Network intelligence clue mining and key target identification method

Abstract

The application provides a network intelligence clue mining and key target identification method, relates to the technical field of network space security and open source intelligence analysis, and comprises the following steps: collecting and cleaning public data from multiple heterogeneous social platforms to uniformly map accounts of different platforms to node identifiers, and obtaining preprocessed multi-source data; based on the preprocessed multi-source data, a unified intelligence correlation graph is constructed, that is, taking accounts as nodes, taking interaction behaviors between accounts as edges and assigning weights, and simultaneously generating high-dimensional node feature vectors containing attributes and semantic features of each account; analyzing the unified intelligence correlation graph, extracting node features and topological structures thereof, and constructing a node implicit weight evaluation model according to the same, wherein the node implicit weight evaluation model adopts a graph attention network containing a multi-head attention mechanism. The application can realize intelligent monitoring of the whole process from macroscopic clue mining to microscopic target positioning.

Description

Technical Field

[0001] This invention relates to the fields of cyberspace security and open-source intelligence analysis technology, and in particular to methods for mining cyber intelligence clues and identifying key targets. Background Technology

[0002] As the cybersecurity landscape continues to escalate, social networking platforms have become core carriers for open-source intelligence gathering. They not only facilitate normal social interactions but also harbor high-risk activities such as organized dissemination of false information and communication. Accurately extracting high-value intelligence clues from massive amounts of noisy data and quickly locating key targets behind the scenes are core requirements for ensuring cybersecurity.

[0003] The current field of network intelligence analysis faces the following technical shortcomings: Traditional methods fail to effectively integrate network topology features with deep features such as node semantics and attributes, relying solely on explicit statistical data like forwarding volume and comment volume, or single topological indicators like degree centrality, to conduct intelligence lead mining and key target identification. This deficiency leads to a series of problems. For example, the mining of covert intelligence leads exhibits a significant lag; traditional methods can only passively perceive overt events that have already occurred, failing to capture abnormal leads in the incubation period, employing low-frequency covert communication or decentralized propagation strategies, thus missing opportunities for early intervention. Moreover, the identification of key targets suffers from serious distortion; relying solely on single indicators such as degree centrality makes it difficult to distinguish between ordinary active users and hidden core nodes, often misjudging frequently interacting ordinary users as key targets, while overlooking behind-the-scenes manipulators with few followers but located at the network's structural hubs, responsible for information bridging or command distribution, resulting in a lack of effective support for intelligence tracing and precision strikes. Summary of the Invention

[0004] The technical problem to be solved by this invention is to provide a method for mining network intelligence clues and identifying key targets. This method can solve the technical problem in the prior art that it is impossible to simultaneously take into account the network structure characteristics and node content characteristics, which leads to difficulties in mining high-value intelligence clues and inaccurate positioning of hidden key targets. It can realize intelligent monitoring of the entire process from macro clue mining to micro target positioning.

[0005] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0006] A method for mining network intelligence clues and identifying key targets, the method comprising:

[0007] Public data from multiple heterogeneous social platforms is collected and cleaned to map accounts from different platforms as node identifiers, resulting in preprocessed multi-source data.

[0008] Based on the preprocessed multi-source data, a unified intelligence association graph is constructed, which uses accounts as nodes, the interaction behavior between accounts as edges and assigns weights, and generates high-dimensional node feature vectors containing the attributes and semantic features of each account.

[0009] The unified intelligence association graph is analyzed to extract its node features and topology. Based on this, a node implicit weight evaluation model is constructed. The node implicit weight evaluation model adopts a graph attention network with a multi-head attention mechanism. By aggregating neighbor information, the implicit control relationship between nodes is learned to output the global importance score of the node.

[0010] The implicit weight evaluation model is used to process all nodes in the unified intelligence association graph and calculate the global importance score of each node.

[0011] Based on the global importance score, the unified intelligence association map is divided into several communities; the information diffusion rate, organizational density and cross-domain linkage of each community are calculated and merged into a community intelligence value score, and high-value intelligence clue communities are selected accordingly.

[0012] Within a high-value intelligence community, the global importance score of nodes is integrated with graph statistics within the community to calculate the comprehensive target value score of each node. Based on this comprehensive target value score, key intelligence targets are identified and output.

[0013] Furthermore, publicly available data from multiple heterogeneous social media platforms is collected and cleaned to uniformly map accounts from different platforms to node identifiers, resulting in preprocessed multi-source data, including:

[0014] We collected publicly available account data and interaction behavior data from multiple social media platforms to obtain raw multi-source data;

[0015] The original multi-source data is cleaned to filter out invalid information and noisy data, resulting in purified data.

[0016] Based on the purified data, public accounts on different social media platforms are aligned to ensure that the unique account identifiers on each platform are uniformly mapped to globally unique node identifiers, thereby generating preprocessed multi-source data.

[0017] Furthermore, based on the preprocessed multi-source data, a unified intelligence association graph is constructed, which uses accounts as nodes and interactions between accounts as edges with assigned weights. Simultaneously, high-dimensional node feature vectors containing the attributes and semantic features of each account are generated, including:

[0018] Using the global node identifiers obtained by mapping from the preprocessed multi-source data, corresponding nodes are created in the graph;

[0019] Identify the interaction behaviors between the nodes, and establish directed edges between the nodes based on the identified interaction behaviors;

[0020] Each directed edge is assigned a corresponding weight value based on the intensity of the identified interaction behavior.

[0021] Based on assigning corresponding weight values ​​to each directed edge, for each node, its multi-dimensional attribute features are extracted, and a pre-trained language model is used to encode its related text content to generate semantic feature vectors.

[0022] Multi-dimensional attribute features are combined with semantic feature vectors to form a high-dimensional node feature vector for each node;

[0023] By integrating all nodes, weighted directed edges, and high-dimensional node feature vectors, a unified intelligence association graph is constructed.

[0024] Furthermore, the unified intelligence association graph is analyzed to extract its node features and topology. Based on this, a node implicit weight evaluation model is constructed. This model employs a graph attention network incorporating a multi-head attention mechanism. By aggregating neighbor information, it learns the implicit control relationships between nodes to output the global importance score of each node, including:

[0025] Based on the unified intelligence association graph, load all the nodes it contains, the weighted directed edges between nodes, and the high-dimensional node feature vectors of each node.

[0026] From the unified intelligence association graph, high-dimensional node feature vectors are extracted as node features, and the connection relationship between nodes and weighted directed edges is extracted as the graph topology.

[0027] Based on the extracted node features and topology, a network structure for evaluating the implicit weights of nodes is constructed. The network structure adopts a graph attention network with a multi-head attention mechanism, which is used to learn the implicit control relationships between nodes by aggregating information from neighboring nodes.

[0028] The node implicit weight evaluation model is trained using labeled sample data. By optimizing the loss function, the model learns the importance of nodes, and finally the trained node implicit weight evaluation model is obtained.

[0029] Furthermore, using a node implicit weight evaluation model, all nodes in the unified intelligence association graph are processed to calculate the global importance score of each node, including:

[0030] Load the trained node implicit weight evaluation model into the inference environment;

[0031] After being loaded into the inference environment, the nodes in the unified intelligence association graph, the weighted directed edges between nodes, and the high-dimensional node feature vectors of each node are input into the trained node implicit weight evaluation model.

[0032] By using the multi-head attention mechanism in the trained node implicit weight evaluation model, the neighbor node information of each node is aggregated to learn and generate the importance representation of the node in the global network structure.

[0033] The importance representation is subjected to nonlinear mapping and normalization to output the global importance score of each node.

[0034] Furthermore, based on the obtained global importance score, the unified intelligence association map is divided into several communities; the information diffusion rate, organizational density, and cross-domain linkage of each community are calculated and merged into a community intelligence value score, based on which high-value intelligence clue communities are selected, including:

[0035] The unified intelligence association graph was divided into communities, resulting in multiple community division results.

[0036] For each community in the multiple community division results, calculate the information diffusion rate based on the information propagation time sequence characteristics within the community;

[0037] For the same community, calculate the organizational density, which reflects the degree of connection between nodes within the community;

[0038] For the same community, calculate the cross-domain linkage degree, which represents the diversity of social platforms spanned by nodes within the community;

[0039] For the same community, the calculated information dissemination rate, organizational density, and cross-domain linkage are weighted and fused to obtain the community intelligence value score of the community.

[0040] All communities are sorted according to their community intelligence value scores, and a predetermined number of communities with the highest scores are selected as high-value intelligence lead communities.

[0041] Furthermore, based on the community intelligence value scores of all communities, a predetermined number of communities with the highest scores are selected as high-value intelligence lead communities, including:

[0042] Based on the calculated community intelligence value scores of all communities, they are sorted in descending order to obtain a community ranking list;

[0043] Based on the preset number of filters, select the corresponding number of communities that rank highest from the community sorting list;

[0044] The communities with the highest rankings will be selected as the final high-value intelligence lead communities.

[0045] Furthermore, within high-value intelligence tip communities, the global importance score of nodes is integrated with graph statistics within the community to calculate the comprehensive target value score for each node. Based on this comprehensive target value score, key intelligence targets are identified and output, including:

[0046] For the final high-value intelligence community, obtain the global importance score of each node within the community;

[0047] For each node in the community, obtain the graph statistics indicators of the node within its respective community;

[0048] The global importance score of each node is weighted and fused with the graph statistics of the corresponding node to calculate the comprehensive target value score of each node.

[0049] Based on the comprehensive target value score of all nodes, the nodes in the community with the final high-value intelligence leads are sorted in descending order to obtain the ranking result;

[0050] Based on the sorting results and the preset number of key targets, key intelligence targets are identified and output from the nodes at the top of the sorting list.

[0051] The above-described solution of the present invention has at least the following beneficial effects:

[0052] By employing technologies such as multi-source data preprocessing and unified intelligence association graph construction, graph attention network model with multi-head attention mechanism, community three-dimensional value scoring and node comprehensive evaluation system, it overcomes the technical problems of traditional methods that cannot take into account network structure and node depth features, the lag in the mining of hidden intelligence clues and the distortion of key target positioning. It then achieves the technical effects of cross-platform integrated intelligence representation, accurate capture of hidden core nodes, rapid screening of high-value communities and accurate identification of key targets, providing intelligent support for the entire process of network situational awareness. Attached Figure Description

[0053] Figure 1 This is a flowchart illustrating the network intelligence clue mining and key target identification method provided in an embodiment of the present invention. Detailed Implementation

[0054] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0055] like Figure 1 As shown, embodiments of the present invention propose a method for mining network intelligence clues and identifying key targets, the method comprising the following steps:

[0056] Step 1: Collect and clean publicly available data from multiple heterogeneous social media platforms to map accounts from different platforms to node identifiers in a unified manner, thereby obtaining pre-processed multi-source data.

[0057] Step 2: Based on the preprocessed multi-source data, construct a unified intelligence association graph, that is, with accounts as nodes, the interaction behavior between accounts as edges and assign weights, and at the same time generate a high-dimensional node feature vector containing the attributes and semantic features of each account.

[0058] Step 3: Analyze the unified intelligence association graph, extract its node features and topology, and construct a node implicit weight evaluation model based on this. The node implicit weight evaluation model adopts a graph attention network with a multi-head attention mechanism, learns the implicit control relationship between nodes by aggregating neighbor information, and outputs the global importance score of the node.

[0059] Step 4: Using the node implicit weight evaluation model, process all nodes in the unified intelligence association graph and calculate the global importance score of each node.

[0060] Step 5: Based on the obtained global importance score, the unified intelligence association map is divided into several communities; the information diffusion rate, organizational density and cross-domain linkage of each community are calculated and merged into a community intelligence value score, and high-value intelligence clue communities are selected accordingly.

[0061] Step 6: Within the high-value intelligence lead community, integrate the global importance score of nodes with the graph statistics indicators within the community to calculate the comprehensive target value score of each node. Based on this comprehensive target value score, identify and output key intelligence targets.

[0062] In this embodiment of the invention, cross-platform intelligence is integrated through unified mapping and cleaning of multi-source data. Utilizing a graph attention network with a multi-head attention mechanism, the implicit control weights of nodes can be accurately captured, avoiding the omission of key nodes with few followers. Combining community value scores based on information diffusion rate, organizational density, and cross-domain linkage, high-risk clue communities can be quickly screened, improving the timeliness of situational awareness. A comprehensive evaluation system integrating global node importance scores and graph statistical indicators can accurately locate the targets behind the scenes, providing clear support for intelligence tracing. The entire method is adaptable to multi-source heterogeneous social networks, achieving intelligent processing from clue mining to target identification, effectively improving the accuracy and efficiency of network intelligence analysis.

[0063] In a preferred embodiment of the present invention, step 1 above may include:

[0064] Step 1.1 involves collecting publicly available account data and interaction behavior data from multiple social media platforms to obtain raw multi-source data. Specifically, this includes: targeted collection of publicly available, permitted, and accessible account data and interaction behavior data from multiple social media platforms; collected account data includes basic information such as account ID, account registration time, account avatar, and profile description; interaction behavior data covers published content, including descriptive text for text, images, and videos; timestamps, i.e., the time record accurate to the second when the data was generated; forwarding paths, recording the propagation chain of content from the original publishing account to various levels of forwarding accounts; and comment replies, including core fields such as comment content and reply relationships between accounts. A multi-threaded parallel collection mechanism is used to improve data acquisition efficiency. This involves allocating independent collection threads for different social media platforms and different publicly available data interfaces on the same platform, simultaneously initiating data requests and processing data transmission and reception in parallel, reducing single-threaded waiting time. While ensuring the integrity and standardized format of the collected data, this effectively improves the overall acquisition efficiency of multi-source heterogeneous data. Simultaneously, it adapts to the publicly available data interface specifications of different platforms to avoid data loss or format errors during the collection process, ultimately summarizing to form raw multi-source data covering multiple platforms and multiple dimensions.

[0065] Step 1.2 involves cleaning the original multi-source data to filter out invalid and noisy information, resulting in purified data. This includes using a combination of rule-based filtering and statistical identification to clean the original multi-source data, focusing on filtering invalid and noisy information. Invalid information includes garbled text without actual semantic meaning, blank content, and notifications automatically generated by the system. Noisy data mainly refers to repetitive content generated in batches by machine scripts, abnormally high-frequency meaningless data, and abnormal records that do not conform to the platform's data format specifications. By setting content semantic similarity thresholds (e.g., determining content as meaningless based on a cosine similarity below 0.1 after text segmentation), deduplication rules, and deduplication based on a combination of published content, timestamps, and account IDs, as well as data format verification rules (e.g., timestamps must conform to ISO8601 standards, and text length must be within a reasonable range), data that does not meet the requirements is screened and removed one by one. Simultaneously, some data with non-standard but valuable data undergoes standardization processing, such as unifying the timestamp format and supplementing missing key field identifiers, ultimately resulting in purified data with a standardized structure and valid content.

[0066] Step 1.3: Based on the purified data, entity alignment is performed on publicly available accounts across different social media platforms to uniformly map the unique account identifiers of each platform to globally unique node identifiers, thereby generating preprocessed multi-source data. Specifically, this includes: using multi-dimensional feature matching to perform entity alignment on publicly available accounts across different social media platforms based on the purified data, to achieve a unified mapping of account identifiers; specifically, based on the core association features of the accounts, including account nicknames containing historical nickname change records, de-identified bound mobile phone numbers, commonly used login IP address ranges, semantic features of published content, and social relationship chain topology, etc., by calculating the comprehensive matching degree of cross-platform account features, such as the cosine similarity of semantic features and the weighted matching score of association features, it is determined whether accounts on different platforms belong to the same entity; all cross-platform account IDs determined to be the same entity are uniformly mapped to globally unique node identifiers. ,in v This represents the global node identifier corresponding to a single account. V Represents the set of all global node identifiers, and this mapping relationship satisfies the uniqueness requirement (one entity corresponds to only one identifier). v Consistency (all data of the same entity are always associated with the same...) v To ensure subsequent data traceability, a two-way mapping dictionary was established between original account IDs and global node identifiers. This dictionary includes the original account IDs of each platform, the platform identifier, and the globally unique node identifier. v The mapping relationship is established, and the execution time and matching confidence level of each mapping are recorded in the mapping relationship log, i.e., the specific value and update record of the comprehensive matching degree of cross-platform account features, to ensure that the mapping relationship is traceable and verifiable; finally, all associated global node identifiers are identified. v The cross-platform data is integrated to form preprocessed multi-source data with a unified structure and consistent identification, laying the foundation for the subsequent construction of a unified intelligence association map.

[0067] In this embodiment of the invention, by collecting account data and interaction behavior data from multiple social media platforms, the comprehensiveness and diversity of intelligence data sources are ensured, providing a rich data foundation for subsequent mining of cross-platform intelligence associations. The raw data is cleaned and filtered to remove invalid information and noisy data, effectively improving the purity and usability of the data and avoiding interference from redundant data in subsequent graph construction and model training. Based on the cleaned data, cross-platform account entity alignment is performed and mapped to globally unique node identifiers, successfully solving the consistency problem of multi-source heterogeneous data and achieving the normalization and integration of account data from different platforms. The resulting preprocessed multi-source data provides standardized and high-quality basic data support for the construction of a unified intelligence association graph, ensuring the accuracy and reliability of the entire intelligence analysis scheme from the source.

[0068] In a preferred embodiment of the present invention, step 2 above may include:

[0069] Step 2.1: Create corresponding nodes in the graph using the global node identifiers obtained from mapping the preprocessed multi-source data. This specifically includes: using globally unique node identifiers generated after cross-platform entity alignment. Based on this as the core basis, the graph node creation process is initiated; firstly, the preprocessed multi-source data is traversed to extract all unique global node identifiers. v To ensure that each cross-platform entity corresponds to only one graph node and avoid duplicate creation, key metadata is synchronously bound according to the entity attribute association logic when creating a node. This includes the platform to which the original account belongs, cross-platform matching confidence, node creation timestamp, and account registration status. This metadata will serve as the core basis for subsequent node tracing and status updates, and is embedded in the node attributes in the form of standardized key-value pairs. To adapt to the efficient management and querying of large-scale graphs, a storage strategy of platform partitioning + primary key index is adopted: nodes are partitioned and stored according to the code of the platform to which they belong, enabling centralized management of related nodes on the same platform and reducing the overhead of cross-partition queries. At the same time, a global node identifier is used. v As the primary key, create a unique index to ensure subsequent access... v When querying node and associated edge information, it can quickly locate the node; after the node is created, it performs an integrity check: it verifies whether the total number of created nodes is consistent with the total number of global node identifiers in the preprocessed data, checks whether the metadata of each node is complete and without missing data, and ensures that the unique mapping relationship between the node and the cross-platform entity is accurate, providing a reliable node foundation for subsequent directed edge construction and overall graph analysis.

[0070] Step 2.2: Identify the interaction behaviors between the nodes and establish directed edges between the nodes based on the identified interaction behavior types. Specifically, this includes: based on preprocessed multi-source data, identifying the relationships between nodes by parsing the interaction behavior logs between accounts. The interaction behavior types are clearly defined as four categories: forwarding, quoting, commenting, and liking. When parsing forwarding behavior, extract the global identifier of the initiating account, the global identifier of the original publishing account, and the forwarding level from the forwarding path field of the data, including one-level or multi-level forwarding, and establish directed edges only for one-level forwarding. For quoting behavior, calculate the semantic similarity of the text by using the @ symbol and quoting keyword markers in the text content, combined with a pre-trained language model, with a threshold set to 0.7, and establish directed edges after confirming the relevance of viewpoints. For commenting and liking behavior, directly extract the initiator and receiver identifiers from the comment reply link field and like record field in the data to establish directed edges. Each directed edge... All are associated with interaction behavior type tags, including forward , quote , comment , likeThe timestamp of the action is accurate to the second, along with a unique ID for the corresponding content, such as the published content ID or comment ID. Representative node u Initiator and Node v Directed edges between receivers, E It represents the set of all directed edges, ensuring that the association information of each directed edge is complete and traceable.

[0071] Step 2.3: Assign a corresponding weight value to each directed edge based on the intensity of the identified interaction behavior. Specifically, this includes: assigning differentiated basic weights to directed edges according to the type of identified interaction behavior, and dynamically adjusting the weights based on the communication strength to form the final edge weights; the basic weight assignment rule is as follows: forwarding behavior is considered a deep propagation path, and the basic weights are... Reference behavior is considered an associated reference path, with a base weight. Commenting or liking is considered a frequent communication path, and its basic weight is determined accordingly. The dynamic adjustment rule is: if the same pair of nodes u and v If multiple interactions of the same type occur within 3 days, each repeated interaction is weighted by 0.1 on top of the base weight, with the maximum weight set to 1.2 to prevent a single interaction type from having an excessively high weight. If the interaction involves special semantic content, it is identified through a pre-trained language model with a threshold of 0.85, and the weight is increased by an additional 0.2. All edge weights constitute the weight set W, ultimately ensuring that the unified intelligence association graph satisfies the following: The definition, in which W Let be the set of all edge weights. E Represents the set of all directed edges, with the weight of each edge corresponding to its directed edge. e uv Each interaction is associated with the edge and stored in the edge attributes of the graph database. This ensures that the weights assigned to the same type of interaction are consistent and reflect the actual connectivity strength, providing a standardized basis for subsequent topology analysis.

[0072] Step 2.4: After assigning corresponding weight values ​​to each directed edge, for each node, extract its multi-dimensional attribute features and encode its relevant text content using a pre-trained language model to generate a semantic feature vector, specifically including: potential influence... The calculation involves the total number of followers across all platforms. When the number of followers is 0, To avoid invalid values; the activity frequency is the average number of valid posts published by the account in the past 30 days. Valid content must exclude duplicate content and meaningless garbled characters. It is calculated by dividing the total number of valid posts by 30 and keeping two decimal places; the account duration is the difference between the current timestamp and the account registration timestamp, converted to days and accurate to two decimal places. Each of the three attribute features occupies 1 dimension, forming a 3-dimensional attribute feature vector.

[0073] The semantic feature vector generation relies on a pre-trained language model based on a customized improvement of the BERT-base architecture. This model is based on the original BERT-base framework, retaining its core structure of 12 Transformer encoder layers, 12 attention heads, and 768-dimensional hidden layers. At the same time, it is optimized for the core needs of network intelligence analysis: First, the Next Sentence Prediction task head, which is irrelevant to intelligence semantic recognition, is removed from the original model, and a dual output layer for intelligence semantic tendency and organized communication features is added. The semantic tendency layer is used to distinguish between three types of text: normal social interaction, covert communication, and speech. The organized communication feature layer is used to capture traces of organized behavior such as instruction distribution and coordination in the text. Second, more than 500 words specific to the network intelligence field are added to the original vocabulary, and the vocabulary is dynamically updated to ensure adaptation to the ever-evolving intelligence dissemination rhetoric.

[0074] The model training was conducted in two orderly phases, closely aligning with the actual needs of online intelligence mining scenarios: The pre-training phase used a large-scale publicly available online intelligence corpus as training data. This corpus included publicly available contact case texts from authoritative institutions, datasets of disinformation spread that had been addressed on social media platforms, compliantly obtained language samples, and normal social interaction texts, configured in a 1:1:1:3 ratio to ensure the model learned balanced semantic representations. During training, a masked language modeling (MLM) task was employed, masking 15% of key information in the text, such as organization names, contact locations, and instruction keywords. A semantic coherence prediction auxiliary task was also added, allowing the model to learn the logical connections within intelligence texts. The training process utilized the Adam optimizer, setting a reasonable learning rate decay strategy and batch size, dynamically adjusting according to the corpus size. Through multiple iterations, the model solidly mastered the semantic features and expression patterns of intelligence-related texts, acquiring basic intelligence semantic recognition capabilities.

[0075] The fine-tuning phase focuses on precise optimization for the target scenario, introducing a high-quality dataset annotated by professional intelligence analysts. The annotations include four core dimensions: whether it involves high-risk intelligence, the strength of the sentiment (0-5 points), the significance of organized communication characteristics, and the topic category. During training, a mini-batch gradient descent strategy is employed, with a low initial learning rate to avoid overwriting pre-learned general features. A gradient pruning mechanism is introduced to prevent overfitting, and an early stopping strategy is used, stopping training when the model's performance shows no improvement for five consecutive rounds, using the F1 score on the validation set as the metric. After fine-tuning, performance is evaluated using metrics such as accuracy, recall, and F1 score to ensure the model performs well in core scenarios such as identifying seemingly normal text with hidden communication intentions and distinguishing between ordinary active accounts and organized account statements, accurately adapting to the needs of hidden clue mining and key target identification in this invention.

[0076] In specific application scenarios, the model is used to process the top-K most recent text posts from an account, with K set to 20 and adjustable as needed. First, the text undergoes standardized preprocessing: lowercase letters are standardized, special symbols are removed, and the length is truncated or padded to 128 characters. This is then input into a customized pre-trained model, and the output of the last layer's CLS token is used as the basic semantic representation vector. For specific scenarios such as cross-platform collaborative dissemination, domain knowledge graph entity embedding is introduced, including entity features such as event classification. Key entities in the text are identified and supplemented with two-dimensional features, ultimately generating a 770-dimensional semantic feature vector. The advantage of this model lies in its ability, compared to general pre-trained models, to accurately capture hidden semantic relationships and organized communication traces in intelligence texts, effectively distinguishing between seemingly normal daily communication and group communications containing implicit instructions. The generated semantic feature vectors are more targeted, providing high-quality semantic support for subsequent graph attention network evaluation of node importance.

[0077] Step 2.5 combines the multi-dimensional attribute features with the semantic feature vector to form a high-dimensional node feature vector for each node. Specifically, this involves using a combination of vector concatenation and linear transformation to combine the multi-dimensional attribute features with the semantic feature vector to form a high-dimensional node feature vector for each node. h i The specific splicing logic is as follows: That is, first arrange the 3-dimensional attribute feature vectors. h attr This includes potential influence, activity frequency, and account duration; then it is connected to a 770-dimensional semantic feature vector. h sem This yields a 773-dimensional concatenated vector. Since the target dimension is 770, a linear transformation matrix is ​​used to map the concatenated vector to the target dimension. The transformation formula is as follows: ,in W proj It is a learnable linear transformation matrix of 770×773.b proj The bias vector is 770-dimensional. The transformed vector is normalized by using Min-Max normalization to map the vector values ​​to the interval [0, 1], ensuring that the high-dimensional feature vector hi of all nodes is completely uniform in dimension 770 and has a consistent numerical range, which meets the requirements of the subsequent graph attention network model for input features. Unless otherwise specified, the high-dimensional node feature vector mentioned below refers to the 770-dimensional vector.

[0078] Step 2.6 integrates all nodes, weighted directed edges, and high-dimensional node feature vectors to construct a unified intelligence association graph, specifically including: integrating the node set. V Weighted set of directed edges E (Including interaction type, timestamp, content ID, weight) W and high-dimensional node feature vector set H Each node corresponds to a unique h i Construct a unified intelligence association graph A sliding time window mechanism is introduced during the map construction process. The window size is set to 7 days, and the sliding step is 1 day. Each time window generates a corresponding sub-map. ,in V t The set of active nodes within the window. E t The set of interaction edges that occur within the window. W t For the set of edge weights inside the window, H t This method uses a set of feature vectors for nodes within a window to capture the dynamic evolution of node interactions and features in real time across different time windows. The graph data is stored using the Neo4j graph database, partitioned by time window, and global identifiers are established for each node. v Primary key index, used to establish the initiating node for the edge. u Receiver node v An interactive timestamp composite index supports efficient querying and updating of nodes, edges, and feature vectors; a graph integrity verification mechanism is established for periodic verification. Total number of nodes The number of all directed edges, each node h i With 770 dimensions, it ensures no missing or erroneous data; it also supports dynamic graph updates, automatically matching global node identifiers when new data is added, updating edge weights and node feature vectors, and synchronously updating the subgraphs of the corresponding time windows; ultimately forming a unified intelligence association graph with complete structure, standardized data, and support for dynamic updates, providing core data support for subsequent node importance assessment and community discovery.

[0079] In this embodiment of the invention, nodes are created through global node identifier mapping, ensuring the uniqueness and consistency of nodes corresponding to multi-source data and avoiding node redundancy or conflict during heterogeneous data fusion. Directed edges are established based on interaction behavior types and weighted according to interaction intensity, accurately depicting the association direction and interaction tightness between nodes in the intelligence network, giving the graph a basis for quantitative analysis. High-dimensional node features are generated by combining multi-dimensional attribute features and semantic feature vectors encoded by pre-trained language models, which not only retains the basic attribute information of nodes but also incorporates the deep semantic association of text content, improving the richness and recognizability of node features. Finally, a unified intelligence association graph constructed by integrating all elements realizes the structured and integrated expression of multi-source heterogeneous intelligence data, providing comprehensive, accurate, and reliable basic data support for subsequent training of node implicit weight evaluation models, community division, high-value community screening, and key intelligence target identification.

[0080] In a preferred embodiment of the present invention, step 3 above may include:

[0081] Step 3.1, based on the unified intelligence association graph, load all the nodes it contains, the weighted directed edges between nodes, and the high-dimensional node feature vectors of each node. Specifically, this includes: based on the constructed unified intelligence association graph... A dual-partitioning and parallel loading strategy is employed to extract core data from the Neo4j graph database. First, time partitioning is performed using a 7-day sliding window, then platform partitioning is performed based on platform type. Each partition is further divided into sub-shards with 100,000 nodes per unit. Multi-process parallel reading of sub-shard data significantly improves loading efficiency. The loaded content includes globally unique identifiers for all nodes. v And associated metadata, including the platform, registration status, matching confidence, and a set of weighted directed edges between nodes. E Including edge weights w uv Interaction type labels, behavior timestamps, and 770-dimensional high-dimensional feature vectors for each node. h i After loading, perform triple checks: unique node identifiers, edge weights... The feature vector dimension is strictly 770. After verification, the node feature vector is converted into a float32 tensor under the PyTorch framework to adapt to the model calculation accuracy. The edge weights and topological relationships are converted into COO format sparse tensors to reduce memory usage. A node identifier-tensor index mapping table is established to ensure fast indexing and matching when data is retrieved.

[0082] Step 3.2: Extract high-dimensional node feature vectors from the unified intelligence association graph as node features, and extract the connection relationships between nodes and weighted directed edges as the graph's topology. Specifically, this includes: accurately extracting node features and topology from the loaded graph data to ensure a one-to-one correspondence; during node feature extraction, first obtain the 770-dimensional high-dimensional feature vector of each node. h i Then, perform Min-Max normalization on each feature dimension. The normalization formula is as follows:

[0083] ;

[0084] in For nodes i No. d 3D eigenvalues For all nodes d The minimum value of a feature. For the first d The maximum value of each feature dimension is used to ensure that each feature value is mapped to the interval [0, 1], thus eliminating the dimensional differences between different dimensions; during topology extraction, nodes are used as identifiers. v For indexing, a three-dimensional relational dictionary is constructed, consisting of the center node, neighbor nodes, and edge weights. Each entry in the dictionary records the center node. u All first-order neighbor nodes j and corresponding edge weights It automatically removes duplicate edges and retains the one with the highest weight; based on this dictionary, it generates a COO-formatted sparse adjacency matrix. A In the matrix Nodes with no direct connections have an element value of 0. Sparse storage optimizes the memory usage of large-scale graphs, ensuring efficient subsequent model computation.

[0085] Step 3.3: Based on the extracted node features and topology, construct the network structure for the node implicit weight evaluation model. This network structure employs a Graph Attention Network (GAT) model, which incorporates a multi-head attention mechanism. This GAT model learns implicit control relationships between nodes by aggregating information from neighboring nodes. Specifically, it includes: constructing an input layer, a multi-head attention feature extraction layer, and a single-head attention aggregation layer based on the extracted node features and topology. MLP Output layer GAT The model focuses on learning the implicit control relationships between nodes, adapting to the need for identifying hidden core nodes in network intelligence analysis; the input layer receives a 770-dimensional normalized node feature tensor. With COO format sparse adjacency matrix AThe feature vectors are mapped to a 64-dimensional hidden layer through a linear projection layer. This dimension is the optimal value determined after considering both the complexity of intelligence features and the computational efficiency of the model, and it can accurately carry the core information of node attributes and semantics. The first layer sets up 8 attention heads. K =8 serves as the feature extraction layer. Each attention head independently learns the association patterns in different feature subspaces. For example, some attention heads focus on account interaction strength features, while others focus on semantic tendency features, achieving comprehensive capture of multi-dimensional intelligence associations. This is achieved through the formula:

[0086] ;

[0087] compute nodes i with neighboring nodes j In the k The original attention coefficients of each attention head, where the meaning of each character is as follows: It is the first k Nodes in each attention head j For nodes i The original attention coefficient; the larger the value, the more nodes in that feature subspace... j For nodes i The stronger the information penetration capability or the stronger the implicit control; LeakyReLU As the activation function, the negative slope is set to 0.2, which can introduce non-linear characteristics to adapt to complex network intelligence relationships, and retain negative value information to avoid the loss of effective associations due to negative feature values; No. k The learnable weight vector transpose of each attention head, with a dimension of 1×128, acts as an intelligence feature filter, specifically screening out association patterns that are valuable for node importance assessment. W k It is the first k The linear transformation matrix of each attention head, with a dimension of 64×770, is used to map the 770-dimensional high-dimensional node features to the 64-dimensional hidden layer space, reducing computational complexity while preserving core features. h i,norm , h j,norm They are nodes i With nodes j The normalized feature vectors have been mapped to the [0,1] interval through Min-Max normalization to ensure the uniformity of the dimensions of features of different dimensions; This is a vector concatenation operation, which transforms the nodes. i With nodes j The feature vectors are concatenated into a 128-dimensional vector, providing a complete input for calculating the correlation strength between the two.

[0088] Subsequently passed SoftmaxThe function normalizes the original attention coefficients to obtain the attention weights:

[0089] ;

[0090] The meanings of each character are as follows: For the first k The normalized attention weights in each attention head, with values ​​ranging from [0,1], quantify the nodes within the information context. i The received information comes from the node j The proportion directly reflects the node j Its importance as a source of intelligence; exp It is an exponential function used to amplify the high score differences in the original attention coefficient, making the weight of key intelligence nodes more prominent and facilitating the subsequent identification of core associations; N i It is a node i The set of all first-order neighbors of the node, i.e., the set of all first-order neighbors of the node i A collection of account nodes that directly forward, quote, comment, or like; l For set N i For any neighboring node, the denominator is normalized by summing the original attention coefficients of all neighboring nodes after taking the exponent, ensuring that all neighbors are attentive to the node. i The sum of the influence weights is 1.

[0091] The second layer employs a single-head attention mechanism for feature aggregation. First, the 64-dimensional feature vectors output by the eight attention heads are concatenated into a 512-dimensional vector, integrating the correlation information of the multi-dimensional feature subspaces. Then, the aggregation is performed using the following formula:

[0092] ;

[0093] Complete information fusion, among which For the updated node i The hidden layer feature representation, with a dimension of 64, integrates the node's own features and the weighted association information of neighboring nodes, and is the core feature carrier for capturing the implicit control relationship of nodes. σ It is the Sigmoid activation function, which maps the aggregated feature values ​​to the [0,1] interval, enhances the non-linear expressive power of the features, and adapts to the complex implicit association patterns in intelligence networks; For the weighted summation operation, based on attention weights α ij Aggregate neighbor node information to the central node. i Simulates the flow and infiltration of intelligence in the network;

[0094] α ijThe average of the normalized weights of all attention heads, comprehensively reflecting the neighboring nodes. j For nodes i The overall intensity of the impact; It is the output layer linear transformation matrix with a dimension of 64×512. Its function is to converge the concatenated 512-dimensional vector to 64-dimensional vector and extract the core related features. W res It is a residual connection projection matrix with dimensions of 64×770, used to solve the dimensionality mismatch between the 770-dimensional input features and the 64-dimensional aggregated features. It also effectively transmits information from deep networks, avoids gradient vanishing, and ensures that the core features of each node are not diluted. The output layer consists of two fully connected layers. MLP The structure involves mapping the 64-dimensional hidden layer features to 32 dimensions in the first layer, using... ReLU The activation function further enhances the nonlinear feature representation; the second layer maps the 32-dimensional features to a 1-dimensional scalar, and then... Sigmoid The global importance score of the node output by the activation function The higher the score, the more central the node is in the intelligence network, the stronger its implicit control, and the more likely it is to be a key node in promoting intelligence dissemination or behind-the-scenes manipulation.

[0095] Step 3.4 involves training the constructed node implicit weight evaluation model using labeled sample data. The loss function is optimized to enable the model to learn node importance, ultimately resulting in the trained node implicit weight evaluation model. Specifically, this includes: supervised training of the node implicit weight evaluation model using high-quality labeled samples to ensure the model accurately learns the patterns of node importance; the training samples are derived from publicly available high-risk account cases from authoritative institutions, totaling 100,000 samples, with a training set:validation set:test set ratio of 7:2:1. Each sample contains normalized node features. h i,norm The system consists of a local topological adjacency matrix and ground truth labels, where 1 represents a key intelligence target and 0 represents a regular node. Labels are assigned using a three-person independent labeling and cross-validation mechanism; in case of inconsistencies, professional intelligence analysts consult and confirm the labels to ensure accuracy. Training uses binary cross-entropy loss as the optimization objective, with the loss function formula as follows:

[0096] ;

[0097] in n This represents the batch sample size. y i For real labels, The global importance score predicted by the model accurately measures the difference between the predicted value and the true label.

[0098] The Adam optimizer was selected, with an initial learning rate of 0.001, β1=0.9, β2=0.999, and a weight decay coefficient of 1. e- 5. To suppress overfitting, a stepped learning rate decay strategy is adopted, halving the learning rate every 10 epochs; the batch size is set to 32; model parameters are initialized using Xavier uniform initialization (linear layers) and normal distribution initialization; the attention weight vector has a mean of 0 and a variance of 0.01. MLP A dropout layer (dropout rate = 0.3) is introduced to further suppress overfitting; an early stopping strategy is introduced during training to validate the data on the validation set. F 1. The score is a monitoring indicator, expressed as: F 1 = 2 PR / (P+R) , P For accuracy, R For recall rate, save F The model parameter with the highest score, validated over 5 consecutive epochs. F If there is no improvement, training stops; after each epoch, calculate the loss, accuracy, precision, recall, and [other parameters] for both the training and validation sets. F 1 score, visualize the training curve through TensorBoard and monitor the model status in real time; after training, perform performance evaluation on the test set, requiring F1 ≥ 0.85 on the test set, and finally save the complete model structure configuration, optimal parameters and feature dimension information to form a node implicit weight evaluation model that can be directly used for inference.

[0099] In this embodiment of the invention, by standardizing the loading of nodes, weighted directed edges, and high-dimensional feature vectors of a unified intelligence association graph, the integrity and standardization of the model training data are ensured, laying a solid data foundation for subsequent model construction. Accurate extraction of node features and graph topology enables effective separation and correspondence between node attribute information and network connectivity, allowing the model to simultaneously learn node characteristics and global association patterns. The model structure is built based on a graph attention network and incorporates a multi-head attention mechanism, enabling deep aggregation of neighbor node information and efficient mining of implicit control relationships between nodes in the intelligence network, overcoming the limitations of traditional models in capturing hidden associations in complex networks. Supervised training is conducted using labeled sample data combined with loss function optimization, ensuring the model can accurately learn the rules for determining node importance. The resulting trained model possesses reliable node importance assessment capabilities, providing core technical support for outputting global node importance scores in the subsequent inference stage, effectively improving the targeting and accuracy of intelligence network node assessment.

[0100] In a preferred embodiment of the present invention, step 4 above may include:

[0101] Step 4.1: Load the trained node implicit weight evaluation model into the inference environment. Specifically, this includes loading the trained node implicit weight evaluation model into a lightweight inference environment. This environment is designed for production-level deployment and is configured with a GPU acceleration module to improve inference efficiency for large-scale graphs. The loading process is performed in two steps: first, the model structure configuration file in JSON format is read to confirm the number of attention heads (8) and the hidden layer dimension (64 dimensions). MLP The core structural parameters, such as the number of layers (2), remain consistent with those used in the training phase. Then, the optimal parameter file in .pth format is loaded, and the graph attention network is reconstructed in the hierarchical order of input layer, multi-head attention layer, aggregation layer, and output layer. GAT Weights, including attention weight vectors, linear transformation matrices, residual connection parameters, etc.; after loading, a double check is performed: first, parameter dimension check to confirm the attention weight vector. Dimensions are 1×128, and the linear transformation matrix is... W k The first dimension is 64×770 to avoid parameter loading errors; the second is functional integrity verification. The input contains a test sample of 500 nodes, covering different types of nodes such as active or silent, core or edge, to verify that the forward propagation output dimension is 1-dimensional and the numerical range is in the [0,1] interval. At the same time, the inference latency is tested. The inference latency of a single batch of 10,000 nodes in the GPU environment is ≤2 seconds, and the latency in the CPU environment is ≤5 seconds, which meets the real-time and accuracy requirements of intelligence analysis.

[0102] Step 4.2: After loading into the inference environment, the nodes in the unified intelligence association graph, the weighted directed edges between nodes, and the high-dimensional node feature vectors of each node are input into the trained node implicit weight evaluation model. Specifically, this includes: after loading the model into the inference environment, performing multi-dimensional preprocessing on the full dataset of the unified intelligence association graph to ensure that the input data is highly consistent with the format and feature distribution during model training; firstly, extracting the 770-dimensional high-dimensional feature vectors of all nodes in the graph, and calling the feature extremum file retained during the training phase, which contains various dimensions. min h,d , max h,d According to the formula Min-Max normalization is performed, and the feature distributions (mean and variance) of the inference data and training data are verified. If the deviation exceeds 10%, feature calibration is triggered, and the distribution shift is corrected through linear transformation. Next, the normalized feature vectors are converted into float32 tensors, and the weighted directed edges between nodes are converted into COO-format sparse adjacency matrices. Data is sharded according to a high-activity node priority strategy: nodes with interaction behavior in the past 7 days are sharded into batches of 50,000 nodes, and silent nodes are sharded into batches of 100,000 nodes. This controls memory usage (peak memory ≤ 32GB) while ensuring that high-value intelligence nodes are prioritized for inference. After sharding, a global node identifier is established for each batch of data. v A tensor index bidirectional mapping table is used, and the sparsity of the adjacency matrix is ​​verified, which must be ≥99%, consistent with the training phase, to avoid abnormal data interfering with model inference.

[0103] Step 4.3: Through the multi-head attention mechanism in the trained node implicit weight evaluation model, the neighbor node information of each node is aggregated to learn and generate the importance representation of the node in the global network structure. Specifically, after receiving the sharded input data, the model aggregates the neighbor information node by node through a parallelized multi-head attention mechanism to generate the importance representation under the global network structure, adapting to the core association priority analysis logic in the intelligence network; for each central node... i First, filter its neighboring nodes: only retain edge weights. w uj Core neighbors with a value ≥0.5 correspond to high-frequency forwarding, referencing, and other strong interactive behaviors; low-weight invalid associations are removed. Then, eight attention heads are used in parallel to calculate the original attention coefficients of the core neighbors, using the following formula:

[0104] ;

[0105] in Representing the k Nodes in each attention head j For nodes i The original weight of the intelligence dissemination influence; subsequently through Softmax Function normalization yields ; For nodes i The core neighbor set is used to calculate the average of the weights of the eight attention heads to obtain the comprehensive attention weight. For isolated nodes without core neighbors, i.e., silent nodes in the intelligence network, their normalized features are directly retained as the basic representation; the remaining nodes are represented by the aggregation formula. Information integration, among which It is a 64-dimensional importance representation vector that comprehensively reflects the implicit control capabilities and intelligence dissemination value of nodes in the global network.

[0106] Step 4.4 involves performing nonlinear mapping and normalization on the importance representation, outputting a global importance score for each node. Specifically, this includes performing a three-step process—nonlinear mapping, normalization, and score calibration—on the 64-dimensional node importance representation vector to output a global importance score that is interpretable for intelligence analysis. First, the representation vector is input to the two fully connected layers of the output layer. MLP The first layer introduces batch normalization to stabilize the feature distribution, through... ReLU The activation function maps a 64-dimensional vector to 32-dimensional core features; the second layer maps the 32-dimensional features to 1-dimensional raw scores. s i Then through Sigmoid Normalization formula Map the original scores to the interval [0,1], where For nodes i The global importance score represents the probability that a node will undertake core functions such as command distribution and information bridging within the intelligence network. `exp` is the natural exponential function, mathematically expressed as an exponential operation with the natural constant e (approximately 2.71828) as the base. Its function is to transform the linear difference in the original scores `si` into a non-linear difference, amplifying the score gap between core and peripheral nodes and making the score characteristics of high-value intelligence nodes more prominent. s i Raw fractions s i The opposite number is Sigmoid The function's standard input form, by inverting it, ensures that when the original score... s i When the exponent increases, the exponent term exp (- s i ) decrease, eventually making The score approaches 1, conforming to the intelligence analysis logic that the more important the node, the closer its score is to 1; finally, score calibration is performed: based on the score distribution of the training set, Nodes are categorized into five levels based on quantiles: 0-0.2 for edge nodes, 0.2-0.4 for ordinary nodes, 0.4-0.6 for related nodes, 0.6-0.8 for important nodes, and 0.8-1.0 for core nodes. A global node identifier is then generated. v A complete comparison table of global importance scores, score levels, and score quantiles not only quantifies node importance but also provides an intuitive hierarchical basis for subsequent community division and key target identification.

[0107] In this embodiment of the invention, by loading the trained model into an inference environment adapted to actual deployment needs, the stability and efficiency of model operation are ensured, meeting the real-time requirements of intelligence analysis. Standardized preprocessing of input data ensures that the data format is consistent with the training phase, avoiding the interference of distribution offset on the evaluation results and laying the foundation for accurate inference. By aggregating neighbor node information using a multi-head attention mechanism, the implicit connections and control relationships of nodes in the global network structure can be deeply explored, generating importance representations that better reflect the complex characteristics of intelligence networks. Through nonlinear mapping and normalization, standardized global importance scores are output, making the importance of different nodes comparable. Ultimately, this provides accurate and reliable node-level quantitative evaluation criteria for subsequent community division, high-value community screening, and key intelligence target identification, effectively improving the rationality and targeting of intelligence analysis.

[0108] In a preferred embodiment of the present invention, step 5 above may include:

[0109] Step 5.1 involves dividing the unified intelligence association graph into communities, resulting in multiple community divisions. Specifically, this includes: using an improved Louvain algorithm adapted to directed weighted intelligence graphs for community division. The graph is preprocessed: each directed weighted edge is converted to an undirected weighted edge; the average weight of the input and output edges is used to retain interaction strength, while weak interaction edges with weights below 0.3 are filtered out. These edges represent occasional social behaviors with extremely low relevance to intelligence dissemination; removing them reduces noise interference. Initially, each node is treated as an independent community, and each node is then moved to its directly connected neighboring communities. After each move, the change in global modularity is evaluated, retaining only moves that significantly improve modularity, and prioritizing communities connected by high-weight edges, as these communities are more likely to be core clusters for intelligence dissemination. When the local modularity of all nodes... When movement can no longer improve modularity, the community merging phase begins. Each current community is treated as a supernode, and the connections between supernodes are reconstructed. The weight of each edge is the sum of the weights of all edges between the original communities, thus simulating the evolution and merging of clusters in an intelligence network. The iterative process of local movement and community merging is then repeated until the global modularity no longer improves and stabilizes above 0.5. This threshold is an empirical standard for significant community structure in an intelligence network. After the partitioning is completed, the results need to be post-processed to remove micro-communities with fewer than 5 nodes. These communities are mostly isolated and have occasional interactions, which do not have intelligence analysis value. At the same time, metadata is generated for each valid community, including the global identifier set of nodes within the community, the global importance score of core nodes, and the time window of community coverage, providing complete basic information for subsequent indicator calculations.

[0110] Step 5.2: For each community in the multiple community segmentation results, calculate the information diffusion rate based on the time-series characteristics of information dissemination within the community. Specifically, this includes: For each community, calculating the information diffusion rate based on the time-series characteristics of information dissemination within the community. This indicator quantifies the dissemination efficiency of intelligence content within the community and is the core basis for identifying high-risk intelligence communities with rapid dissemination. First, extract the start time (original content publication time) of each propagation path from the timestamps of all directed edges within the community. t start ) and termination time (last-level forwarding time) t end ), calculate the propagation time of a single path Δt=t end - t start Then, analyze all effective transmission paths within the community, and the average transmission duration of paths with a length of ≥2. and the number of nodes involved in the propagation. N c Nodes that only publish but do not forward are excluded; finally, the formula is used. Calculate the information diffusion rate, where each character has the following meaning: R c Representing the community c The information dissemination rate; the larger the value, the faster the intelligence spreads within the community and the wider its coverage. N c The number of nodes participating in the dissemination within the community reflects the scale of the dissemination's coverage. The average duration of all transmission paths, in hours, reflects the time efficiency of transmission; after calculation, it is applied to all communities. R c Min-Max normalization is performed, mapping to the [0,1] interval to eliminate the dimensional differences between different community sizes and propagation scenarios.

[0111] Step 5.3: For the same community, calculate the organization density, which reflects the degree of connection between nodes within the community. Specifically, this includes: For each community, calculating the organization density, which reflects the degree of connection between internal nodes. This indicator is used to identify special organizational communities with strong collaborative characteristics; first, counting the actual number of directed edges within the community. E c Only strong interaction edges with a weight ≥ 0.5 and the total number of nodes in the community are retained. V c Next, calculate the average weight of all strong interaction edges within the community. Finally, using the formula: The calculation of tissue density, where each character has the following meaning: C c Representing the communityc The organizational density ranges from [0,1]. A larger value indicates more frequent strong interactions and stronger collaboration between nodes within the community. E c This represents the number of strongly interacting directed edges within the community, reflecting the strength of the actual connections. V c ( V c- 1) represents the maximum number of directed edges that may exist within the community, reflecting the theoretical upper limit of connectivity; The average weight of strongly interacting edges further amplifies the impact of connection strength; if the community is a set of isolated nodes... E c If the density is 0, then the density is set directly to 0 to ensure the effectiveness of the indicator.

[0112] Step 5.4: For the same community, calculate the cross-domain linkage degree, which represents the diversity of social platforms across which nodes within the community span. Specifically, this includes: For each community, calculating the cross-domain linkage degree, which represents the diversity of nodes across social platforms. This indicator is used to identify high-risk intelligence communities that spread information across platforms. First, extract the platform information, such as some social platforms, from the metadata of all nodes within the community, and then calculate the percentage of nodes on each platform within the community. ,in For the community c China belongs to the platform k The number of nodes, V c For the community c The total number of nodes; then using the entropy formula Calculate cross-domain linkage degree, where the meaning of each character is as follows: D c Representing the community c The cross-domain linkage degree, with a value range of , m This represents the total number of social platform types appearing in the current dataset. The larger the value, the more evenly the cross-platform distribution of nodes within the community and the stronger the cross-domain linkage capability. p k For community nodes on the platform k The proportion reflects the concentration of platform distribution; The logarithmic transformation of the proportion is used to quantify the diversity of the distribution through entropy; after the calculation is completed, D c Normalize to the [0,1] interval (divided by) This ensures that the dimensions are consistent with those of other indicators.

[0113] Step 5.5: For the same community, the calculated information dissemination rate, organizational density, and cross-domain linkage are weighted and fused to obtain the community intelligence value score. Specifically, this includes: weighting and fusing the information dissemination rate, organizational density, and cross-domain linkage to obtain the intelligence value score for each community. This score is the core basis for selecting high-value intelligence communities. First, the three indicators... Min-Max normalization was performed separately to ensure that all values ​​were mapped to the [0,1] interval; then weights were set according to the priority of the intelligence analysis scenario: information dissemination rate weight. Rapidly disseminated intelligence is more threatening, and organizational cohesion is more important. Closely collaborative communities are more likely to be the focus of attention, with higher weighting for cross-domain collaboration. Intelligence disseminated across platforms has a wider reach and meets the following requirements: Finally, through the formula Calculate the community intelligence value score, where S c Representing the community c The intelligence value score is calculated, with a value range of [0,1]. The higher the value, the greater the intelligence threat and analytical value of the community. After the calculation is completed, the scores of all communities and the corresponding set of nodes are saved to provide a quantitative basis for the subsequent selection of high-value communities.

[0114] Step 5.6: Sort all communities according to their community intelligence value scores, and select the preset number of communities with the highest scores as high-value intelligence lead communities.

[0115] In this embodiment of the invention, a community discovery algorithm adapted to the characteristics of intelligence graphs is used to divide communities, realizing the structured decomposition of complex intelligence networks and laying the foundation for accurate analysis. A community evaluation system is constructed from three core dimensions: information dissemination rate, organizational density, and cross-domain linkage, which accurately captures the community's dissemination efficiency, collaboration intensity, and cross-platform influence capabilities, achieving a multi-dimensional and comprehensive characterization of the community's intelligence value. A community intelligence value score is generated through weighted fusion, taking into account the priority of different evaluation dimensions, so that the score is more in line with the needs of intelligence threat assessment. Finally, high-value intelligence clue communities are identified through sorting and screening, effectively eliminating low-value interference communities, accurately focusing on core assessment targets, significantly improving the pertinence and efficiency of intelligence analysis, providing a high-quality community-level foundation for subsequent identification of key intelligence targets, and adapting to the business needs of accurate assessment from groups to individuals in actual intelligence work.

[0116] In a preferred embodiment of the present invention, step 5.6 above may include:

[0117] Step 5.61: Based on the calculated community intelligence value scores of all communities, sort them in descending order to obtain a community ranking list, specifically including: the calculated intelligence value scores of all valid communities. S c Preprocessing and sorting operations are carried out before sorting to ensure that the sorting results accurately match the intelligence screening needs; firstly, valid communities participating in the sorting are screened, and those communities that were not removed in the post-processing of step 5.1 but have high intelligence value scores are removed. S c Low-value communities (<0.3) pose extremely low intelligence threat and do not need to be included in the ranking; meanwhile, for the remaining valid communities... S c A consistency check is performed to confirm that the score calculation logic and weight assignment are consistent, avoiding ranking distortion due to calculation errors. Then, the effective communities are ranked from highest to lowest intelligence value score. If multiple communities have the same score, and the difference is ≤0.001, then organizational density is used as the ranking factor. C c As a secondary ranking criterion, communities with higher organizational density are ranked first, as these communities are more likely to be highly collaborative organizational clusters that require close attention. If organizational density remains the same, then the information diffusion rate is further compared. R c This ensures the uniqueness and rationality of the sorting results. After sorting, a community ranking list is generated, which contains key information such as the unique identifier of each community, intelligence value score, ranking, number of core nodes, and number of cross-domain platforms, providing a clear reference for subsequent screening.

[0118] Step 5.62: Based on the preset screening quantity, select the top-ranked corresponding number of communities from the community ranking list. Specifically, this includes: setting the preset screening quantity according to the actual business needs of intelligence analysis. The screening quantity is determined using a dual strategy of a fixed quantity + a safety net ratio. This ensures the relevance of the screening results while avoiding screening imbalance due to too many or too few communities. The fixed quantity is set in conjunction with daily intelligence processing capabilities; for example, a preset fixed screening quantity of 20 communities is used, while a safety net ratio of 10% of the total number of effective communities is set. The final screening quantity is the smaller of the two values. If the effective communities... If the total number of districts is less than 20, such as only 15, then all valid communities will be directly screened; if 10% of the total number of valid communities is less than 20, such as 180 valid communities, then 10% is 18, then the selection will be based on 18 communities; during the selection process, the corresponding number of communities will be selected from the community ranking list generated in step 5.61 in descending order of ranking, and detailed indicator data for each selected community will be recorded, including intelligence value score, information dissemination rate, organizational tightness, cross-domain linkage, and global importance score of core nodes. If a community's core nodes contain high-risk accounts that have been marked, the selection will be processed accordingly.

[0119] Step 5.63 involves selecting the top-ranked communities as the final high-value intelligence lead communities. This includes: conducting multi-dimensional verification on the selected top-ranked communities to ultimately determine the high-value intelligence lead communities, ensuring the accuracy of the screening results and the intelligence analysis value; firstly, performing a completeness verification on the selected communities, checking whether the metadata of each community is complete, including information such as the set of nodes within the community, edge weight distribution, and time window coverage, to avoid subsequent analysis being hindered due to missing data; secondly, conducting a rationality verification, checking whether the global importance score of the core nodes of the selected communities is ≥0.7, whether the organizational tightness is ≥0.4, and whether the cross-domain linkage degree is ≥0. 5. If a community fails to meet any of the above conditions, it will be deemed an abnormal community and removed from the candidate list. Subsequent communities will be selected from the community ranking list in order of ranking until the preset number of communities is reached. After verification, the remaining candidate communities will be officially confirmed as the final high-value intelligence lead communities, generating a high-value community list. The list will record detailed metadata for each community, including its unique identifier, intelligence value score, core node details (including global identifier and importance score), cross-domain platform distribution, information dissemination characteristics, and organizational density level. It will also label the potential intelligence types of each community, providing intelligence analysts with accurate and comprehensive core evidence for subsequent lead verification and target tracking.

[0120] In a preferred embodiment of the present invention, step 6 above may include:

[0121] Step 6.1: For the final high-value intelligence lead community, obtain the global importance score of each node within the community. Specifically, this includes: extracting the global importance scores of all nodes within the high-value intelligence lead community in batches from the generated node global identifier-global importance score lookup table. I global ( i Extraction is performed using the node's global identifier. v The mapping relationship with the community node set is accurately matched, and the score value range is checked to see if it is within the range of [0,1]. If there are nodes with missing scores, the average score of nodes of the same level in the same community is used to fill in the missing scores, based on the interaction frequency and semantic features of the nodes in the graph, to ensure that each node has a complete global importance score as the basis for evaluation.

[0122] Step 6.2: For each node within the community, obtain the graph statistical indicators of the node within its respective community. Specifically, this includes: for each node within the high-value intelligence clue community, calculating three types of core graph statistical indicators within the community. The first type is the weighted in-degree. InDeg ( iThe first type is the weighted out-degree, which is the sum of the weights of all directed edges pointing to the node within the community, reflecting the node's influence as an intelligence receiver; the second type is the weighted out-degree. OutDeg ( i The first type is called centrality, which is the sum of the weights of directed edges pointing from the node to other nodes within the community, reflecting the node's ability to propagate information as an initiator; the second type is betweenness centrality. Betw ( i The percentage of paths passing through this node in all shortest propagation paths within the community reflects the criticality of the node as a bridge for intelligence flow. Only strong interaction edges with a weight ≥ 0.5 are considered in the calculation to avoid weak interaction behaviors interfering with the effectiveness of the indicator.

[0123] Step 6.3 involves weighted fusion of the global importance score of each node with the corresponding graph statistical indicators to calculate the comprehensive target value score of each node. Specifically, this includes: weighted fusion of the node's global importance score with the community's graph statistical indicators; firstly, performing Min-Max normalization on the weighted in-degree, weighted out-degree, and betweenness centrality of the three types of graph statistical indicators, mapping them to the [0,1] interval to eliminate dimensional differences between indicators; then, setting weights according to the priority of intelligence analysis, with the global importance score weighted... w global =0.5, reflecting the node's core position in the global intelligence network, weighted in-degree weight. w in =0.2, reflecting the strength of a node's attention and citation within the community, weighted out-degree weight. w out =0.2, reflecting the node's ability to actively spread intelligence within the community, and the center centrality weight. w betw =0.1, reflecting the criticality of the node as a bridging node for intelligence flow, and the sum of the weights is 1; finally, through the formula:

[0124] Calculate the overall objective value score, where For nodes i The overall score ranges from [0,1]. , , This is a normalized graph statistical indicator; the higher the value, the greater the likelihood that the node is a key intelligence target.

[0125] Step 6.4: Based on the comprehensive target value score of all nodes, sort the nodes in the final high-value intelligence clue community in descending order to obtain the ranking result, specifically including: based on the comprehensive target value score of each node. All nodes within the high-value intelligence community are sorted in descending order. If multiple nodes have the same score, and the difference is ≤0.001, then the global importance score is used.I global ( i The ranking is based on the following secondary criteria: nodes with higher global importance scores are ranked first. If the global importance scores are still the same, then the betweenness centrality is further compared. Betw norm ( i This ensures the uniqueness and rationality of the sorting results; after sorting, a node sorting list is generated, which includes the node's global identifier, comprehensive target value score, global importance score, various graph statistical indicators, and community information, providing a clear basis for subsequent key target selection.

[0126] Step 6.5: Based on the ranking results and the preset number of key targets, identify and output key intelligence targets from the top-ranked nodes. This includes: setting a preset number of key targets according to the actual needs of intelligence processing, using a fixed number + percentage fallback strategy. The fixed number is set to select 10 key nodes for each community, and the fallback percentage is 5% of the total number of nodes in the community. The smaller of the two values ​​is taken. If the total number of nodes in a community is less than 10, all nodes are selected directly. Select the corresponding number of nodes from the node ranking list in descending order of ranking. At the same time, verify the rationality of the selected nodes, checking whether the global importance score of the node is ≥0.7 and whether the weighted out-degree is ≥0.4. If a node does not meet either condition, a node is selected from the subsequent rankings. After the verification is passed, the selected nodes are officially identified as key intelligence targets, and a key target output list is generated. The list includes the node's global identifier, comprehensive target value score, affiliated community, core interactive behavior characteristics, and potential intelligence roles, such as initiator, bridging agent, and receiver, providing core support for intelligence analysts to conduct accurate tracking and processing.

[0127] In this embodiment of the invention, by accurately acquiring the global importance scores of nodes within a high-value intelligence clue community, a global perspective for evaluation is ensured, avoiding the isolation of nodes within the community. Combining community graph statistical indicators with supplementary local correlation features achieves a dual consideration of global network status and local role within the community, enhancing the comprehensiveness of node evaluation. A comprehensive target value score is generated through weighted fusion, taking into account the priority of different evaluation dimensions, making the score more aligned with intelligence analysis needs. Key intelligence targets are determined through descending sorting and reasonable screening, ensuring the accuracy and efficiency of target identification, effectively avoiding interference from low-value nodes. Ultimately, this provides intelligence analysts with clear and accurate key tracking targets, effectively improving intelligence processing efficiency and adapting to the operational needs of accurately targeting high-risk targets in actual intelligence work.

[0128] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for mining network intelligence clues and identifying key targets, characterized in that, The method includes: Public data from multiple heterogeneous social platforms is collected and cleaned to map accounts from different platforms to node identifiers, resulting in preprocessed multi-source data. Based on the preprocessed multi-source data, a unified intelligence association graph is constructed, which uses accounts as nodes, the interaction behavior between accounts as edges and assigns weights, and generates high-dimensional node feature vectors containing the attributes and semantic features of each account. This paper analyzes a unified intelligence association graph, extracts its node features and topology, and constructs a node implicit weight evaluation model based on this. The node implicit weight evaluation model employs a graph attention network with a multi-head attention mechanism. It learns implicit control relationships between nodes by aggregating neighbor information to output a global importance score for each node. The process includes: loading all nodes, weighted directed edges between nodes, and high-dimensional node feature vectors from the unified intelligence association graph; extracting high-dimensional node feature vectors as node features from the unified intelligence association graph, and extracting the connection relationships between nodes and weighted directed edges as the graph's topology; constructing the network structure of the node implicit weight evaluation model based on the extracted node features and topology; the network structure employs a graph attention network with a multi-head attention mechanism to learn implicit control relationships between nodes by aggregating information from neighboring nodes; training the constructed node implicit weight evaluation model using labeled sample data, and optimizing the loss function to enable the model to learn node importance, ultimately obtaining the trained node implicit weight evaluation model. The implicit weight evaluation model is used to process all nodes in the unified intelligence association graph and calculate the global importance score of each node. Based on the global importance score, the unified intelligence association map is divided into several communities; the information diffusion rate, organizational density and cross-domain linkage of each community are calculated and merged into a community intelligence value score, and high-value intelligence clue communities are selected accordingly. Within a high-value intelligence lead community, the global importance score of nodes is integrated with the graph statistical indicators within the community to calculate the comprehensive target value score of each node. Based on this comprehensive target value score, key intelligence targets are identified and output. This process includes: for the final high-value intelligence lead community, obtaining the global importance score of each node within the community; for each node within the community, obtaining the graph statistical indicators of that node within its respective community; weightedly integrating the global importance score of each node with the graph statistical indicators of the corresponding node to calculate the comprehensive target value score of each node; sorting the nodes within the final high-value intelligence lead community in descending order based on the comprehensive target value scores of all nodes to obtain the ranking result; and determining and outputting key intelligence targets from the top-ranked nodes based on the ranking result and a preset number of key targets.

2. The method for mining network intelligence clues and identifying key targets according to claim 1, characterized in that, Public data from multiple heterogeneous social media platforms was collected and cleaned to map accounts from different platforms to a unified node identifier, resulting in preprocessed multi-source data, including: We collected publicly available account data and interaction behavior data from multiple social media platforms to obtain raw multi-source data; The original multi-source data is cleaned to filter out invalid information and noisy data, resulting in purified data. Based on the purified data, public accounts on different social media platforms are aligned to ensure that the unique account identifiers on each platform are uniformly mapped to globally unique node identifiers, thereby generating preprocessed multi-source data.

3. The method for mining network intelligence clues and identifying key targets according to claim 2, characterized in that, Based on preprocessed multi-source data, a unified intelligence association graph is constructed, which uses accounts as nodes and interactions between accounts as edges with assigned weights. Simultaneously, high-dimensional node feature vectors containing the attributes and semantic features of each account are generated, including: Using the global node identifiers obtained from mapping the preprocessed multi-source data, corresponding nodes are created in the graph; Identify the interaction behaviors between the nodes, and establish directed edges between the nodes based on the identified interaction behaviors; Each directed edge is assigned a corresponding weight value based on the intensity of the identified interaction behavior. Based on assigning corresponding weight values ​​to each directed edge, for each node, its multi-dimensional attribute features are extracted, and a pre-trained language model is used to encode its related text content to generate semantic feature vectors. Multi-dimensional attribute features are combined with semantic feature vectors to form a high-dimensional node feature vector for each node; By integrating all nodes, weighted directed edges, and high-dimensional node feature vectors, a unified intelligence association graph is constructed.

4. The method for mining network intelligence clues and identifying key targets according to claim 3, characterized in that, The implicit weight evaluation model is used to process all nodes in the unified intelligence association graph and calculate the global importance score of each node, including: Load the trained node implicit weight evaluation model into the inference environment; After being loaded into the inference environment, the nodes in the unified intelligence association graph, the weighted directed edges between nodes, and the high-dimensional node feature vectors of each node are input into the trained node implicit weight evaluation model. By using the multi-head attention mechanism in the trained node implicit weight evaluation model, the neighbor node information of each node is aggregated to learn and generate the importance representation of the node in the global network structure. The importance representation is subjected to nonlinear mapping and normalization to output the global importance score of each node.

5. The method for mining network intelligence clues and identifying key targets according to claim 4, characterized in that, Based on the obtained global importance score, the unified intelligence association map is divided into several communities. The information dissemination rate, organizational density, and cross-domain linkage of each community are calculated and merged into a community intelligence value score. Based on this score, high-value intelligence lead communities are selected, including: The unified intelligence association graph was divided into communities, resulting in multiple community division results. For each community in the multiple community division results, calculate the information diffusion rate based on the information propagation time sequence characteristics within the community; For the same community, calculate the organizational density, which reflects the degree of connection between nodes within the community; For the same community, calculate the cross-domain linkage degree, which represents the diversity of social platforms spanned by nodes within the community; For the same community, the calculated information dissemination rate, organizational density, and cross-domain linkage are weighted and fused to obtain the community intelligence value score of the community. All communities are sorted according to their community intelligence value scores, and a predetermined number of communities with the highest scores are selected as high-value intelligence lead communities.

6. The method for mining network intelligence clues and identifying key targets according to claim 5, characterized in that, Based on the community intelligence value scores of all communities, the communities with the highest scores are selected as high-value intelligence lead communities, including: Based on the calculated community intelligence value scores of all communities, they are sorted in descending order to obtain a community ranking list; Based on the preset number of filters, select the corresponding number of communities that rank highest from the community sorting list; The communities with the highest rankings will be selected as the final high-value intelligence lead communities.

Images