Social network inference method and security monitoring method

Abstract

The invention discloses a social network inference method and a security monitoring method, and relates to the technical field of network identification. A social network inference method comprises the following steps: collecting income time sequence characteristic data of all nodes in a game dynamics system; calculating a reference degree sequence formed by all node reference degrees; inhibiting the behavior of the node i, and obtaining new income time sequence characteristic data of all nodes after the node i is inhibited; obtaining a new reference degree sequence based on new income time sequence feature data of all nodes obtained after the suppression of the node i; and comparing a new reference degree sequence obtained after the node i is inhibited with the reference degree sequence of the nodes, finding out the nodes with changed reference degrees so as to obtain network nodes connected with the node i, judging the number of hidden nodes connected with the node i, and finally inferring the network structure of the whole social network. A complex network structure in a nonlinear dynamic system is captured, connection information between nodes is deeply mined, and accuracy and comprehensiveness are improved.

Description

Technical Field

[0001] This invention relates to the field of network identification technology, and in particular to a social network inference method and a security monitoring method. Background Technology

[0002] In engineering and technical fields such as cybersecurity, power system monitoring, and social media content security, accurately understanding the connections between various components within a system is fundamental to effective monitoring and management. However, in practical engineering, due to limitations in physical sensor deployment, communication bandwidth constraints, or the active concealment of abnormal nodes, the complete internal topology of a system is often not directly obtainable. This "structural unobservability" severely impacts the accuracy and timeliness of system security monitoring.

[0003] Taking content security monitoring on social media platforms as an example, platforms need to detect abnormal collaborative intervention behaviors between user accounts in real time. Existing technologies mainly infer the relationships between accounts by analyzing the statistical correlation of account behavior data or constructing linear models. However, these methods have significant technical shortcomings: First, methods based on statistical correlation are easily affected by platform-wide events or public noise, misjudging accounts that are not directly related as having a collaborative relationship; second, methods based on linear models cannot accurately describe the complex nonlinear interaction process between accounts, leading to a large deviation between the inferred results and the actual connection structure; furthermore, when there are accounts that are secretly interfering in the system, existing methods have difficulty distinguishing between normal interactions and abnormal interventions, and cannot identify these hidden nodes and their impact on the system.

[0004] Specifically, in social media platforms, each account acts as a node in the social network, and interactions between accounts form connections. Hidden accounts can subtly interfere with the network system, acting as hidden nodes. The behavioral data of observable accounts (such as forwarding and commenting) constitutes a discrete time series, and accounts influence each other through complex feedback mechanisms and these connections. Subtly interfering accounts disrupt the normal behavioral patterns of observable accounts through specific connections, causing significant errors in connection relationship inferences based on traditional methods. This problem also exists in fields such as cybersecurity and power system monitoring, severely hindering the improvement of system security monitoring effectiveness.

[0005] Therefore, there is an urgent need in this field for a new solution that can overcome the above-mentioned technical defects, accurately reconstruct the real connection relationship between user accounts on social platforms when the connection relationship between user accounts cannot be directly observed, and effectively identify possible hidden nodes, so as to provide reliable technical support for system security monitoring. Summary of the Invention

[0006] To overcome the shortcomings of the prior art, this invention proposes a social network inference method and a security monitoring method.

[0007] To achieve the above objectives, the present invention adopts the following technical solution, including: A social network inference method, comprising: S1: In the game dynamics system, social platform user accounts are regarded as nodes, and the interactions between accounts are regarded as connections between nodes; collect the time series characteristics of the payouts of all nodes; wherein, the time series characteristics of the payouts of each node are composed of the payouts of the corresponding node at several time points within a set time period; S2: Based on the revenue time-series feature data of each node, the strength of each node is obtained in the frequency domain through the revenue frequency domain feature data, and the reference degree sequence composed of all node reference degrees is calculated iteratively. S3: In the game dynamics system, suppress the behavior of node i and obtain the new payoff time-series feature data of all nodes after suppressing node i; refer to step S2 to obtain the new reference degree sequence after suppressing node i. S4: Compare the new reference degree sequence obtained after suppressing node i with the reference degree sequence to find the nodes with decreased reference degree, thereby obtaining the network nodes connected to node i. At the same time, based on the number of nodes with decreased reference degree and the reconstruction degree of node i, identify whether there are hidden nodes connected to node i and determine the number of hidden nodes connected to node i; hidden nodes are hidden user accounts. S5: Following the operation process of steps S3-S4, suppress the dynamic behavior of each node in the game dynamics system, calculate the adjacency information and hidden connection information of each node, and thus obtain the structural inference of the entire network and the identification results of hidden nodes.

[0008] Preferably, in step S1, the formula for calculating the payoff of node i in a game with any neighbor node j is as follows: ; Where j is a neighboring node of node i; This refers to the strategy used by node i. Neighbor node j uses strategy The payoff of node i after the game; all Nodes with a value of 0 choose to betray, while nodes with a value of 1 choose to cooperate. The payoff parameters representing the Prisoner's Dilemma game cover four typical outcomes: cooperation between the two sides, when the node... and nodes When a cooperative strategy is adopted, the benefits obtained by each party are: One party cooperates while the other betrays; when the node... Choose to cooperate and nodes When choosing to betray, the node Will gain the benefits of betrayal And nodes Will gain tempting benefits Conversely, if both parties betray each other, and both nodes choose to betray, their respective gains are... .

[0009] Preferably, step S2 includes: S21: Obtain the frequency domain characteristic data of each node's revenue based on the time-series revenue characteristic data of each node. The calculation formula is: ; Where w is the imaginary unit; T is the length of the time series; t is the time index; P i (t) represents the reward of node i at time t; f is the frequency index. ; For nodes In frequency index The complex Fourier coefficients at the point are the frequency domain characteristic data of the earnings; e is the base of the natural logarithm. S22: Obtain the strength of node i based on the frequency domain characteristic data of node i's gains across all frequency domains; the strength S of node i i The expression is: ; Where F is the set of frequency indices; For mold taking operation; S23: Intensity vector formed by the intensity combination of each node. Perform iterative calculations to obtain the reference degree sequence K of the nodes. The reference degree sequence of the nodes includes the reference degrees of all nodes.

[0010] Preferably, step S23 includes: S231: Intensity vector formed by the intensity combination of each node. Non-zero intensity components are filtered out, that is, intensity components with nodal intensity of 0 are removed, and the median intensity S is calculated. med ; S232: Initialize the reference degree sequence K of the nodes to 0, and set the candidate count k... c Set to 1; optimal error for Candidate count k c The traversal range is [1, k max ]; where k max =N-1, where N is the maximum possible degree of each node; N is the total number of nodes. S233: Based on median intensity Smed and candidate count kc Calculate the linear factor =Smed / k c ; S234: The reconstruction degree of each node is obtained by fitting the strength and linear factor of each node. ; S235: Reconstruction degree based on each node Calculate the reconstruction strength of each node ; S236: Calculate the overall fitting error formed by all nodes based on the strength and reconstruction strength of each node. ; S237: Determine the overall fitting error Is it less than the optimal error? If yes, take the current overall fitting error as the optimal error, increment the candidate count by 1, and continue with steps S233-S237; if no, output the reference degree sequence K composed of the reconstruction degree of each node. ,i=0,1,...,N-1.

[0011] Preferably, step S4 includes: S41: Compare the new reference degree sequence obtained after suppressing node i with the reference degree of each node in the reference degree sequence one by one, find the nodes in the new reference degree sequence whose reference degree has decreased, and establish a set V of nodes with decreased reference degree. d and neighboring nodes ; S42: Fill the adjacency information in the adjacency matrix M of node i with the nodes in the set of nodes whose reference degree decreases, that is, for any , This allows for the construction of a node network connected to node i; S43: The number N nodes in the new reference degree sequence where the reference degree has decreased. d Reconstruction degree of node i Compare; if If N d < The number of hidden nodes connected to node i, L(i), is calculated as follows: -N d .

[0012] Preferably, in step S5, if L(i) = 1, and That is, only nodes If a hidden connection exists, and no other node has a hidden connection, then the total number of hidden nodes in the entire network is 1, and each hidden node has exactly one neighbor node. ; Let i be the set of nodes remaining after removing node i. If multiple nodes have hidden connections simultaneously, the set of nodes with hidden connections is denoted as V. e ,but The number of hidden nodes in the entire network The upper and lower limits are N respectively. H and N L The calculation formula is: ; ; Where max is the maximum value function.

[0013] Preferably, in step S1, the gain of node i at time t is... for: ; Where, N i Let i be the set of neighboring nodes of node i.

[0014] Preferably, the reconstructibility degree of each node The calculation formula is: ; The round(.) function performs rounding. Overall fitting error The calculation formula is: ; Where N is the total number of nodes.

[0015] A security monitoring method employs a social network inference approach to obtain the structural inference of the entire network and the identification results of hidden nodes, thereby monitoring the network structural security of the social platform. Specifically, based on the inferred network topology and the connection relationships of hidden nodes, the known adjacency relationships of each node in the network are compared with the inferred hidden connection relationships. When the number of hidden connections of a node exceeds a preset ratio relative to the number of its explicit adjacency connections, the node is marked as a suspected risk node, and a suspected risk node group consisting of several suspected risk nodes is obtained accordingly. Then, the node density within the suspected risk node group and the connection density between the suspected risk node group and external nodes are calculated. When the difference between the density within the suspected risk node group and the density of external nodes is higher than a set threshold, a security risk assessment and risk classification of the network structural security status of the target social platform is performed, and a corresponding level of risk warning signal is output.

[0016] A security monitoring system includes a memory and a processor. The memory stores a computer program, and the processor is connected to the memory. The processor executes the computer program to implement a security monitoring method.

[0017] The advantages of this invention are: (1) This invention transforms the time-series characteristics of user account nodes' earnings in a social network into the frequency domain using Discrete Fourier Transform (DFT) for analysis. Combined with perturbation operations on network dynamics, it can effectively recover the network structure and detect hidden node information. Its advantage lies in deeply linking the dynamic and structural characteristics of nodes, analyzing the dynamic data of nodes from a frequency domain perspective, and combining the changes in node dynamics with the node structure. Compared with traditional network inference methods, it performs better in evolutionary game dynamics, can better capture the complex network structure in nonlinear dynamic systems, deeply mine the connection information between nodes, accurately reconstruct the real connection relationship between user accounts, and effectively identify possible hidden nodes, providing reliable technical support for system security monitoring.

[0018] (2) In the data collection process, this invention fills the research gap in evolutionary game dynamics by collecting and analyzing the game payoff data of nodes, laying a reliable foundation for subsequent data analysis and processing. Evolutionary game dynamics is a dynamic system in a real-world scenario. The analysis and research on the evolutionary game dynamics process enables the recovered network to accurately reflect the actual interaction relationships of user account nodes on the social platform, enhancing the practicality and realism of the method.

[0019] (3) This invention utilizes Discrete Fourier Transform combined with a linear fitting algorithm to analyze the temporal characteristics of node revenue and maps the node's dynamic data to its structural features. This process incorporates advanced techniques in signal processing, using Discrete Fourier Transform to transform the temporal data to the frequency domain for analysis, extracting the deep mechanisms of the nodes, and constructing the relationship between node strength and node degree. Through the combination of these two processes, the node's dynamic data can be efficiently and accurately converted to the node's reference degree, providing a solid foundation for subsequent analysis of node adjacency, enabling the dynamic data of social platform user account nodes to truly reflect the structural features in the network topology.

[0020] (4) This invention identifies node connectivity based on a driver-response method. By comparing the changes in the reference degree sequence before and after node suppression, it identifies the node's direct neighbors and detects the number of hidden connections. Its advantage lies in starting with the influence of a node on its neighbors; changes in the node's dynamic state are directly reflected in its neighbors, reflecting the dependencies between nodes and providing a feasible path for identifying network structure. The additional detected connectivity information further assists in identifying hidden nodes in social platform networks.

[0021] (5) This invention reconstructs the connection information of each node by traversing the node dynamics in the network, thereby identifying the adjacency matrix structure of the entire network. By comprehensively considering the internal and external connections of nodes, the dynamic processes of nodes are explored from multiple dimensions, reflecting the topological structure and actual influence distribution of nodes, providing key support for accurate deterministic social platform network topology inference and hidden node identification.

[0022] (6) This invention analyzes the real network topology by defining a hidden connection cardinality vector and combining it with adjacency matrix information. Its advantage lies in using the number of hidden connections of each node to define the number of hidden nodes in the entire network, fully considering the boundary cases of the two extremes, as well as the influence of hidden nodes on known nodes. It can capture the position and influence of hidden nodes in the social platform network, improving the scientificity and reliability of social platform abnormal intervention (hidden nodes) identification. Attached Figure Description

[0023] Figure 1 This is a flowchart of the steps of a social network inference method according to the present invention; Figure 2 This is the game dynamics system in this invention; Figure 3 This refers to the dynamic system after suppressing a specified node in this invention; Figure 4 This is a schematic diagram of the network structure type of the present invention; Figure 5 This is a schematic diagram illustrating the acquisition of the reference degree sequence of the nodes in this invention. Detailed Implementation

[0024] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0025] Network structure is fundamental to understanding the functions and behaviors of complex systems such as society, technology, and the economy. For example, the connection patterns of social networks determine the efficiency of information or rumor dissemination, the topology of supply chain networks influences the diffusion path of risks, and the structure of cooperative networks directly relates to innovation effectiveness. However, in practical applications, obtaining complete network connection data is often extremely difficult. Due to technological limitations or high costs, the connections between nodes often cannot be measured directly and comprehensively. In particular, weak connections that are difficult to observe are prevalent in systems, and there may even be completely undiscovered hidden nodes. These hidden nodes and the hidden networks they form with observable nodes or with each other pose a substantial threat to the security, stability, and cognitive accuracy of the system. For example, in social networks, hidden nodes may represent individuals who influence public opinion in a covert manner, and their existence can distort judgments about the true path of information dissemination and the structure of influence.

[0026] Therefore, how to efficiently and accurately reconstruct the entire underlying network structure based on limited dynamic data, usually derived from only a portion of observable nodes, and further identify hidden nodes and connections, has become a crucial and highly challenging frontier problem in network science. Unlike traditional, more extensively studied diffusion dynamics (such as disease transmission and information diffusion), many key processes in the real world, such as opinion interactions on social platforms, pricing games in e-commerce systems, and offensive and defensive confrontations in the security field, are more consistent with the paradigm of evolutionary game dynamics. This dynamic has core characteristics such as discrete time, nonlinearity, policy adaptation, and endogenous reward feedback; that is, the behavioral strategies of nodes are dynamically adjusted based on the rewards they obtain from interacting with their neighbors. This complex feedback mechanism presents unique challenges to network inference based on such dynamic data: First, the statistical correlation of node behavior may originate from policy resonance or external shocks, rather than actual connectivity; second, the reward signal is the aggregation result of neighborhood behavior, and its nonlinear characteristics make traditional methods based on local linear approximations prone to failure; third, the existence of hidden nodes can interfere with the dynamics between observable nodes in a "external" way, obscuring the true connection patterns and greatly increasing structural unobservability.

[0027] Currently, methods for network structure inference and hidden node identification can be mainly divided into three categories, but they all have significant limitations when dealing with evolutionary game dynamics scenarios: The first category is based on statistical characteristics, such as Granger causality, mutual information, and transition entropy. These methods infer connectivity by analyzing the statistical dependencies of time series. While they have some tolerance for mild nonlinearity, they struggle to handle strong endogenous feedback and strategic synergy in evolutionary games. They are prone to misjudging noise or common drivers as direct connections, leading to a high false alarm rate.

[0028] The second category is methods based on solving matrix equations, such as compressed sensing and optimization algorithms. These methods model network dynamics as matrix equations and solve for the adjacency matrix. They perform well in handling sparse networks and certain linear models, but in evolutionary game dynamics, the aggregation of payoffs severely weakens the identifiability of model parameters, and the systematic bias introduced by hidden nodes can make the matrix equations ill-conditioned, making it difficult to obtain stable and accurate solutions.

[0029] The third category is based on deep learning methods, which utilize neural networks to learn complex patterns in time series data. While these methods exhibit some robustness in noisy environments, their performance heavily relies on massive amounts of training data, and the models lack interpretability and have poor generalization ability. Especially in evolutionary game scenarios where data is scarce and dynamic rules are highly variable (such as games with different payoff matrices), they often suffer from low inference accuracy and enormous computational costs.

[0030] In summary, the existing technologies have the following common shortcomings: (1) poor adaptability to evolutionary game dynamics, and existing models are difficult to accurately characterize core features such as policy adaptation and strong nonlinear feedback; (2) weak or missing ability to identify hidden nodes, and most methods do not specifically model the influence of hidden nodes, making it impossible to locate and identify hidden entities while inferring visible connections; (3) insufficient computational efficiency and scalability, making it difficult to meet the actual application needs of large-scale complex networks.

[0031] Against the backdrop of the aforementioned concentrated challenges, scenario-based requirements are particularly prominent. Taking the detection and tracing of abnormal intervention behaviors in platform-level information dissemination as an example, a small number of hidden accounts amplify or suppress specific issues through collaborative operations. Observable nodes are active accounts within the platform, making interactive choices of cooperation or betrayal at discrete time steps and obtaining measurable gains. Individuals update their strategies based on neighborhood feedback, exhibiting the discrete, adaptive, and strong feedback characteristics of evolutionary game dynamics. Hidden nodes may inject consistency instructions into the platform through external coordination channels, or exert asymmetric influence at key moments using low-activity or one-off accounts. Gains, as neighborhood aggregation signals, cause hidden nodes to change the intensity of the gain spectrum and the rhythm of their strategies in an externalistic manner, thereby obscuring the true connection structure. This type of scenario presents integrated technical requirements for structural reconstruction, hidden node identification, and governance action generation, demanding that accuracy and efficiency be maintained under conditions of incomplete observation and strong feedback.

[0032] Therefore, there is an urgent need in this field for a new technical solution that can overcome the above-mentioned defects and provide a unified, efficient and robust framework that can simultaneously and accurately complete the tasks of inferring the visible network structure and identifying hidden nodes and their connections under the setting of evolutionary game dynamics, thereby providing more reliable technical support for applications such as network security, monitoring of information dissemination anomalies, and supply chain risk management.

[0033] Detection and tracing of abnormal intervention behaviors in platform-level information dissemination. In this scenario, a small number of hidden accounts amplify or suppress specific issues through collaborative operations. Observable nodes are active accounts within the platform that make interactive choices of cooperation or betrayal at discrete time steps, such as forwarding, liking, commenting, or boycotting, and thereby obtain measurable benefits, such as increased interaction, content exposure, and account credit scores. Individuals update their strategies in the next time step based on feedback from their neighborhood, forming a discrete, adaptive, and strongly feedback-driven temporal process that conforms to the dynamics of evolutionary game theory.

[0034] Hidden nodes primarily exist in two forms: first, external coordination channels inject consistency instructions into accounts within the platform; second, inactive or one-off accounts within the platform exert asymmetric influence at critical moments. Since returns are aggregated signals of neighborhood behavior, hidden nodes alter the return spectrum strength and policy update rhythm of observable nodes through externalities, thereby masking the true connection patterns.

[0035] Based on this scheme, frequency domain features are extracted from the time series of observable account earnings. Through robust matching of strength and degree, three capabilities can be achieved without relying on complete observations: First, reconstructing the interaction framework between visible accounts within the platform; second, performing statistical tests on the residual strength of visible edges that are difficult to interpret, obtaining the hidden link count and suspicious tracing direction for each account; third, generating executable governance actions, such as gray-scale weighting, disconnecting diffusion links, and freezing suspicious clusters, enabling targeted and traceable identification and handling of abnormal information dissemination interventions. This scenario clearly defines the protected object as platform content security and dissemination order, and the technical effect as simultaneously completing structural reconstruction and hidden node identification under evolutionary game dynamics conditions, demonstrating direct engineering feasibility.

[0036] Example 1 like Figures 1-5 As shown, this invention proposes a social network inference method, comprising: S1: In the game dynamics system, social platform user accounts are regarded as nodes, and the payout time-series characteristic data of all nodes are collected.

[0037] To obtain the payoff data of nodes within a set time period in the current evolutionary game dynamics system, this data is used as the temporal characteristic data of node payoffs. This data should be collected under natural system operation without specific external interference, serving as the benchmark dataset for subsequent analysis. Here, "payoff" refers to the reward obtained by a node based on its own strategy and the strategies of its neighboring nodes, which is the core signal driving the dynamic evolution of the entire system.

[0038] The game dynamics system used in this embodiment is as follows: Figure 2As shown, the nodes with black borders are directly accessible nodes. Their existence can be determined, and their corresponding revenue time-series feature data can be collected. The node number is... For nodes with dashed borders, these are nodes that may exist in the network, but their existence cannot be determined, and corresponding revenue time-series feature data cannot be collected. Furthermore, it is impossible to identify these nodes. Secondly, even for nodes that can be directly accessed, their corresponding network topology cannot be directly obtained. Therefore, the real network topology of nodes that can be directly accessed is represented by dashed lines, indicating that there is no information about the network structure. Only the revenue data of nodes with black borders can be accessed, and external interference can be applied to such nodes.

[0039] This invention is based on evolutionary game theory (such as the Prisoner's Dilemma game model). Within this framework, nodes dynamically adjust their behavioral strategies (such as "cooperation" or "betrayal") based on the payoff feedback obtained from local interactions. Therefore, the temporal characteristics of a node's payoffs are essentially a time record of the aggregate effect of all its neighbors' strategies on it, providing a unique source of information for inferring its connected environment (including hidden nodes).

[0040] Through this step, we transform the complex problem of network reverse engineering into the problem of analyzing observable time-series revenue data with clear physical meaning, laying the foundation for subsequent core algorithm processing.

[0041] Consider the diagram Let V represent the underlying interactive network, where the set of nodes is V and the set of edges is E. In each round of the game dynamics, the nodes... and neighboring nodes (N) i Let be the set of neighboring nodes of node i. Then, under the rules of the Prisoner's Dilemma, a game is played, and the payoff for node i in a single game against any neighboring node j is calculated using the following formula: ; Where j is a neighboring node of node i; This refers to the strategy used by node i. Neighbor node j uses strategy The payoff of node i after the game; all This represents the node's strategy choice (cooperation is 1 or betrayal is 0). The payoff parameters representing the Prisoner's Dilemma game cover four typical outcomes: cooperation between the two sides, when the node... and nodes When a cooperative strategy is adopted, the benefits obtained by each party are: One party cooperates while the other betrays; when the node... Choose to cooperate and nodes When choosing to betray, the node Will gain the benefits of betrayal And nodes Will gain tempting benefits Conversely, if both parties betray each other, and both nodes choose to betray, their respective gains are... .

[0042] Considering the game situation between node i and all its neighboring nodes, the payoff of node i at time t is... for: ; Thus, the time-series characteristic data of the revenue of node i are obtained. .

[0043] S2: Based on the time-series revenue feature data of each node, the strength of each node is obtained in the frequency domain through the revenue frequency domain feature data, and the reference degree sequence composed of the reference degrees of all nodes is calculated, including: S21: Time-series revenue characteristic data P based on each node i Obtain the frequency domain feature data of the revenue of each node. The calculation formula is: ; Where w is the imaginary unit; e represents the base of the natural logarithm; T represents the length of the time series; t is the time index; and f is the frequency index. ; Representative node In frequency index The complex Fourier coefficients at the given point are the frequency domain characteristics of the earnings. The purpose of the Discrete Fourier Transform (DFT) is not to change the information, but to transform the dispersed and noisy time-series earnings characteristics in the time domain into a stable, comparable, and more sensitive frequency domain representation to changes in network structure.

[0044] This means that the number of frequency indices is the same as the number of time indices, both being T. In other words, the number of time-series revenue feature data points is equal to the number of frequency-domain revenue feature data points. For example, when f=1, substituting f=1 into the formula for calculating the frequency-domain revenue feature data yields the following result. .

[0045] Furthermore, because the profit P of node i at time t i (t) can be seen as the result of the game interaction between node i and all its neighbors, therefore the payoff P of node i at time t is... i (t) can be decomposed into: ; In the formula, p represents the degree of node i (i.e., the number of neighboring nodes of node i); i (t) represents the average revenue generated by each neighboring node at time t.

[0046] Therefore, the gain of node i at frequency domain f It can also be expressed as ; in, This represents the average revenue generated by each neighboring node at frequency domain f; S22: Obtain the strength of node i based on the frequency domain feature data of node i's gains across all frequency domains. The strength S of node i is... i The calculation formula is: ; in, For modulo operation; F is the set of frequency indices.

[0047] By defining intensity, we compress high-dimensional frequency domain features into a single scalar, providing a foundation for subsequent discretization and reference degree calculation. We utilize amplitude to eliminate phase effects, retaining only energy; and we perform averaging and aggregation across multiple frequency bands to avoid accidental amplification of a single band. Because p i (t) is independent of the degree of the node and represents the average payoff for each pairwise game, therefore S p The value is a constant, thus the strength S of node i can be obtained. i It is positively correlated with the degree of node i: .

[0048] In theory, the strength of node i can also be defined as: ; Among them, S p p represents the average revenue p generated by each neighboring node at time t. i (t) is the average magnitude over the frequency index set F.

[0049] S23: Intensity vector formed by the intensity combination of each node. Iterative calculations are performed to obtain the reference degree sequence of each node, which includes the reference degrees of all nodes. The core objective is to transform the continuous intensity vector... The mapping is a discrete reference degree sequence K. Each step is not used to directly calculate the network topology, but rather to progressively construct a proxy quantity that is sensitive to disturbance responses and comparable across the entire network. Ultimately, response information is obtained through node intervention, thus avoiding reliance on global modeling or prior assumptions. This includes: S231: Intensity vector formed by the intensity combination of each node. Non-zero intensity components are filtered out, that is, intensity components with nodal intensity of 0 are removed, and the median intensity S is calculated. med .

[0050] Non-zero intensity component selection refers to extracting components that are strictly greater than 0 from the intensity vector S to form a non-zero intensity set S. nz .if If so, directly output the zero vector of length N as the estimation sequence and end the process. Then, from the set of non-zero intensities... Select median intensity S med The intensity vector is formed by combining the intensity of each node. Due to the high heterogeneity of the nodes, we selected the median as the typical strength representative among all nodes and removed points with a strength of 0 to prevent interference with the degree calibration.

[0051] S232: Initialize the degree of each node to 0, and set the candidate count k. c Set to 1; optimal error for Candidate count k c The traversal range is [1, k max ]; where k max =N-1, where N is the maximum possible degree for each node; N is the total number of nodes. Candidate count k c Used to enumerate possible typical connection sizes, providing interpretable, finite-range calibration anchors when the reference scale is unknown.

[0052] S233: Based on median intensity Smed and candidate count k c Calculate the linear factor Sq = Smed / k c The scaling factor Sq is used to characterize the "intensity corresponding to a unit of reference degree", aligning the intensity dimension with the reference dimension, so that the reference degrees of different nodes have a consistent comparison basis across the entire network.

[0053] S234: The reconstruction degree of each node is obtained by fitting the strength and linear factor of each node. The calculation formula is: ; The `round(.)` operator performs rounding. The strength of a node is calculated as its degree value; since degree is an integer, the `round` operation is used.

[0054] Enforce constraints, Clip to range And guarantee If the sum of the degrees of all nodes is even (in an undirected graph), then discard the degree sequence formed by all current node degrees and continue iterating.

[0055] S235: Calculate the reconstruction intensity of each node based on its reconstruction degree, and infer the reconstruction intensity of the node from the reference degree. This can verify the consistency of the intensity-reference degree mapping relationship within the node range, providing an objective evaluation basis for scale selection. ; S236: Calculate the overall fitting error formed by all nodes based on the strength and reconstruction strength of each node. The calculation formula is: ; The overall fitting error is used to measure the degree of deviation between the reference degree and the actual intensity under the current scale calibration, ensuring that the reference degree sequence has optimal consistency at the node level.

[0056] S237: Determine the overall fitting error Is it less than the optimal error? ,Right now Yes, take the current overall fitting error as the optimal error and perform candidate counting k. c If ++, continue with steps S233-S237; otherwise, output the reference degree sequence K composed of the reconstruction degree of each node. Select the k that minimizes the overall fitting error from a finite candidate range. c This allows us to obtain the reference degree sequence corresponding to the intensity sequence, avoiding reliance on local or empirical settings.

[0057] In this embodiment, after fitting and iterative operations, the reference degree sequence K of the nodes in the network can be obtained as follows: ; After the above operations are completed, the resulting degree sequence K of the nodes is called the reference degree sequence. At this point, the nodes have not been affected by external interference, and the network topology has not been changed. K can be regarded as the actual network node degree sequence.

[0058] This process aims to transform the continuous strength values ​​of nodes (connection strength metrics derived from dynamic data) into discrete integer degree sequences (i.e., estimates of the number of edges connected to each node). The core idea is to establish a linear relationship between strength and degree values ​​by introducing a scaling factor related to the number of hidden nodes, and to minimize the overall fitting error by iteratively searching for the optimal factor.

[0059] S3: In the game dynamics system, suppress the behavior of node i and obtain the new payoff time-series feature data of all nodes after suppressing node i. The new time-series feature data of the revenue of all nodes after suppressing node i will be used. The new reference degree sequence is obtained after obtaining the suppression node i according to the process in step S2. .

[0060] By suppressing the behavior of node i, node i no longer participates in the game with its neighbors in the game dynamics system. In this case, new payoff time-series characteristic data of all nodes are collected. .

[0061] After node i's game-playing behavior is suppressed, it can no longer participate in the game process. This will affect node i's neighboring nodes. This has a direct impact. Specifically, the lack of interaction between node j and node i in the game dynamics system, compared to the previous normal game state, will be reflected in the node degree value calculated based on the new payoff time-series feature data. Therefore, this method can be used to find the direct neighbor nodes of node i.

[0062] like Figure 3 As shown, game behavior suppression was applied to node 7 (red node) in the dynamic system, preventing node 7 from participating in the game process and resulting in new payoff time-series feature data. The red time-series revenue data on the right represents the revenue time-series revenue data of the nodes affected after node 7 was suppressed.

[0063] For the new time-series feature data of all nodes obtained after suppressing node i, The new reference degree sequence is obtained after obtaining the suppression node i according to the process in step S2. For example, if node 7 is suppressed, the resulting new reference degree sequence is: .

[0064] S4: The new reference sequence obtained after suppressing node i. By comparing with the reference degree sequence, nodes whose reference degrees have changed are identified, thus obtaining the network nodes connected to node i. Simultaneously, based on a comparison between the number of nodes with changed reference degrees and the reconstruction degree of node i, it is determined whether there are hidden nodes connected to node i and the number of hidden nodes connected to node i is counted, including: S41: The new reference sequence obtained after suppressing node i. Compare the reference degree of each node in the new reference degree sequence with the reference degree of each node in the new reference degree sequence, find the nodes in the new reference degree sequence whose reference degree has decreased, and establish a set V of nodes with decreased reference degree. d Then the neighboring nodes When making comparisons, it is not necessary to compare the reference degree of the suppression node itself.

[0065] S42: Fill the adjacency information in the adjacency matrix M of node i with the adjacency information of the nodes in the set of nodes whose reference degree has decreased, that is, for any , This allows for the construction of a node network connected to node i; This indicates that the adjacency matrix is ​​a symmetric matrix and that node i is connected to node j. Therefore, node j is also connected to node i.

[0066] when This indicates that there is a direct connection between node i and node j.

[0067] S43: Count the number of nodes in the new reference degree sequence where the reference degree has decreased. Reconstruction degree of node i Compare; if Node i has no hidden nodes, and all its connections can be interpreted from the known nodes. The number of nodes affected by node i is consistent with the degree of node i; if N d < The number of nodes affected by the suppression of node i is inconsistent with the degree calculated for node i under normal conditions. It is known that the connections within a node cannot fully explain the degree of node i, indicating that node i has additional hidden connections to support its degree value. Simultaneously, calculate the number of hidden nodes connected to node i, L(i) = -N d .

[0068] Suppressing a single node weakens its interaction with neighboring nodes, resulting in a significant decrease in the reference level of neighboring nodes. By comparing the changes in reference level before and after suppression, neighboring nodes can be directly identified, and the number of hidden connections can be determined from the difference in changes.

[0069] In this embodiment, the two reference degree sequences obtained above are first compared to find the nodes whose reference degree changes before and after the suppression node, and the total number of nodes that change is recorded. The specific steps are as follows: by Figure 3 Taking the result after suppressing node 7 as an example, the reference degree sequence K calculated under the condition of no interference is: ; After suppressing node 7, the new reference degree sequence is obtained as follows: ; In the formula, represent , for the node after suppressing node 7 The time-series data is used to calculate the new reference degree of node i. and By comparing, we can obtain the set of neighboring nodes of node 7 as follows: ; In this case, the number of neighbors of node 7 is: .

[0070] Compare the number of neighbors of node 7 with the referentiality of node 7, and record the number of hidden node connections, i.e.: ; This allows us to obtain the adjacency information of node 7, as well as the number of hidden node connections of node 7.

[0071] When the suppressed node i is calculated through step S3, the new reference degree sequence of the nodes in the network is obtained. Then, combining the node reference degree sequence K without node suppression operation in S2, the new reference degree sequence after suppression i is obtained by modifying the reference degree sequence K and the new reference degree sequence after suppression i. The comparison can restore the connection status of node i in the network and detect whether there are hidden nodes or additional hidden connections in node i in the network.

[0072] S5: Following the operation process of steps S3-S4, suppress the dynamic behavior of each node in the game dynamics system, calculate the adjacency information and hidden connection information of each node, and thus obtain the structural inference of the entire network and the identification results of hidden nodes.

[0073] Steps S3 and S4 are performed to identify the adjacency information of each node in the game dynamics system. By utilizing the correlation between the node dynamics and structural features discovered in S2, and combining this with the dynamics suppression operation for a specified node, the lack of dynamic game behavior of a node will be reflected in its neighboring nodes.

[0074] During the processing, an adjacency matrix M is used to represent the connectivity between network nodes, with each row representing the adjacency information of a node. If M(i,j)=1, it means that there is a direct connection between node i and node j.

[0075] Additionally, hidden nodes are used to connect the counting vector. Store the external hidden connections of all nodes, where each element represents the number of external hidden connections for a node. If L(i) = 0, it means that node... There are no additional connections; if L(i) > 0, assuming L(i) = 1, then it means the node... There are external hidden connections, and the number of hidden connections is... .

[0076] When multiple nodes have hidden connections, we can give upper and lower bounds on the number of hidden nodes in the entire network. If L(i)=1, and That is, only nodes A hidden connection exists, but no other node has a hidden connection. At this point, the total number of hidden nodes in the entire network is 1, and each hidden node has exactly one neighbor node. . Let i be the set of nodes remaining after removing node i.

[0077] If multiple nodes have hidden connections simultaneously, the set of nodes with hidden connections is denoted as V. e ,but Then the number of hidden nodes in the entire network can be calculated. satisfy .in: ; ; Where max is the maximum value function; The lower bound of the number of hidden nodes is that each hidden node simultaneously connects to all nodes with hidden connections, and each node connected to will have one less hidden connection. The upper bound of the number of hidden nodes is that each hidden node occupies one hidden connection, and this number is equal to the total number of hidden connections in the network.

[0078] Based on the above process, by suppressing the operable nodes in the dynamic system in sequence, the neighbor and hidden connection information of each node can be calculated.

[0079] Example 2 A security monitoring method employs a social network inference method to obtain the structural inference of the entire network and the identification results of hidden nodes, and monitors the network structure security of social platforms based on the structural inference of the entire network and the identification results of hidden nodes.

[0080] Specifically, based on the inferred network topology and the connection relationships of hidden nodes, the known adjacency relationships of each node in the network are compared with the inferred hidden connection relationships. When the number of hidden connections of a node exceeds a preset ratio relative to the number of explicit adjacent connections, the node is marked as a suspected risk node, and a suspected risk node group consisting of multiple suspected risk nodes is obtained accordingly. Subsequently, using existing complex network analysis methods and anomaly detection techniques, the connection density within the suspected risk node group and between it and external nodes is calculated to assess whether it exhibits abnormal clustering characteristics relative to normal user groups. It is determined whether the risk node group exhibits abnormally concentrated connectivity, clustering, or similar "gang-like" characteristics, i.e., when the difference between the density within the suspected risk node group and the density of external nodes exceeds a set threshold. At the same time, combined with commonly used information propagation analysis models, it is determined whether there are abnormalities in the propagation path of content messages within the social platform in this node group. Furthermore, combined with the platform's existing user behavior analysis and revenue monitoring mechanisms, the abrupt behavioral characteristics of relevant nodes can be identified. Based on the comprehensive results of at least one or more of the above indicators, existing risk assessment and classification methods are used to quantitatively assess and classify the structural security status of the target social network, and output the corresponding level of risk warning signal to the platform security management module to support subsequent security handling processes such as manual review, account freezing or policy adjustment.

[0081] Example 3 A security monitoring system includes a memory and a processor. The memory stores a computer program, and the processor is connected to the memory. The processor executes the computer program to implement a security monitoring method.

[0082] As an embodiment of the present invention, the reference degree sequence composed of all nodes obtained in this process and the new reference degree sequence obtained by suppressing each node are shown in Table 1: Table 1. Connections without hidden nodes

[0083] Analysis of Table 1 shows that when node 0 is suppressed, the number N of nodes whose reference degree decreases in the new reference degree sequence is [not specified]. d The degree is 2, representing nodes 1 and 2 respectively. Therefore, it is proven that node 0 is connected to both nodes 1 and 2. Furthermore, node 0 originally had a degree of 2, which is equal to the number of nodes whose reference degree values ​​decreased in the new reference degree sequence. And when suppressing each other node, we have... Corresponding Therefore, the network connectivity of all nodes can be obtained: Node 1 is connected to nodes 0, 2, and 3; Node 2 is connected to nodes 0, 1, and 4; Node 3 is connected to nodes 1 and 4; Node 4 is connected to nodes 2, 3, 6, and 7; Node 5 is connected to node 7; Node 6 is connected to node 4; and Node 7 is connected to nodes 4 and 5. It is also proven that the reference degree of all nodes in the network can be obtained from the observed nodes, and there are no hidden nodes or extra connections. Figure 4 The situation shown in Figure a.

[0084] As an embodiment of the present invention, the reference degree sequence composed of all nodes obtained in this process and the new reference degree sequence obtained by suppressing each node are shown in Table 2.

[0085] Table 2 shows the connection status of a hidden node.

[0086] As shown in Table 2, when node 6 is suppressed, the number N of nodes with decreased reference degree in the new reference degree sequence is... d =1, for node 4 ( =2, =3). Therefore, it is proven that node 6 is connected to node 4, but the reference degree of node 6 is 2 > the number of nodes that decrease is 1, L(6) = -N d =2-1=1, therefore node 6 has an extra connection. Since only node 6 has this extra connection in the entire network, we can assume there is a hidden node in the network, and this node is connected to node 6. In this way, we can determine the existence of the hidden node and identify its neighbors. Figure 4 The result corresponding to 'b' in the table.

[0087] As an embodiment of the present invention, when the reference degree sequence composed of all nodes obtained in this process and the new reference degree sequence obtained by suppressing each node are shown in Table 3, Table 3 shows the connection status of multiple hidden nodes.

[0088] Table 3 shows that node 0 has a degree of 4, is connected to nodes 1 and 2, and has 2 external connections; node 1 has a degree of 3, is connected to nodes 0, 2, and 3, and has 0 external connections; node 2 has a degree of 4, is connected to nodes 0, 1, and 4, and has 1 external connection; node 3 has a degree of 3, is connected to nodes 1 and 4, and has 1 external connection; node 4 has a degree of 4, is connected to nodes 2, 3, 6, and 7, and has 0 external connections; node 5 has a degree of 1, is connected to node 7, and has 0 external connections; node 6 has a degree of 3, is connected to node 4, and has 2 external connections; node 7 has a degree of 3, is connected to nodes 4 and 5, and has 1 external connection. Therefore, the set V of nodes with hidden external connections is... e =(0,2,3,6,7), the set of nodes V with no external hidden connections. n =(1,4,5).

[0089] Following step S6, the upper and lower bounds of the number of hidden nodes in the entire network can be calculated as follows: ; ; and Figure 4 The number of actual hidden nodes in c is The result successfully fell within the upper and lower bounds of the hidden node, thus proving the effectiveness of the present invention. Following the above procedure, the network structure M can be successfully inferred; based on the hidden connection counting vector L, the existence of hidden nodes in the network can be identified, and if hidden nodes exist, the set of nodes with external connections can be calculated, further providing the connection status and quantity information of the hidden nodes in the entire network.

[0090] Of course, those skilled in the art will recognize that the present invention is not limited to the details of the exemplary embodiments described above, but also includes the same or similar structures that can be implemented in other specific forms without departing from the spirit or essential characteristics of the invention. Therefore, the embodiments should be considered illustrative and non-limiting in all respects, and the scope of the invention is defined by the appended claims rather than the foregoing description. Thus, all variations falling within the meaning and scope of equivalents of the claims are intended to be included within the present invention. No reference numerals in the claims should be construed as limiting the scope of the claims.

[0091] Furthermore, it should be understood that although this specification describes embodiments, not every embodiment contains only one independent technical solution. This narrative style is merely for clarity. Those skilled in the art should consider the specification as a whole, and the technical solutions in each embodiment can also be appropriately combined to form other embodiments that can be understood by those skilled in the art.

[0092] The technologies, shapes, and structures not described in detail in this invention are all known technologies.

Claims

1. A social network inference method, characterized in that, include: S1: In the game dynamics system, social platform user accounts are regarded as nodes, and the interactions between accounts are regarded as connections between nodes; Collect the time-series revenue characteristics of all nodes; wherein, the time-series revenue characteristics of each node consist of the revenue of the corresponding node at several time points within a set time period; S2: Based on the revenue time-series feature data of each node, the strength of each node is obtained in the frequency domain through the revenue frequency domain feature data, and the reference degree sequence composed of all node reference degrees is calculated iteratively. S3: In the game dynamics system, suppress the behavior of node i and obtain the new payoff time-series feature data of all nodes after suppressing node i; refer to step S2 to obtain the new reference degree sequence after suppressing node i. S4: Compare the new reference degree sequence obtained after suppressing node i with the reference degree sequence to find the nodes with decreased reference degree, thereby obtaining the network nodes connected to node i. At the same time, based on the number of nodes with decreased reference degree and the reconstruction degree of node i, identify whether there are hidden nodes connected to node i and determine the number of hidden nodes connected to node i; hidden nodes are hidden user accounts. S5: Following the operation process of steps S3-S4, suppress the dynamic behavior of each node in the game dynamics system, calculate the adjacency information and hidden connection information of each node, and thus obtain the structural inference of the entire network and the identification results of hidden nodes.

2. The social network inference method as described in claim 1, characterized in that, In step S1, the formula for calculating the payoff of node i in a game with any neighbor node j is as follows: Where j is a neighboring node of node i; This refers to the strategy used by node i. Neighbor node j uses strategy The payoff of node i after the game; all Nodes with a value of 0 choose to betray, while nodes with a value of 1 choose to cooperate. The payoff parameters representing the Prisoner's Dilemma game cover four typical outcomes: cooperation between the two sides, when the node... and nodes When a cooperative strategy is adopted, the benefits obtained by each party are: One party cooperates while the other betrays; when the node... Choose to cooperate and nodes When choosing to betray, the node Will gain the benefits of betrayal And nodes Will gain tempting benefits Conversely, if both parties betray each other, and both nodes choose to betray, their respective gains are... .

3. The social network inference method as described in claim 1, characterized in that, Step S2 includes: S21: Obtain the frequency domain characteristic data of each node's revenue based on the time-series revenue characteristic data of each node. The calculation formula is: Where w is the imaginary unit; T is the length of the time series; t is the time index; P i (t) represents the reward of node i at time t; f is the frequency index. ; For nodes In frequency index The complex Fourier coefficients at the point are the frequency domain characteristic data of the earnings; e is the base of the natural logarithm. S22: Obtain the strength of node i based on the frequency domain characteristic data of node i's gains across all frequency domains; the strength S of node i i The expression is: Where F is the set of frequency indices; For mold taking operation; S23: Intensity vector formed by the intensity combination of each node. Perform iterative calculations to obtain the reference degree sequence K of the nodes. The reference degree sequence of the nodes includes the reference degrees of all nodes.

4. The social network inference method as described in claim 3, characterized in that, Step S23 includes: S231: Intensity vector formed by the intensity combination of each node. Non-zero intensity components are filtered out, that is, intensity components with nodal intensity of 0 are removed, and the median intensity S is calculated. med ; S232: Initialize the reference degree sequence K of the nodes to 0, and set the candidate count k... c Set to 1; optimal error for Candidate count k c The traversal range is [1, k max ]; where k max =N-1, where N is the maximum possible degree of each node; N is the total number of nodes. S233: Based on median intensity Smed and candidate count k c Calculate the linear factor =Smed / k c ; S234: The reconstruction degree of each node is obtained by fitting the strength and linear factor of each node. ; S235: Reconstruction degree based on each node Calculate the reconstruction strength of each node ; S236: Calculate the overall fitting error formed by all nodes based on the strength and reconstruction strength of each node. ; S237: Determine the overall fitting error Is it less than the optimal error? If yes, take the current overall fitting error as the optimal error, increment the candidate count by 1, and continue with steps S233-S237; if no, output the reference degree sequence K composed of the reconstruction degree of each node. ,i=0,1,...,N-1.

5. The social network inference method as described in claim 1, characterized in that, Step S4 includes: S41: Compare the new reference degree sequence obtained after suppressing node i with the reference degree of each node in the reference degree sequence one by one, find the nodes in the new reference degree sequence whose reference degree has decreased, and establish a set V of nodes with decreased reference degree. d and neighboring nodes ; S42: Fill the adjacency information in the adjacency matrix M of node i with the nodes in the set of nodes whose reference degree decreases, that is, for any , This allows for the construction of a node network connected to node i; S43: The number N nodes in the new reference degree sequence where the reference degree has decreased. d Reconstruction degree of node i Compare; if If N d < The number of hidden nodes connected to node i, L(i), is calculated as follows: -N d .

6. The social network inference method as described in claim 4, characterized in that, In step S5, if L(i) = 1, and That is, only nodes If a hidden connection exists, and no other node has a hidden connection, then the total number of hidden nodes in the entire network is 1, and each hidden node has exactly one neighbor node. ; Let i be the set of nodes remaining after removing node i. If multiple nodes have hidden connections simultaneously, the set of nodes with hidden connections is denoted as V. e ,but The number of hidden nodes in the entire network The upper and lower limits are N respectively. H and N L The calculation formula is: Where max is the maximum value function.

7. The social network inference method as described in claim 1, characterized in that, In step S1, the profit of node i at time t for: Where, N i Let i be the set of neighboring nodes of node i.

8. The social network inference method as described in claim 4, characterized in that, Reconstruction degree of each node The calculation formula is: The round(.) function performs rounding. Overall fitting error The calculation formula is: Where N is the total number of nodes.

9. A safety monitoring method, characterized in that, A social network inference method as described in any one of claims 1-8 is used to obtain the structural inference and hidden node identification results of the entire network, and to monitor the network structure security of the social platform. Specifically, based on the inferred network topology and the connection relationships of hidden nodes, the known adjacency relationships of each node in the network are compared with the inferred hidden connection relationships. When the number of hidden connections of a node exceeds a preset ratio relative to the number of its explicit adjacency connections, the node is marked as a suspected risk node, and a suspected risk node group consisting of several suspected risk nodes is obtained accordingly. Then, the node density inside the suspected risk node group and the connection density between the suspected risk node group and external nodes are calculated. When the difference between the density inside the suspected risk node group and the density of external nodes is higher than a set threshold, a security risk assessment and risk classification of the network structure security status of the target social platform is performed, and a corresponding level of risk warning signal is output.

10. A safety monitoring system, characterized in that, It includes a memory and a processor. The memory stores a computer program, and the processor is connected to the memory. The processor is used to execute the computer program to implement a security monitoring method as described in claim 9.

Images