the next-generation global model and inputs the local multimodal feature vectors (text feature vectors, image feature vectors, and transaction chain topology feature vectors) into the gated graph attention tracking network. The gated graph attention tracking network outputs entity nodes and edge relationships that are potentially associated with the suspicious target through gated weighted fusion and multi-head attention calculation, i.e., the local associated subgraph.

[0124] S6.3 Each federated learning client encrypts its local associated subgraph and returns it to the federated learning client that initiated the collaborative reasoning request;

[0125] It should be noted that each federated learning client uses an asymmetric encryption public key to encrypt structured data such as node attributes, edge relationships, and confidence levels of the local associated subgraph, encapsulates it into a standardized response data packet, and transmits it through a secure communication channel to the message queue specified by the federated learning client that initiated the collaborative inference request.

[0126] S6.4 The federated learning client that initiates the collaborative reasoning request aggregates all encrypted local relational subgraphs, decrypts and merges them, and generates cross-platform relational intelligence;

[0127] It should be noted that the federated learning client initiating the collaborative inference request sequentially retrieves the encrypted response data packets returned by each federated learning client from the message queue. Simultaneously, it decrypts each encrypted response data packet using its own asymmetric encryption private key, reconstructing the local association subgraph of each federated learning client. After aligning the nodes of different local association subgraphs using a graph fusion algorithm, overlapping nodes and edges are identified. For identical edges from different local association subgraphs, the confidence value attached to each edge is extracted, and a weighted average algorithm is used to calculate the overall association strength. The association threshold is set to 0.85, and all edges in the global association graph are traversed. Edges with an overall association strength below 0.85 are marked as unobservable edges and temporarily discarded, while edges with an overall association strength greater than or equal to 0.85 are retained to form a high-confidence subgraph. A breadth-first search algorithm is executed on the high-confidence subgraph with the suspected target as the root node to extract all association paths with a depth not exceeding three hops. The path weight is calculated for each association path, and the path weight is obtained by using a geometric average algorithm based on the overall association strength of each edge in the path, expressed by the formula:

[0128] ;

[0129] in, Indicates path weight, Indicates the first in the path The overall correlation strength of the edges, Indicates the total number of edges in the path (path length);

[0130] Arrange the paths in descending order of weight to generate cross-platform related intelligence.

[0131] The association threshold of 0.85 is a quantitative standard determined by the balance principle of precision and recall and the tolerance for business risks in the federated learning scenario.

[0132] "Three-hop" is a term in graph theory and network analysis used to describe the length or range of a path, figuratively representing the number of "jumps" a relationship takes to propagate from one node to another.

[0133] S6.5 The Federated Learning Client serializes cross-platform related intelligence into standardized data and calculates the hash value of the standardized data as a proof digest.

[0134] It should be noted that the Federated Learning client converts the entity relationship mapping, fund flow path, and risk rating level in cross-platform related intelligence into a byte stream according to the JSON-LD standard format; it then uses the SHA-256 hash algorithm to calculate a fixed-length hash value for the serialized byte stream, expressed by the formula:

[0135] ;

[0136] in, SHA-256 represents a cryptographic hash function, indicating a hash value. Represents a byte stream;

[0137] Use hash values ​​as evidence digests for cross-platform related intelligence.

[0138] The Federated Learning client calls the blockchain smart contract's notarization interface, uploads the notarization summary and the Federated Learning client's digital signature to the blockchain. After the smart contract verifies the validity of the digital signature, it writes the notarization summary into a new block and broadcasts it to all nodes in the blockchain network through the consensus mechanism, forming an immutable cross-platform related intelligence notarization record.

[0139] This embodiment also provides a computer device applicable to the cross-platform dark web intelligence dynamic tracking method based on federated learning, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to realize the cross-platform dark web intelligence dynamic tracking method based on federated learning proposed in the above embodiment.

[0140] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0141] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the cross-platform dark web intelligence dynamic tracking method based on federated learning as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0142] In summary, this invention achieves efficient collaborative modeling of dark web intelligence across platforms without sharing original data by constructing a multimodal federated learning architecture that integrates text, images, and transaction graphs, combining a gated graph attention tracking network with a triple alignment loss function (task, modality, and distribution). It utilizes Paillier homomorphic encryption to ensure privacy and security during gradient transmission and aggregation, balancing computational efficiency and compliance. Furthermore, it introduces a dynamic collaborative reasoning mechanism that triggers multi-node joint analysis upon discovering suspicious targets, and writes the generated cross-platform related intelligence into the blockchain in the form of hash digests and digital signatures, forming an immutable and legally valid chain of evidence. This not only improves the accuracy of dark web entity associations, model convergence speed, and generalization ability, but also solves the core pain points of previous methods, such as fragmented multi-source information, high privacy leakage risks, and difficulty in solidifying intelligence.

[0143] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A cross-platform dynamic tracking method for dark web intelligence based on federated learning, characterized in that: include, On each federated learning client, a local model is pre-configured, and raw data is collected from a heterogeneous data platform. The raw data is then converted into local multimodal feature vectors, specifically: After preprocessing the dark web forum data, it is input into the text encoder of the local model to extract text feature vectors; The image encoder that inputs data from the instant messaging platform into the local model is compressed by a global average pooling layer and mapped into an image feature vector. The blockchain network data is input into the transaction graph encoder of the local model. The transaction graph encoder is based on the GraphSAGE architecture, which constructs a transaction topology graph and outputs transaction chain topology feature vectors. Text feature vectors, image feature vectors, and transaction chain topology feature vectors together constitute the local multimodal feature vector; After calculating the federated alignment loss function using local multimodal feature vectors, the gradients of the local model parameters for each federated learning client are calculated. Each federated learning client uses the Paillier encryption algorithm to encrypt the gradients of its local model parameters before uploading them to the federated server. The federated server performs a weighted average aggregation of the encrypted local model parameter gradients to generate the global model update gradient, specifically: The text feature vector, image feature vector, and transaction chain topology feature vector are input into the gating graph attention tracking network for forward propagation to obtain cross-platform association prediction results. The task loss term is calculated based on the cross-platform association prediction results. The cosine distance between the text feature vector, image feature vector, and transaction chain topology feature vector in the latent space is used as the intermodal alignment term. Based on the local multimodal feature vectors of each federated learning client, combined with the global feature distribution template in the federated server, the distribution alignment term is solved. The task loss term, inter-modal alignment term, and distribution alignment term are weighted and summed to generate the federated alignment loss function value. The backpropagation algorithm is used to automatically differentiate and calculate the partial derivatives of the federated alignment loss function with respect to the text encoder, image encoder, transaction graph encoder, and gated graph attention tracking network, generating local model parameter gradients. The global model update gradient is distributed to each federated learning client. Each federated learning client decrypts the gradient and updates its local model to obtain the next generation of the global model. When any federated learning client detects a suspicious target, all federated learning clients use a new generation global model and local multimodal feature vectors to perform joint inference calculations and generate cross-platform related intelligence, specifically: The federated learning client that discovers a suspicious target sends a collaborative reasoning request to the other federated learning clients. After receiving a collaborative reasoning request, each federated learning client uses a new generation global model to perform forward computation on the local multimodal feature vectors to generate a local association subgraph. Each federated learning client encrypts its local associated subgraph and returns it to the federated learning client that initiated the collaborative reasoning request; The federated learning client that initiates the collaborative reasoning request aggregates all encrypted local relational subgraphs, decrypts and merges them, and generates cross-platform relational intelligence. Cross-platform related intelligence will be written into the blockchain as evidence.

2. The cross-platform dark web intelligence dynamic tracking method based on federated learning as described in claim 1, characterized in that: The provision of a pre-configured local model on each federated learning client specifically includes: Construct a multimodal encoder group and a gated graph attention tracking network to form a local model and initialize it; The initialized local model is converted into a local model file in binary stream format through serialization. The local model files are distributed to each federated learning client via a secure transmission protocol.

3. The cross-platform dark web intelligence dynamic tracking method based on federated learning as described in claim 2, characterized in that: The raw data includes dark web forum data, instant messaging platform data, and blockchain network data; The multimodal encoder group includes a text encoder, an image encoder, and a transaction graph encoder.

4. The cross-platform dark web intelligence dynamic tracking method based on federated learning as described in claim 3, characterized in that: Each federated learning client encrypts the gradients of its local model parameters using the Paillier encryption algorithm before uploading them to the federated server. Specifically: Each federated learning client serializes the local model parameter gradients into gradient vectors; The public key of the Paillier encryption algorithm is used to perform element-wise homomorphic encryption on the values ​​of each dimension in the gradient vector, generating a ciphertext gradient vector. Each federated learning client transmits the encrypted gradient vector to the data receiving interface specified by the federated server.

5. The cross-platform dark web intelligence dynamic tracking method based on federated learning as described in claim 4, characterized in that: The federated server performs a weighted average aggregation of the encrypted local model parameter gradients to generate the global model update gradient. This means that the federated server extracts the encrypted gradient vectors uploaded by each federated learning client from the aggregation queue, and performs a weighted summation of the encrypted gradient vectors to obtain the global model update gradient.

6. The cross-platform dark web intelligence dynamic tracking method based on federated learning as described in claim 5, characterized in that: The process of distributing the global model update gradient to each federated learning client, and then each federated learning client decrypting and updating its local model to obtain the next-generation global model, is as follows: Use a federated server to distribute global model update gradients to all federated learning clients; After receiving the global model update gradient, each federated learning client uses the private key of the Paillier encryption algorithm to decrypt the global model update gradient and restore the global model update gradient in plaintext. Each federated learning client adds the global model update gradient in plaintext state to the current parameters of its local model to obtain a new generation of global model.

7. The cross-platform dark web intelligence dynamic tracking method based on federated learning as described in claim 6, characterized in that: The specific steps for writing cross-platform related intelligence as evidence records into the blockchain are as follows: The Federated Learning client serializes cross-platform related intelligence into standardized data and calculates the hash value of the standardized data as a proof digest. The Federated Learning client calls the blockchain smart contract's notarization interface, uploads the notarization summary and the Federated Learning client's digital signature to the blockchain. After the smart contract verifies the validity of the digital signature, it writes the notarization summary into a new block and broadcasts it to all nodes in the blockchain network through the consensus mechanism, forming an immutable cross-platform related intelligence notarization record.

Images