Network abnormal user identification method and device based on dynamic evolution, equipment and storage medium

Abstract

The application provides a network abnormal user identification method and device based on dynamic evolution, equipment and storage medium, which constructs a multi-dimensional quantitative portrait of "basic features-content features-social features" through fine preprocessing of multi-platform user full-dimensional data; outputs a user comprehensive credibility value based on the improved XGBoost algorithm and the fusion of multi-dimensional features; constructs an attributed social knowledge graph, introduces five types of dynamic evolution factors, namely trend factor, cycle factor, random factor, autocorrelation factor and external variable factor, and realizes dynamic behavior capture combined with hierarchical time complexity optimization strategy; calibrates individual credibility value by fusing social correlation through confidence propagation, calculates propagation probability combined with total time complexity decay, and finally realizes accurate identification of individual and group anomalies through abnormal score.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to the cross-application of user behavior analysis and anomaly detection technologies. It is particularly applicable to scenarios such as social media platforms, e-commerce platforms, and news information platforms for the identification and management of abnormal users and abnormal user groups. It can be deployed on the platform's backend real-time monitoring system or third-party network security governance tools to provide technical support for the construction of a clean cyberspace. Background Technology

[0002] 1. The business problem being addressed

[0003] With the widespread use of social networks and e-commerce platforms, malicious users are causing serious damage to the online ecosystem by registering accounts in bulk, posting false content, and manipulating social relationships.

[0004] Existing technologies need to analyze user behavior, social relationships, and content characteristics to accurately identify abnormal users, curb the spread of false information at the source, and protect public rights and market fairness.

[0005] 2. Key technical problems

[0006] Existing abnormal user identification technologies have four major flaws:

[0007] Lagging behavioral evolution: Abnormal users constantly adjust their behavioral patterns to evade detection. Traditional static models, trained on historical data, are difficult to adapt to dynamic changes, resulting in a false negative rate of over 15%.

[0008] Group identification is difficult: Most solutions focus on individual behavior analysis and cannot identify abnormal groups that "collaborate on multiple accounts". The influence of such groups on false information is 5-10 times that of individuals.

[0009] High false positive rate: The influence of social relationships is not considered, and the probability of normal users being falsely identified as users with abnormal following / interactions exceeds 20%.

[0010] Large-scale inefficiency: When processing data from millions of users, a single identification takes more than 2 hours, which cannot meet the business requirements of "real-time monitoring and immediate intervention". Summary of the Invention

[0011] To address the above problems, this invention provides a method for identifying abnormal network users based on dynamic evolution, comprising the following steps:

[0012] Step 1: Collect and refine multi-dimensional user data from multiple platforms, filter and obtain physical parameters that are strongly correlated with abnormal user behavior, and remove invalid interference data through cleaning;

[0013] Step 2: Construct a multi-dimensional feature profile of users with network anomalies. Transform the collected structured data into quantifiable anomaly feature indicators and construct user profiles from multiple dimensions, including basic behavior, content quality, and social relationships.

[0014] Step 3: Construct a comprehensive user trust measurement model, which includes:

[0015] Integrating multi-dimensional social features, and through standardized processing and improvement The algorithm determines the feature weights and outputs a comprehensive confidence value;

[0016] Step 4: Knowledge graph construction and dynamic evolution factor fusion calculation. An attribute-based knowledge graph storing social features and relationships is constructed. Five types of dynamic evolution physical factors are introduced to capture temporal anomalies in user behavior within the knowledge graph. A time complexity optimization strategy ensures computational efficiency. Confidence values ​​are calibrated through confidence propagation to achieve accurate identification of dynamic and group anomalies. Specifically, this includes:

[0017] Step 4.1: Construct an attribute-based social knowledge graph;

[0018] Step 4.2: Calculate five types of dynamic evolution factors based on user behavior, set five types of factors according to trend, cycle, randomness, autocorrelation and external variables, and capture behavioral time series anomalies respectively;

[0019] Step 4.3: Confidence propagation and anomaly score calculation. Combining the user's comprehensive confidence value and dynamic evolution factor, the initial confidence is calculated to obtain the user's initial anomaly suspicion. Then, the confidence propagation calculation is performed, and the confidence propagation probability is calculated by integrating the total time complexity. Finally, the user's anomaly score is obtained based on the anomaly calculation and propagation probability of the dynamic evolution factor.

[0020] Step 5: Output the identification results and iteratively optimize the model. Output the anomaly identification results and continuously iterate and optimize the model parameters to adapt to the dynamic evolution of abnormal behavior.

[0021] Specifically, in step 1, a collection period is set to obtain and acquire user registration duration, user account authentication level, number of logged-in devices, number of posts per unit time, comment response duration, like decision delay, text semantic entropy, image tampering probability, and video watermark integrity.

[0022] Specifically, in step 2, the user's basic behavior includes the account activity index; the quality of the content published by the user includes the average content similarity; and the user's social relationships include node degree, friend-follower ratio coefficient, and social interaction health.

[0023] Specifically, in step 3, the user's comprehensive trust value is calculated after standardizing the multidimensional features, i.e.:

[0024]

[0025] in, This represents the weight corresponding to each feature. Indicates the first Standard values ​​for the social characteristics of each user.

[0026] Specifically, in step 4.1, when constructing the knowledge graph, the identity attributes in step 1, the multi-dimensional features in step 2, and the comprehensive confidence value in step 3 are obtained, and basic data is provided for the calculation of dynamic evolution factors and the propagation of confidence.

[0027] Specifically, in step 4.2, the trend factor is used to quantify the long-term trend of behavior and capture abnormal situations caused by short-term outbreaks; the periodic factor is used to quantify the periodicity of behavior; the random factor is used to quantify the degree of random fluctuation of behavior; the autocorrelation factor is used to quantify the correlation strength between current and historical behavior and capture low correlation anomalies; and the external variable factor is used to quantify the impact of external events on user behavior and capture over-response anomalies.

[0028] Specifically, in step 4.3, the initial confidence level is calculated based on the standardized dynamic evolution factors and the user's comprehensive confidence value. The weighted sum of the neighbor nodes and the edge weights of the neighbor node set in the knowledge graph are obtained. The confidence level after propagation is updated iteratively in this way. The confidence level propagation probability is obtained through the total time complexity, the time complexity decay coefficient, and the updated confidence level. Finally, the user's abnormal score is obtained based on the abnormal calculation and propagation probability of the dynamic evolution factors. The total time complexity is calculated by the time complexity of the five types of dynamic evolution factors and the time complexity of confidence level propagation.

[0029] This invention also provides a method for identifying anomalous network users based on dynamic evolution, specifically including the following modules: a data collection and preprocessing module, a multi-dimensional feature profiling module, a user comprehensive credibility quantification module, a knowledge graph construction and dynamic evolution factor fusion calculation module, and an identification result output and model iteration optimization module. The device includes a processor and a memory: the memory stores program code and transmits the program code to the processor, which executes the aforementioned method for identifying anomalous network users based on dynamic evolution according to the instructions in the program code.

[0030] The present invention also provides a computer device, characterized in that the computer device includes a processor and a memory: the memory is used to store program code and transmit the program code to the processor, the processor is used to execute the above-described method for identifying abnormal network users based on dynamic evolution according to the instructions in the program code.

[0031] The present invention also provides a computer-readable storage medium, characterized in that the computer-readable storage medium is used to store program code and transmit the program code to a processor, the processor being used to execute the above-described method for identifying abnormal network users based on dynamic evolution according to the instructions in the program code.

[0032] This invention comprehensively addresses the core pain points of existing technologies, namely "lagging identification, difficulty in capturing groups, high false positive rate, and low efficiency," through a full-process innovation of "multi-dimensional feature quantification + dynamic factor capture + knowledge graph association + complexity optimization." It provides an efficient and reliable technical solution for identifying abnormal network users and can be widely applied in e-commerce, social networking, finance, and other fields, demonstrating significant technological innovation value and practical application prospects. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart illustrating a method for identifying abnormal network users based on dynamic evolution.

[0035] Figure 2 This is a schematic diagram of a module for identifying abnormal network users based on dynamic evolution. Detailed Implementation

[0036] Example 1

[0037] like Figure 1 As shown, the present invention provides a method for identifying abnormal network users based on dynamic evolution, which specifically includes the following steps:

[0038] Step 1: Multi-platform user data collection and refined preprocessing, including:

[0039] The process of filtering and acquiring physical parameters strongly correlated with abnormal user behavior, and cleaning up invalid and interfering data to provide standardized input for subsequent feature calculations includes the following steps:

[0040] First, the data sources and collection strategies are determined. User data from different types of mainstream platforms, including social media platforms, e-commerce platforms, and content communities, are selected. It is understood that these platforms cover typical scenarios such as public opinion interaction, transaction evaluation, and in-depth content publishing, and can comprehensively capture abnormal user behaviors such as batch operations and fake interactions in different scenarios.

[0041] Specifically, set the collection cycle. The collection period is 30 days. Covering the complete user behavior cycle: Abnormal users often evade detection through short-term batch operations, such as posting fake reviews within 3 days. A 30-day cycle can distinguish between "occasional high-frequency" and "continuous batch" behaviors, avoiding misjudgments based on short-term behavior; at the same time, a sampling frequency is set. The sampling frequency is 1 time per hour. It can accurately capture high-frequency behavioral fluctuations. Typical abnormal user types include bot accounts, which usually operate at fixed time intervals, such as posting one message per hour. Therefore, by setting a sampling frequency of once per hour, such regular fluctuations can be fully recorded, providing data support for subsequent identification of bot behavior.

[0042] Furthermore, we define physical parameters for full-dimensional data collection, where each physical parameter corresponds to a quantifiable characteristic of an abnormal user:

[0043] Regarding the identity attribute dimension, a registration duration is set. The unit is "days", referring to the registration duration. Used to distinguish batches of new accounts, typically 85% of accounts among abnormal users have a longer registration period. This is because new accounts do not need to be maintained for a long time and can be used directly for abnormal operations;

[0044] Set the authentication level for user accounts. The authentication level Assign values ​​according to different authentication types, for example, unauthenticated. Personal Authentication Enterprise Certification Official Certification The authentication level Used to filter accounts whose identities have not been verified, and authentication levels are often used to identify suspicious users. This is because unverified accounts are easier to register in bulk because it is less costly to conduct abnormal activities.

[0045] Set the number of login devices The unit is "unit," referring to the number of logged-in devices. To identify bulk manipulation behavior, abnormal accounts are typically associated with more than 5 devices, i.e., the number of logged-in devices. It enables batch operations by allowing multiple devices to log in simultaneously, such as batch content publishing and liking different pieces of content.

[0046] Furthermore, regarding the behavioral attribute dimension, the number of posts per unit time is set. The number of releases per unit time This is used to represent the total number of pieces of content published within 24 hours, in units of "items". The unit of time publication count... Used to capture high-frequency publishing behavior, exemplified by the number of publishes per unit time by a normal user. The number of posts published per unit time by abnormal users This is because a large number of abnormal activities require the release of a large amount of content in a short period of time;

[0047] Set comment response time The comment response time This refers to the time difference between a user browsing and commenting, measured in minutes; the comment response time is... Used to identify real-time machine interaction, exemplified by the comment response time of a normal user. Response time for comments from abnormal users This is because abnormal users can achieve "instant reviews" through machine programs;

[0048] Set a delay for liking decisions The like decision delay This refers to the time difference, measured in seconds, between a user browsing and liking a post; the liking decision delay. Used to filter script-driven "like" behavior, exemplified by normal users. Abnormal users This is because abnormal users can automatically and quickly like posts using a script that allows them to do so.

[0049] Furthermore, in terms of content attribute dimension, the semantic entropy of the text is set. The text semantic entropy Used to distinguish batches of low-quality content, specifically the text semantic entropy. The calculation formula is:

[0050]

[0051] Wherein, the The probability of word occurrence is used as an example, verified across multiple platforms, to measure the semantic entropy of text generated by a normal user. The semantic entropy of the text generated by the abnormal user This is because abnormal users usually generate content in batches, with a single semantic meaning, such as repeatedly using words like "easy to use" and "recommended".

[0052] Set the probability of image tampering The probability of the image being tampered with Used to identify fake images, and combined with Calculations are performed based on information and pixel edge blur;

[0053] Set video watermark integrity The video watermark integrity is used to filter tampered videos, exemplarily by offsetting the watermark position. Calculations are performed without fuzzy operations;

[0054] In terms of social attributes, set the friend-to-follow ratio. The friend-to-follow ratio This is used to identify abnormal friend-adding and follower-gaining behaviors. This is because abnormal user accounts may try to gain traffic by abnormally adding friends when they have many friends but few followers, or they may try to gain attention to attract other users to view their content when they have many followers but few friends.

[0055] Set interaction frequency Interaction frequency Used to indicate users within 30 days With users The total number of interactions, setting the semantic similarity of interactions. The and the semantic similarity of the interaction This is used to capture close group interactions because anomalous users need to coordinate abnormal operations through high-frequency, similar language. Therefore, the frequency of interactions between members of an anomalous group is used as an example. And interactive semantic similarity .

[0056] Furthermore, after data collection, multi-rule cleaning is performed, and the content characteristics of abnormal users' batch publishing across platforms are calculated to determine the nature of the published content. If the hash values ​​of content from two platforms are the same and the publication time difference is less than 1 hour, the earlier content is retained to avoid duplicate interference in subsequent content similarity calculations. Given that machine-generated content often contains garbled characters, only the hash value is retained. or This allows for content parsing, avoiding semantic analysis distortion caused by encoding errors; and it calculates text word frequency entropy based on the characteristic of abnormal users generating low-quality content in batches. The text word frequency entropy The calculation formula is:

[0057]

[0058] Among them, the Words Number of occurrences Words The corresponding total number of words in the text, if For example, phrases like "good, good, good" are deleted to improve the distinctiveness of subsequent content features. To detect abnormal user behavior that attracts other users, the proportion of non-platform domain links in the content is checked; if the proportion exceeds 30%, the content is deleted to reduce misjudgments in credibility calculations due to advertising behavior. After cleaning the raw data, valid data is retained and a "user" column is output. Structured data including identity attributes, behavioral attributes, content attributes, and social attributes provides standardized physical input for subsequent feature profiling.

[0059] Step 2: Construct a multi-dimensional feature profile of users with network anomalies, including:

[0060] The collected structured data is transformed into quantifiable anomaly indicator metrics, and user profiles are constructed from multiple dimensions, including basic behavior, content quality, and social relationships. This provides dimensional support for subsequent comprehensive credibility value calculations, specifically including:

[0061] Calculate account activity index The account activity index Used to quantify the relative degree of anomaly in user behavior density, specifically in calculating the account activity index. In the process, the first step is to calculate the average behavior of all users, i.e., the average number of posts in 24 hours. , wherein This represents the number of posts published per unit of time, i.e., by users. The total number of contents published per unit time. This represents the number of comments per unit of time, i.e., the number of users. The total number of comments initiated per unit of time, the This represents the number of likes per unit of time. That is, users The total number of likes initiated within a unit of time, the aforementioned This represents the total number of users. These averages serve as a physical benchmark and can eliminate misjudgments of absolute quantities caused by differences in user types. For example, bloggers naturally have a higher posting volume than ordinary users.

[0062] Furthermore, the Analytic Hierarchy Process (AHP) is then used... Determine feature weights , , , wherein This indicates the number of releases per unit time. The weights, the Represents the number of comments per unit of time. The weights, the This represents the number of likes per unit of time. The weights are determined while ensuring that the weight coefficients match the "contribution of behavior to anomaly identification," and the account activity index is calculated using a formula. ,Right now

[0063]

[0064] in, This represents the multiple of user posting volume relative to the overall average. This indicates an abnormally high number of releases; This represents the multiple of the number of user comments relative to the overall mean. This indicates that the commenting behavior is unusually frequent; This represents the multiple of a user's likes relative to the overall average. This indicates abnormal liking behavior, which can be understood as mostly being liked in batches in a short period of time.

[0065] Meanwhile, because content posting is an active creation activity, it is more representative of activity levels than passive interactions like comments and likes. After consistency verification, a posting weight is assigned as an example. Comment weight Likes weight This ensures that the index is more sensitive to proactive bulk publishing behavior.

[0066] Exemplarily, after testing across multiple platforms, the account activity index... When the activity level is above 100%, it indicates that the user behavior density is more than twice the average, corresponding to an "extremely high activity" anomaly, exemplified by batch posting of accounts; the account activity index. This indicates that the behavior density is far below the mean, corresponding to an "extremely low activity" anomaly. For example, when an abnormal user... of At that time, the abnormal user was calculated. Account activity index This indicates that the activity level is extremely high and suspicious. This index provides a behavioral density dimension for subsequent credibility value calculations.

[0067] Furthermore, the mean content similarity is calculated. The average content similarity Used to quantify batch anomalies in user content, specifically first through... The model will display user-posted content. Convert to 300-dimensional semantic vector By using word segmentation tools to remove stop words and setting the window size, contextual semantic relationships are obtained. A minimum word frequency is set to filter out meaningless low-frequency words. It can be understood that a 300-dimensional vector dimension can cover sufficient semantic information, avoiding the omission of batches of synonymous but different words in traditional keyword matching. For example, "easy to use" and "not bad" are semantically similar but have different keywords. Next, user... and users Content similarity ,Right now:

[0068]

[0069] in, dot product of vectors Representing vectors and The dot product reflects the consistency of vector directions; that is, the larger the dot product, the closer the semantics. Representing vectors and The modulus of is used to normalize the dot product result, avoiding the influence of vector length (i.e., text length) on similarity. Taking the maximum value ensures that the most similar content between users is captured. This is validated for example based on 100,000 labeled samples. At that time, the probability of the content being published in batches is 75%, and this threshold becomes the basis for determining batch content;

[0070] Further calculate the mean of user content similarity. ,Right now:

[0071]

[0072] Understandably, after testing on multiple platforms, when This indicates that the user's content is highly similar to that of most other users, corresponding to a "bulk posting" anomaly; normal users post more... For example, an abnormal user A interacts with 15 other users. With the remaining 850,000 users Substituting 0.2, we get If the batch release is deemed suspicious, this average value will be used to provide a basis for the content quality dimension in subsequent credibility value calculations.

[0073] Further calculations of social characteristics quantify social anomalies from multiple perspectives, including social connection density, relationship ratio, and interaction quality. Specifically, these include:

[0074] Node degree is calculated based on social connection density. The specific calculation process is as follows:

[0075]

[0076] in, Indicates user Number of followers Indicates user Number of friends Indicates user Interacting with other users The number and degree of the nodes Reflecting the density of social connections, it's understandable that normal users have limited social circles, and their node degrees are typically less than 50. Abnormal groups, on the other hand, require core nodes to connect to numerous group accounts for collaborative information dissemination, thus their node degrees are often greater than 100. An example of an abnormal user... of , , Substituting into This means that the node is suspected of having too many connections, and the node degree is... It will also be used for core node screening to ensure that no abnormal group cores are missed.

[0077] Calculate the friend-to-follow ratio coefficient based on relationship proportions. ,Right now:

[0078]

[0079] Understandably, during the multi-platform verification process, based on statistics from 100,000 normal users, the range of the friend-to-follow ratio for normal users is [range missing]. ,when When this indicates a large following but few friends, it corresponds to abnormal follower acquisition; when When this indicates a large number of friends but few followers, it corresponds to an abnormal friend addition, such as a user... of , , If so, the user is deemed to have an imbalanced ratio and is therefore considered an abnormal user.

[0080] Calculating the health of social interactions based on the quality of interaction. ,Right now:

[0081]

[0082] Among them, the Indicates user Other users The frequency of interaction, the Indicates user Other users The semantic similarity, the Indicates user Other users The number of days the interaction lasted, the This indicates the platform's highest historical interaction frequency. Indicates complete semantic consistency, the stated This indicates the maximum data collection period, and the social interaction health level. Reflecting the quality of interaction, normal users exhibit diverse and consistently stable semantic interactions, indicating a healthy level of social interaction. Abnormal users, due to the use of batch-form language during interactions resulting in semantically singular and short-duration messages, affect the health of their social interactions. ,

[0083] Furthermore, the node degree The friend-to-follow ratio coefficient Social interaction health We will jointly construct social features and provide a basis for the social relationship dimension for subsequent credibility value calculation.

[0084] Step 3: Construct a comprehensive user trust measurement model, which includes:

[0085] Integrating multi-dimensional social features, and through standardized processing and improvement The algorithm determines feature weights and outputs a single comprehensive confidence value, achieving preliminary screening of abnormal users and providing core input for subsequent dynamic evolution factor fusion and confidence propagation. Specifically, this includes:

[0086] First, multi-dimensional feature standardization is performed. Because the feature dimensions differ greatly when constructing a multi-dimensional feature profile of network anomaly users, an example is the account activity index. The relative value is the degree of the node. Represents the degree of a node. To represent semantic similarity, direct weighting would lead to features with larger dimensions dominating the results. Therefore, a different approach is used. Standardization, that is:

[0087]

[0088] Among them, the Indicates the first The standard value of a certain social characteristic corresponding to a user, the Indicates the first A certain social characteristic value corresponding to a user, the Indicates the first The maximum value of a certain social feature corresponding to a user, the Indicates the first The minimum value of a certain social feature corresponding to a user.

[0089] Furthermore, the account activity index The average similarity of the user content The degree of the nodes The friend-to-follow ratio coefficient The aforementioned social interaction health Unified Standardized operation, for example, user Account activity index The value is 3.4, and the interval is... , The value is 2300, and the range is... After standardization It is 0.34. The value is 0.46. The standardized features eliminate dimensional interference, ensuring the rationality of subsequent weighted fusion.

[0090] Furthermore, then through improvements The algorithm determines feature weights, and the improvement The algorithm can dynamically adapt the feature importance under different abnormal scenarios, avoiding the limitations of fixed weights. Specifically, it first constructs a dataset: selecting 100,000 historical labeled samples from the platform, including 50,000 normal users and 50,000 abnormal users, covering four typical anomalies: batch registration, fake reviews, public opinion manipulation, and traffic-driving advertisements. These samples are divided into training and validation sets in a 7:3 ratio, ensuring the universality of weight learning by covering various abnormal behaviors. Subsequently, improvements are made... The algorithm calculates the loss function, and the total loss function is:

[0091]

[0092] Among them, the The regularization loss is represented by the following calculation process:

[0093]

[0094] Among them, the For logarithmic loss, the predicted value is quantified. Compared with the true value Calculate the loss based on the deviation. To determine the number of decision trees, a balance needs to be struck between accuracy and efficiency. This is a time complexity penalty coefficient for the tree, used to prevent overfitting due to excessive tree depth; exemplarily set to 0.1. This is the weight decay coefficient, which can prevent the weight of a single tree from being too large. For example, it is set to 0.01. For the first The weights of the leaf nodes of the tree;

[0095] Furthermore, the aforementioned The feature interaction regularization term, the It is necessary to balance the weights of physical features to avoid any one feature dominating. The specific calculation process is as follows:

[0096]

[0097] Among them, the This is the interaction regularization coefficient, which needs to control the strength of the interaction item's influence. For example, it is set to 0.05. For the first The weights of class features, the For the first The weights of class features, the Indicates the first Class characteristics and the first Correlation coefficient of class features

[0098] Further settings for training parameters: learning rate Control the weight update step size to avoid oscillations; for example, set it to 0.1, and the maximum tree depth. The time complexity for matching features is, for example, set to 6, and the subsample ratio... It can randomly sample the training set to enhance generalization; for example, it is set to 0.8, which is the column sample ratio. `_bytree` can randomly select feature columns, avoiding feature dependency. For example, it's set to 0.8, which corresponds to the number of training epochs. This ensures model convergence; for example, it is set to 50.

[0099] For example, after training, the model performance is evaluated using a validation set: accuracy 96.8%, precision 96.5%, recall 97.1%, and F1 score 96.8%, meeting the performance targets. The final output feature weights are then defined. The weight is 0.25, and the mean of the user content similarity is... The weight is 0.3, and the degree of the node is... The weight is 0.2, and the friend-follow ratio coefficient is... The weight is 0.15, and the social interaction health score is... The weight of each feature is 0.1, and the magnitude of each weight reflects the importance of each feature in identifying abnormal users.

[0100] Further calculate the user's overall trust value, i.e.:

[0101]

[0102] in, This represents the weight corresponding to each feature. Indicates the first The standard value of a certain social characteristic for a user can be understood as... A higher value indicates a higher level of user credibility, meaning the user is more likely to be a legitimate user; a lower value indicates a user who is not legitimate. This risk grading threshold is set as an example, based on verification across multiple platforms. A value less than 0.4 indicates high risk; manual verification shows that 82% of such users are abnormal accounts. A score between 0.4 and 0.7 indicates medium risk, but further observation is still needed. Manual verification revealed that 35% of these users were abnormal accounts. A value of 0.7 or higher indicates low risk, representing a normal user. After manual verification, 98% of such accounts are legitimate. It is understood that this reliability value... It will not only serve as the basis for the initial screening of anomalies, but will also be the core input for subsequent initial confidence level calculations.

[0103] Step 4: Knowledge graph construction and dynamic evolution factor fusion calculation, specifically including:

[0104] First, an attribute-based knowledge graph storing social features and relationships is constructed. Then, five types of dynamically evolving physical factors are introduced to capture behavioral anomalies in time series. A time complexity optimization strategy is combined to ensure large-scale computational efficiency. Finally, confidence values ​​are calibrated through confidence propagation to achieve accurate identification of dynamic and group anomalies. Specifically, this includes:

[0105] Step 4.1: Construct an attribute-based social knowledge graph, specifically including:

[0106] First, define the graph structure. The node set Taking the 1 million users cleaned in step 1 as entities, each uniquely identified as a user. The edge set refers to the behavioral subjects in a social network. Social relationships between users are categorized into "follow sides" based on interaction type. Comments and forwarding edge It is understandable that different edge types correspond to different anomaly propagation paths; for example, a "follow" edge corresponds to a fabricated circle of friends, and a "comment" edge corresponds to abnormal interactions. (Node attribute set) Store the user's core characteristics, including the identity attributes from step 1 ( , , Step 2 multidimensional features ( , , , , ), Step 3 Comprehensive confidence value These attributes provide the foundational data for subsequent dynamic evolution factor calculation and confidence propagation; edge attribute set Store the physical association characteristics of edges, including the frequency of interactions that reflects the closeness of the edges. Interactive semantic similarity reflects the quality of edge association. Interaction duration reflects the stability of the edge. And calculate the edge weights. ,Right now:

[0107]

[0108] It is understandable that a larger weight indicates a stronger influence of the edge on social association, providing a basis for determining the strength of the neighbor's influence in subsequent confidence propagation.

[0109] Further optimization of map storage and indexing: Adopting Graph database storage offers higher query efficiency for related data compared to traditional relational databases; indexes are built for high-frequency query scenarios based on reliability values. With activity level Build Tree indexes can quickly filter high-risk users and reduce query response time; based on interaction frequency With edge weight Building a hash index enables fast querying of strongly interactive edges, improving subgraph extraction efficiency. At the same time, index optimization provides efficient data access support for subsequent dynamic evolution factor calculation and confidence propagation, ensuring computational efficiency.

[0110] Step 4.2: Calculate the five types of dynamic evolution factors, specifically including:

[0111] Five types of factors are set up based on the perspectives of trend, cycle, randomness, autocorrelation, and external variables, and each is used to capture behavioral anomalies in time series. This compensates for the deficiency of static confidence values ​​in step 3, which cannot identify dynamic evolution anomalies. The calculation of each factor incorporates parameters and formulas designed based on the patterns of anomalous behavior.

[0112] Trend factors This method is used to quantify long-term behavioral trends and capture anomalies caused by short-term bursts, such as a surge in the number of fake reviews posted by accounts within 5 days. The process first divides the time window, subdividing the 30-day collection period into 30 24-hour windows to avoid interference from hourly fluctuations; the sliding window length is then set based on the pattern that anomaly outbreaks mostly occur within 5 days. The frequency of publication of the most significant indicator of high-frequency abnormal user behavior was selected. As a computational feature, let the first... Users in a time window The frequency of release is Next, the behavioral feature increment is calculated, i.e.:

[0113]

[0114] Among them, the Indicates user In the The incremental trend-related behavioral features of each time window, the This reflects the change in the frequency of posts made by the user within 5 days; Indicates user In the The frequency of publication within each time window; Indicates user In the The frequency of release within each time window.

[0115] Furthermore, the aforementioned Reflecting the magnitude of changes in release frequency over 5 days, and marking the direction of the increment. The abnormal user trend is rising in multiple dimensions. For example, based on the posting volume of a certain abnormal account within 5 days... Based on actual test data increasing from 1 to 101, and considering the abnormal user fake reviews, the number of fake reviews increased from the platform's historical maximum behavioral increment within 5 days. As a standardized increment, a trend decay coefficient is introduced. Based on the historical trend impact and the current incremental impact, the trend decay coefficient is exemplarily set. Set it to 0.7. Finally, calculate the trend factor using an iterative formula. ,Right now:

[0116]

[0117] Wherein, the The This indicates a direction correction term, which can amplify the trend signal of the direction.

[0118] Periodic factor Used to quantify cyclical patterns of behavior, this can be understood as the short-term operations of machine accounts, which differ from the human 7-day weekly cycle; therefore, the aforementioned cycle factor... It can detect cycle disorder anomalies. A cycle statistics window is set in the process. The timeframe is 14 days, which covers two collection cycles, ensuring the complete extraction of the cycle and selecting the publication frequency sequence. As the object of computation, through the Discrete Fourier Transform ( The sequence is decomposed into frequency components, and the power spectral density of each frequency is calculated, specifically as follows:

[0119]

[0120] in, Representing the power spectral density, the Reflecting different frequencies The contribution to the original sequence, i.e. The larger the frequency, the more important this frequency is. The more significant the corresponding periodicity; This indicates that the frequency sequence of publications is being analyzed. After that, frequency Complex values ​​at the location.

[0121] It is understandable that the power spectral density To reflect the contribution of different frequencies to the sequence, take... Maximum frequency As the main period frequency, the main period After testing on multiple platforms, this demonstrates the capabilities of normal users. For 7 days, abnormal users Day; Set the user's average main week over the past 3 months as the historical average main week. and the periodic stability coefficient , exemplary settings The initial value is 0.2. Finally, the cycle factor is calculated (for a 1-day cycle deviation, the factor value decreases by 0.2). The cycle factor is then calculated using the formula. ,Right now:

[0122]

[0123] Understandably, the current main cycle Compared with the historical average main cycle The closer, The smaller the periodic factor, the closer the denominator is to 1. The closer the periodicity factor is to 1, the more stable the periodicity, which aligns with normal user behavior. Conversely, the greater the deviation, the larger the denominator. The smaller the value, the more likely it indicates a chaotic cycle, or abnormal behavior from an unusual user.

[0124] Understandably, when calculating the periodic factor, the process involves "extracting the main period through frequency domain analysis → comparing with historical periods → quantifying periodic stability," and ultimately using the periodic factor to identify abnormal accounts with disordered periods.

[0125] random factor This is used to quantify the degree of random fluctuation in behavior. Since the operations of normal users are characterized by stable fluctuations, a random factor is used. This method aims to capture highly volatile anomalies such as irregular and batch operations from abnormal accounts. Because it requires balancing the ability to capture volatility with the stability of the results, the behavior of normal users typically shows relatively stable fluctuations over an 8-day period. A window that is too short is easily affected by occasional fluctuations, while a window that is too long "smooths out" the actual volatility. Therefore, 8 days is a compromise in practice that balances both aspects; hence, it is referred to as a random statistical window. Set to 8 days and select the release frequency sequence. ,Right now:

[0126]

[0127] Among them, the Indicates user At the current time Push forward The frequency of daily releases, the aforementioned Indicates user In the The frequency of releases within a time window can provide samples for subsequent calculations of the mean and standard deviation, ensuring that the volatility analysis is based on sufficient historical behavior.

[0128] Furthermore, the mean and standard deviation within the window are calculated as follows:

[0129]

[0130]

[0131] Among them, the This represents the fluctuation benchmark, reflecting the user's... The average release level over 8 days is measured by the deviation of daily frequency from the mean, indicating fluctuation. Indicates the The degree of dispersion; a larger standard deviation indicates more drastic behavioral fluctuations. It's understandable that when abnormal users perform batch operations, the frequency suddenly increases sharply, and the standard deviation becomes significantly larger. Furthermore, a random fluctuation threshold is set. Calculate the corresponding random factors ,Right now:

[0132]

[0133] Understandably, this can be achieved by calculating the ratio of the actual volatility (i.e., the standard deviation) to the random volatility threshold, and then... The function's limiting factor has a maximum value of 1, where if Then, it represents the random factor. The ratio should equal this value, and the fluctuations should be within the normal range. The smaller the ratio, the more stable the stability. This indicates that the fluctuation far exceeds the normal range, and is judged as a high-fluctuation anomaly. In this case, the random factor... It equals 1.

[0134] Understandably, random factors can accurately quantify the "abnormality" of behavioral fluctuations through "window sampling → statistical mean and standard deviation → threshold comparison → block optimization" while taking into account computational efficiency.

[0135] Autocorrelation factor This is used to quantify the correlation between current and historical behavior, capturing "low-correlation" anomalies, which can be understood as sudden behavioral shifts from infrequent to frequent by an abnormal user. Since a user's historical behavior is significantly correlated with their current behavior within 3 days, an autocorrelation lag window is set in the process. For 3 days, select the frequency of publication ( ), and calculate Correlation coefficient That is, to calculate the current behavior and Historical events before the heavens The degree of linear correlation between them, wherein Correlation coefficient This method quantifies the strength of the linear correlation between current and historical behavior, where a correlation closer to 1 or -1 indicates a stronger correlation, while a correlation closer to 0 indicates a weaker correlation. It also introduces sparsity into the subsequent window. For 2 days, while retaining The window is defined, and the corresponding autocorrelation factor is calculated. ,Right now

[0136]

[0137] Understandably, when calculating the autocorrelation factor... The time parameters are progressively increased, which not only ensures the accurate capture of behavioral correlations, but also optimizes the computational efficiency and the accuracy of anomaly identification through window filtering.

[0138] external variable factor This is used to quantify the impact of external events on user behavior and capture anomalies of overreaction. An example is when abnormal accounts post a concentrated number of comments during trending events, affecting the evaluation of those events. The process first defines external events, such as trending search events or e-commerce promotional events, and then calculates the event's popularity. ,Right now:

[0139]

[0140] Among them, the This indicates the trending search ranking of the event. This indicates the highest ranking of trending searches, representing the popularity of the event. The calculation can quantify the popularity of external events, reflecting the degree of attention an event receives in the public eye through ranking and popularity, and the event popularity... ;

[0141] Furthermore, through Calculate users The semantic similarity between the behavior and the event keywords is used to obtain event-related behaviors. It is understandable that the events related to the above are... It measures the semantic correlation between user behavior and "external events". The higher the value, the stronger the correlation between user behavior and the event.

[0142] Furthermore, based on the popularity of the event Related to the event Calculate the event influence index ,Right now:

[0143]

[0144] Furthermore, obtain user data during the event and before the event. Release increment The incremental posting includes changes in the number of posts and interactions, and also includes data from users in an earlier time period prior to the event. Normal release increment and according to the and stated Calculate behavioral response sensitivity ,Right now:

[0145]

[0146] It is understandable that the aforementioned behavioral response sensitivity It can measure the drastic change in user behavior under the influence of external trending events; for example, the behavior of normal users... This means that the behavioral changes are not significantly different from the usual baseline, while abnormal users... This means that the behavior of abnormal users changes explosively during popular events;

[0147] Furthermore, setting an upper limit threshold for behavioral response sensitivity can prevent extreme outliers, such as the interference caused by an extremely small number of users' excessive responses, to computation. Therefore, a maximum sensitivity limit is set for the platform. And, exemplarily, the platform's maximum sensitivity Set to 10 and pass the platform's maximum sensitivity. Sensitivity to user behavior responses and event influence index Calculate the user's external variable factors ,Right now:

[0148]

[0149] It is understandable that when calculating the user's external variable factors... In the process, it is necessary to comprehensively consider the "influence of the event on the user" and the "degree of response of user behavior to the event", and finally quantify the "intensity of the influence of external events on user behavior". Under the condition of "over-response", the trend of abnormal users interacting in hot events can be captured. This calculation process can not only accurately quantify the influence of external events on user behavior, but also efficiently identify abnormal behavior, while optimizing the computation time complexity.

[0150] After completing the calculation of the above five types of dynamic evolution factors, through Standardization maps it uniformly to the [0,1] interval and denotes it as... , , , , It is understandable that the above five types of dynamic evolution factors effectively reduce the total computation time complexity and provide efficiency support for large-scale application scenarios.

[0151] Step 4.3: Confidence propagation and anomaly score calculation, specifically including:

[0152] First, calculate the initial confidence level. Combined with the user's comprehensive trust value in step 3 Based on the dynamic evolution factor in step 4.2, the initial suspicion of user anomalies is obtained. It is understandable that this is due to the user's overall trust value. A confidence value is set to reflect the basic level of credibility and contribute more to anomaly detection. The weight is The value is 0.6. Simultaneously, the dynamic evolution factor is standardized to obtain the standardized dynamic evolution factor. And based on the standardized dynamic evolution factor We obtain the product of the complements of the dynamic evolution factors, i.e.:

[0153]

[0154] It is understandable that the more abnormal the factor, the smaller the complement and the lower the product, which can reflect the degree of abnormality in dynamic behavior. The initial confidence level is obtained through calculation. ,Right now:

[0155]

[0156] It is understandable that the initial confidence level The smaller the value, the greater the suspicion of anomaly, and the lower the initial confidence level. This provides initial evidence for subsequent confidence propagation;

[0157] Further confidence level The propagation calculation, as can be understood, integrates the physical weights of social connections, calibrates individual confidence levels, and captures group anomalies during the calculation process. After verification across multiple platforms, the influence of neighbor node confidence levels among users accounts for 30%, while their initial confidence levels account for 70%. Therefore, to avoid misjudgment of target users due to neighbor misjudgment, a propagation coefficient is set for example. The value is 0.3, and user information is also obtained. Directly followed and interacting users as a set of neighbor nodes During the confidence propagation calculation, initialization Time confidence ,when First, the set of neighboring nodes is calculated. The weighted sum of the neighboring nodes, i.e.:

[0158]

[0159] Among them, the This refers to the edge weights in step 4.1, which reflect the strength of the neighbor influence. The propagation confidence is then iteratively updated using a formula, namely:

[0160]

[0161] It is understandable that when the neighbors are mostly low-trust users, the confidence level will decrease further after propagation. Therefore, core nodes should be iterated first during the confidence propagation process, and the time complexity should be effectively optimized.

[0162] Further calculate the confidence propagation probability. By integrating the total time complexity, we can avoid overestimating reliability in scenarios with large amounts of data, and set a time complexity decay coefficient. Calculate the total time complexity ,Right now:

[0163]

[0164] Furthermore, through the total time complexity Time complexity decay coefficient Confidence level The final propagation yields the propagation probability. ,Right now:

[0165]

[0166] Furthermore, anomaly scores are calculated by integrating the anomalous contributions and propagation probabilities of dynamic evolution factors, and these scores are then used to... This involves identifying abnormal users, thereby enabling the identification of abnormal users in individuals and groups.

[0167]

[0168] It is understandable that the above This represents the influence coefficient of the dynamic evolution factor. It can amplify low-confidence signals based on the confidence level of abnormal users. It can amplify dynamic anomaly signals based on the dynamic evolution factors of anomalous users, and the product of the two can enhance the anomaly discrimination. Furthermore, for group anomaly identification, it can filter associated anomalous users based on the edge physical features of the knowledge graph: if an anomalous user Neighbors Satisfy edge weight And abnormal scores If the value is close to the threshold, it is considered suspicious and there is an anomaly. For example, a user... Neighbors of And abnormal scores If this is detected, it is determined to be an abnormal association, and an 8-person abnormal group was ultimately identified. This group had been engaging in frequent interaction through following and commenting within 30 days, posting 240 fake reviews, and the semantic similarity of their interactions was high. The use of phrases like "high quality" and "fast logistics" in bulk demonstrates the abnormal behavior of a group colluding to commit fraud.

[0169] Step 5: Outputting recognition results and iteratively optimizing the model, specifically including:

[0170] The system outputs anomaly identification results, providing a physical dimension basis for business intervention. It also continuously iterates and optimizes model parameters to adapt to the dynamic evolution of abnormal behavior, specifically including:

[0171] First, the abnormal user identification results are output. The content design revolves around the "core physical information of the anomaly," ensuring that operations and maintenance personnel can quickly locate the root cause of the anomaly: basic information includes user... With identity physical attributes, for example, sky, , These are clearly high-risk accounts that are newly registered, unverified, or controlled by multiple devices; the abnormal core information includes abnormal scores. Core abnormal factors are exemplified as " Belongs to high volatility The report identifies the issue as "overreaction," specifying the anomaly type as irregular batch operations + excessive event response. Examples of abnormal behavior descriptions include "the standard deviation of posting frequency in the past 8 days is 1.2, exceeding the normal threshold of 0.8 by 50%," and "the increase in postings during the 618 promotion was 1.5, which is 7.5 times the increase before the promotion, and the correlation coefficient with postings 3 days ago is only 0.15." Related information includes a list of associated abnormal users, such as an 8-person group, labeled with the relationship type "follow + comment" and edge weight "0.1125-0.12," clearly indicating the group connection method. Output formats include a real-time visualization interface and an offline report: the real-time interface displays the list of abnormal users and categorizes them by... Sort in descending order; anomaly factor filtering function, exemplified by filtering... User behavior time series plots are exemplified as follows: The 30-day change curve visually displays the high volatility characteristics and supports real-time monitoring and intervention for operation and maintenance. The offline report is in Excel format and includes full-dimensional physical attributes, feature values, factor values ​​and judgment criteria, which facilitates business traceability, such as verifying registered IPs, login device trajectories and post-event review.

[0172] Then, the model is iteratively optimized. The core is to adjust the physical parameters and calculation strategies based on the evolution of abnormal behavior to ensure the long-term effectiveness of the model: First, the samples and parameters are updated. 50,000 new labeled samples are collected every month, including 25,000 new abnormal samples, such as the text semantic entropy of AI-generated comment accounts. The percentage of abnormal cases increased from 15% to 30%, requiring [further action]. The corresponding feature weights were adjusted from 0.1 to 0.18 to improve sensitivity to low-quality AI-generated content; at the same time, the dynamic evolution factor parameters were adjusted, for example, by shortening the abnormal user behavior cycle from 7 days to 3 days, requiring an adjustment to the statistical window of the cycle factor. The processing time has been reduced from 14 days to 7 days to ensure the capture of short-cycle anomalies. Secondly, the time complexity optimization strategy has been upgraded. For scenarios with a growing user base, such as tens of millions of users, the Spark distributed computing framework is used to split the task into 10 nodes, each processing 1 million users, reducing the total processing time from 45 minutes to 15 minutes. To address the increased proportion of highly active users, the random factor... The number of blocks was increased from 8 to 10 to ensure consistent user fluctuation characteristics within each block, improving the recognition accuracy from 94% to 96%. An "incremental-full hybrid calculation" approach was adopted, where only the dynamic evolution factor increment is calculated for non-core users, for example, updating only the current day's and the previous day's data. The differences are as follows: core users are fully calculated every 3 days, and the time taken for dynamic evolution factors of millions of users is reduced by another 10%. Thirdly, the optimization effect is verified. Through testing with newly labeled samples, the model accuracy increased from 96.8% to 97.2%, the false positive rate decreased from 5.2% to 4.8%, and the false negative rate decreased from 3.3% to 2.9%, ensuring that the model maintains high recognition accuracy in new and abnormal scenarios.

[0173] The above method achieves accurate identification of abnormal users throughout the entire process, from static features to dynamic behavior, and from individual identification to group mining, by coherently transferring physical parameters between each step: collecting parameters in step 1 → features in step 2 → confidence values ​​in step 3 → factors and confidence levels in step 4 → output in step 5. At the same time, through time complexity optimization strategies, it ensures efficient computing in large-scale scenarios and provides technical support for network ecosystem governance.

[0174] Example 2

[0175] like Figure 2 As shown, this invention provides a device for identifying abnormal network users based on dynamic evolution, specifically including the following modules: a data collection and preprocessing module, a multi-dimensional feature profiling module, a user comprehensive credibility quantification module, a knowledge graph construction and dynamic evolution factor fusion calculation module, and an identification result output and model iteration optimization module. The device includes a processor and a memory: the memory stores program code and transmits the program code to the processor, which executes the aforementioned method for identifying abnormal network users based on dynamic evolution according to the instructions in the program code.

[0176] The present invention also provides a computer device, characterized in that the computer device includes a processor and a memory: the memory is used to store program code and transmit the program code to the processor, the processor is used to execute the above-described method for identifying abnormal network users based on dynamic evolution according to the instructions in the program code.

[0177] The present invention also provides a computer-readable storage medium, characterized in that the computer-readable storage medium is used to store program code and transmit the program code to a processor, the processor being used to execute the above-described method for identifying abnormal network users based on dynamic evolution according to the instructions in the program code.

[0178] The above description is merely a preferred embodiment of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described concept. For example, technical solutions formed by substituting the above features with (but not limited to) technical features with similar functions disclosed in this disclosure.

Claims

1. A method for identifying anomalous network users based on dynamic evolution, characterized in that: Includes the following steps: Step 1: Collect and refine multi-dimensional user data from multiple platforms, filter and obtain physical parameters that are strongly correlated with abnormal user behavior, and remove invalid interference data through cleaning; Step 2: Construct a multi-dimensional feature profile of users with network anomalies. Transform the collected structured data into quantifiable anomaly feature indicators and construct user profiles from multiple dimensions, including basic behavior, content quality, and social relationships. The basic user behavior includes account activity index; the quality of user-posted content includes average content similarity. A user's social relationships include node degree, friend-to-follow ratio, and social interaction health. Step 3: Construct a comprehensive user trust measurement model, which includes: Integrating multi-dimensional features through standardization and improvement The algorithm determines the feature weights and outputs a comprehensive user confidence value; Step 4: Knowledge graph construction and dynamic evolution factor fusion calculation. An attribute-based knowledge graph storing social features and relationships is constructed. Five types of dynamic evolution physical factors are introduced to capture temporal anomalies in user behavior within the knowledge graph. A time complexity optimization strategy ensures computational efficiency. Confidence values ​​are calibrated through confidence propagation to achieve accurate identification of dynamic and group anomalies. Specifically, this includes: Step 4.1: Construct an attribute-based social knowledge graph and define its structure. Node set For identity attributes, edge sets For social relationships between users, node attribute set Stores user identity attributes, multi-dimensional features, and comprehensive user trust value; edge attribute set. Store the physical association features of the edges, including the interaction frequency reflecting the closeness of the edges, the interaction semantic similarity reflecting the association quality of the edges, and the interaction duration reflecting the stability of the edges. Step 4.2: Calculate five types of dynamic evolution factors based on user behavior. These factors are set according to trend, cycle, randomness, autocorrelation, and external variables, and each type is used to capture behavioral anomalies in time series. Specifically, the trend factor quantifies the long-term trend of behavior and captures anomalies caused by short-term bursts; the cycle factor quantifies the periodicity of behavior; the randomness factor quantifies the degree of random fluctuation in behavior; the autocorrelation factor quantifies the correlation strength between current and historical behavior and captures anomalies with low correlation; and the external variable factor quantifies the impact of external events on user behavior and captures anomalies with overreaction. Step 4.3: Calculate the initial confidence level based on the standardized dynamic evolution factors and the user's comprehensive confidence value. Obtain the weighted sum of the neighbor nodes and edge weights of the neighbor node set in the knowledge graph. Iteratively update the propagated confidence level in this way. Obtain the confidence level propagation probability through the total time complexity, time complexity decay coefficient, and updated confidence level. Finally, obtain the user's abnormal score based on the abnormal calculation and propagation probability of the dynamic evolution factors. The total time complexity is calculated by the time complexity of the five types of dynamic evolution factors and the time complexity of confidence level propagation. Step 5: Output the identification results and iteratively optimize the model. Output the anomaly identification results and continuously iterate and optimize the model parameters to adapt to the dynamic evolution of abnormal behavior.

2. The method for identifying abnormal network users based on dynamic evolution according to claim 1, characterized in that: In step 1, a collection period is set to obtain and acquire user registration duration, user account authentication level, number of logged-in devices, number of posts per unit time, comment response time, like decision delay, text semantic entropy, image tampering probability, and video watermark integrity.

3. The method for identifying abnormal network users based on dynamic evolution according to claim 1, characterized in that: In step 3, the user's comprehensive trust value is calculated after the multidimensional features are standardized. ,Right now: ； in, This represents the weight corresponding to each feature. Indicates the first Standard values ​​for the social characteristics of each user.

4. The method for identifying abnormal network users based on dynamic evolution according to claim 1, characterized in that: In step 4.1, the node attribute set The core features of the stored user include identity attributes, multi-dimensional features, and user comprehensive trust value. The identity attributes include registration duration, user account authentication level, and number of login devices. The multi-dimensional features include account activity index, average content similarity, node degree, friend-follower ratio coefficient, and social interaction health. The user comprehensive trust value is calculated by integrating the multi-dimensional features.

5. A device for identifying anomalous network users based on dynamic evolution, specifically comprising the following modules: a data collection and preprocessing module, a multi-dimensional feature profiling module, a user comprehensive credibility quantification module, a knowledge graph construction and dynamic evolution factor fusion calculation module, and an identification result output and model iteration optimization module, wherein: The device includes a processor and a memory: the memory is used to store program code and transmit the program code to the processor, the processor is used to execute the method for identifying abnormal network users based on dynamic evolution as described in any one of claims 1-4 according to the instructions in the program code.

6. A computer device, characterized in that, The computer device includes a processor and a memory: the memory is used to store program code and transmit the program code to the processor, and the processor is used to execute the method for identifying abnormal network users based on dynamic evolution as described in any one of claims 1-4 according to the instructions in the program code.

7. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store program code and transmit the program code to a processor, the processor being used to execute, according to the instructions in the program code, a method for identifying abnormal network users based on dynamic evolution as described in any one of claims 1-4.

Images