Network water army identification method based on user influence

Abstract

The invention discloses a network water army identification method based on user influence. The method comprises the following steps: step 1, collecting full-dimensional data of social media users; 2, text analysis and directed social graph construction: performing word segmentation and stop word removal on the text content of the full-dimensional data, obtaining sentiment polarity through sentiment analysis, and extracting semantic features; constructing a directed social graph based on the attention relationship between the users; 3, defining a comprehensive influence score of the user, wherein the score is formed by weighting and fusing three sub-dimensions of propagation influence, structure influence and time stability; 4, calculating an influence-activeness ratio and an influence mutation index based on the comprehensive influence score and activeness, and performing water army risk classification on the user in combination with the multi-dimensional feature vector; and step 5, result output and feedback optimization: generating a high-risk water army list, and continuously optimizing a judgment threshold and a feature weight through manual auditing and feeding back a closed loop so as to realize self-adaptive evolution of the recognition capability.

Description

Technical Field

[0001] This invention relates to the fields of network security and social computing technology, and in particular to a method for identifying online trolls based on user influence. Background Technology

[0002] With the rapid development of 5G, artificial intelligence, big data, and mobile internet, social media has become a core channel for the public to obtain information, express opinions, and participate in social interactions. However, along with its widespread adoption, organized groups of "internet trolls" use methods such as mass account registration, automated scripts, and AI-generated content to massively disseminate guiding, inflammatory, or false information, seriously disrupting the public opinion environment, misleading users' decisions, and undermining platform fairness.

[0003] Current online troll identification technologies mainly rely on the following three types of methods:

[0004] (1) Behavioral rule method: such as high frequency of posting, fixed time interval operation, high text repetition, etc.;

[0005] (2) Graph structure analysis method: such as dense interrelation, low clustering coefficient, abnormal community structure, etc.;

[0006] (3) Content semantic analysis method: such as abnormal emotional polarity, topic jump, unnatural language pattern, etc.

[0007] However, the above methods have obvious limitations: behavioral features are easily circumvented dynamically, graph structures can be carefully forged, and large-scale model-driven text generation technology has significantly increased the difficulty of semantic detection. More importantly, current technologies mostly design specific rules for single scenarios and lack the ability to universally identify "highly realistic online trolls"—that is, intelligent online trolls that simulate human routines, use natural language, and build fake social relationships.

[0008] In real-world social networks, user influence is a core indicator for measuring their information dissemination capabilities and social credibility. Normal users typically accumulate influence gradually through long-term, high-quality interactions, while paid online trolls, even with high activity levels, struggle to create a sustainable and deep-seated information dissemination effect. Therefore, there is an urgent need for a paid online troll identification mechanism that can dynamically integrate multi-dimensional influence characteristics and adaptively match the optimal identification strategy to address the complex and ever-changing evolution of paid online trolls. Summary of the Invention

[0009] Purpose of the invention: The technical problem to be solved by the present invention is to provide a method for identifying online trolls based on user influence, addressing the shortcomings of existing technologies.

[0010] To address the aforementioned technical problems, this invention discloses a method for identifying online trolls based on user influence.

[0011] The data access device includes a static user attribute interface and a dynamic user behavior interface, used to collect user data across all dimensions in real time: the static attribute interface receives structured data such as user registration information, authentication status, nickname / avatar features, and historical activity cycles; the dynamic behavior interface receives real-time user behavior streams, including operations such as posting, forwarding, commenting, liking, mentioning others, following / unfollowing, as well as interaction data (number of reposts, comments, and likes, dissemination depth, and proportion of reposts at levels two and above) and text semantic features (sentiment polarity, topic tags, and text similarity) for each piece of content. The aforementioned static and dynamic data are collectively referred to as comprehensive user data.

[0012] The data processing device specifically includes filtering invalid accounts such as official bots and system notifications; unifying multi-source timestamps and aggregating user behavior by hourly or daily granularity; performing word segmentation, stop word removal, and sentiment analysis on text content, and calling BERT pre-trained models to extract semantic features; and constructing a directed social graph based on user follow relationships. This provides a foundation for subsequent influence calculation and graph structure analysis.

[0013] The data storage device is used to classify and store comprehensive user data: it utilizes a graph database to store dynamic user behavior data within the past N days (N=30) to support millisecond-level retrieval; and it uses a database to store static user attributes and historical influence trajectories, supporting dynamic field expansion and long-term archiving. The storage uses user IDs as keys to build efficient indexes, providing a parameter source for subsequent calculations to identify online trolls.

[0014] The network water army identification device uses a model that includes three dimensions: dissemination influence (based on interaction volume, forwarding depth, and deep dissemination rate), structural influence (integrating PageRank, betweenness centrality, and the proportion of high-influence fans), and temporal stability (measuring the fluctuation of influence over the past 30 days). The model is weighted to generate a normalized influence score I(u).

[0015] The device outputs the results of the online troll identification process. It extracts two key anomaly indicators: the Influence-Activity Ratio (IAR) to identify "highly active, low-impact" accounts, and the Influence Mutation Index (ISI) to detect sudden, unfounded surges in influence within a short period. This is achieved by constructing a user feature vector for online troll identification. By fusing multi-source heterogeneous information, a structured input is formed. This includes: core influence indicators, basic account attributes, behavioral temporal features, social graph structural features, and content semantic features. These features are then normalized and concatenated into a unified vector. As input to the LightGBM model, the probability of being a paid online troll is calculated. When the threshold is exceeded, a list of high-risk online trolls is generated, including user IDs, risk scores, and key anomaly characteristics. The device integrates a dynamic update mechanism, incrementally refreshing user behavior and influence data daily, periodically triggering model retraining, and combining manual review feedback in a closed loop to continuously optimize the judgment threshold and feature weights, achieving adaptive evolution of identification capabilities and long-term governance.

[0016] The system performs the following steps:

[0017] Step 1: Data Collection and Preprocessing: Collect full-dimensional data of social media users through data access devices based on a crawler architecture, including static attributes and dynamic behaviors, and clean, unify and aggregate this data;

[0018] Step 2: Text Analysis and Directed Social Graph Construction: The collected text content is segmented, stop words are removed, sentiment analysis is performed, and the BERT model is called to extract semantic features; at the same time, a directed social graph G=(V,E) is constructed based on the attention relationships between users to provide a foundation for subsequent user influence calculation;

[0019] Step 3: User Influence Modeling: Define the user's comprehensive influence score I(u), which is a weighted fusion of three sub-dimensions: dissemination influence, structural influence, and time stability;

[0020] Step 4: Anomaly Indicator Extraction and Classification: Based on the comprehensive influence score I(u) and activity level A(u), calculate the influence-activity ratio (IAR) and influence mutation index (ISI), and use the LightGBM model combined with multidimensional feature vectors. Classify users according to their risk level (e.g., those who use online trolls).

[0021] Step 5: Result Output and Feedback Optimization: Generate a list of high-risk online trolls, and continuously optimize the judgment threshold and feature weights through a closed-loop manual review feedback system to achieve adaptive evolution of recognition capabilities.

[0022] Step 1 includes:

[0023] Step 1-1: Static attribute data includes: account registration information, authentication status, nickname / avatar hash value, device fingerprint, and historical activity period;

[0024] Steps 1-2: Receive dynamic behavior data in real time through the user dynamic behavior interface, including operation logs such as posting, forwarding, commenting, liking, @mention, following / unfollowing, etc.

[0025] Steps 1-3: Collect social media platform account metadata (such as user ID prefix, special naming patterns, authentication tags, etc.) based on the crawler architecture, identify official accounts through predefined regular expressions or keyword lists, filter invalid accounts from the raw data, and remove official platform bots, system notification accounts, and test accounts.

[0026] Steps 1-4: Unify the multi-source timestamp format, aggregate user behavior frequency and total interaction volume at the hourly or daily granularity to form structured time-series data.

[0027] Step 2 includes:

[0028] Step 2-1: Perform Chinese word segmentation and stop word removal on the user-posted content, and calculate the text length, punctuation density, and character entropy;

[0029] Step 2-2: Call the pre-trained BERT model to extract the semantic vector of each piece of content, and realize the data extraction of entities, relationships and attributes to form a directed social graph;

[0030] Steps 2-3: Calculate cross-content text similarity based on the SimHash algorithm to identify templated or batch-generated text;

[0031] Steps 2-4: Construct a directed social graph G=(V,E) based on the attention relationships, where nodes v∈V represent users and edges (v→u)∈E represent users v following users u, and store the graph in the graph database.

[0032] Step 3, user influence modeling, includes:

[0033] Step 3-1: Calculate the impact of the communication ,in This represents the average interaction volume over the past 7 days. For maximum forwarding depth, The percentage of reposts at level two or above. and These are adjustable weighting coefficients used to balance the contributions of depth and breadth propagation, with default values. =0.3、 =0.2, the value range is [0,1], and satisfies + =1;

[0034] Step 3-2: Calculate the structural influence This includes: obtaining the PageRank algorithm. Calculate betweenness centrality using the Brandes algorithm. And based on the global influence threshold Calculate high-influence fans (those with influence exceeding the local influence threshold) The percentage of users who are high-influence fans ; where PR(u) represents the influence score of user u in the directed social graph G=(V,E), and its value is derived by weighted passing of the PageRank values ​​of all neighboring nodes (i.e. followers) pointing to u.

[0035] Calculate the percentage of high-influence fans :

[0036]

[0037] :user The collection of fans (i.e., those who follow) (users)

[0038] :user Influence score (such as PageRank)

[0039] High influence threshold, which can be set based on global distribution (such as the top 10%, 90th percentile, fixed value, etc.).

[0040] The three indicators are normalized and then weighted and combined.

[0041] Step 3-3: Calculate time stability:

[0042]

[0043] in This is a daily influence sequence for users over the past 30 days. and These are its standard deviation and mean, respectively. To prevent positive numbers with a denominator of 0; It is a daily granular influence score sequence calculated for user u over the past 30 calendar days;

[0044] It is the standard deviation of the sequence, which measures the degree of volatility;

[0045] It is the mean of the sequence, reflecting the average level;

[0046] It is a very small positive number used to prevent the denominator from being zero and to improve numerical stability.

[0047] when When the value is relatively small: This indicates that the user behavior is relatively stable over time (with small fluctuations compared to the average level).

[0048] when A large number indicates significant fluctuations in user behavior, which may manifest as intermittent activity or irregular usage.

[0049] It reflects the degree of influence fluctuation over the past 30 days. The lower the value, the more unstable it is and the higher the probability of an anomaly.

[0050] Steps 3-4: Impact of the dissemination Perform Min-Max normalization, combined with time stability Based on the user's overall influence score:

[0051]

[0052] in, To determine the weight of dissemination influence, this controls the contribution of content spreadability to the total influence, with a value range of [0,1], and a default value. =0.5; β is the structural influence weight, reflecting the importance of social network status, with a value range of [0,1], and the default β=0.3; γ is the time stability penalty coefficient, used to suppress abnormal behavior with drastic fluctuations, with a value range of [0,1], and the default γ=0.3.

[0053] The activity level A(u) mentioned in step 4 is the total number of user operations per unit time, including posting, forwarding, commenting, and liking.

[0054] Step 4 specifically includes:

[0055] Step 4-1: Calculate the activity A(u);

[0056] Step 4-2: Calculate the influence-activity ratio Through ratio Identify anomalous patterns of high activity with low impact;

[0057] Step 4-3: Calculate the impact mutation index The short-term impact of detection without a basis has surged; The comprehensive influence score I(u) is calculated for user u in the most recent week (e.g., the past 7 days), reflecting its current level of influence; This represents user u's overall influence score over the previous week (i.e., the 7 days prior to the most recent week), reflecting their historical baseline influence; the "+1" in the denominator is to avoid [unclear meaning - possibly a missing word or phrase]. A division-by-zero error occurred, and numerical smoothing was performed for users with low basic knowledge.

[0058] Step 4-4: Constructing multidimensional feature vectors This vector fusion influence-activity ratio Influence mutation index User overall influence score The inputs are account characteristics, behavioral characteristics, directed social graphs, and semantic features of text content. These are then fed into a LightGBM model trained with SMOTE-Tomek balance, and the output is the probability of being a paid online troll. ;

[0059] Account characteristics include: number of days since registration, authentication status (0 / 1), and nickname character entropy;

[0060] Behavioral characteristics include: average daily number of posts and nighttime activity ratio (22:00-6:00).

[0061] Features of directed social graphs include: local clustering coefficient: measures the tightness of the connections between users' neighbors; in directed graphs, the directed clustering coefficient calculation method proposed by Fagiolo is adopted, taking into account the closure of triples formed by inbound edges, outbound edges and bidirectional edges; average neighbor influence: the average comprehensive influence score of all objects followed by the user (outbound neighbors) or followers (inbound neighbors).

[0062] Content features: sentiment polarity variance, text repetition rate (calculated based on SimHash).

[0063] Influence-Activity Ratio ( )

[0064]

[0065] normal users Typically >0.05, A value less than 0.01 is considered high risk.

[0066] Influence Mutation Index (ISI)

[0067]

[0068] If the ISI > 2.0 (i.e., a week-on-week increase of over 200%) and has a low historical influence, it is marked as an abnormal surge.

[0069] Local clustering coefficient Real users are usually in close social circles (such as mutual friends following each other), and have a higher LCC; while the followers / followers of fake accounts are mostly one-way and not interconnected, and their LCC is close to 0.

[0070] Average Neighbor Influence Regular users tend to follow content creators with a certain influence; while paid trolls often follow a large number of low-quality or similar paid troll accounts, resulting in a significantly lower MNI.

[0071] The LightGBM model (comparing paid trolls to normal users) is employed, and the SMOTE-Tomek hybrid sampling strategy is used to alleviate the sample imbalance problem. The model outputs the risk probability Pbot(u)∈[0,1] of paid trolls, and a threshold is set to classify them as paid trolls. Optionally, SHAP values ​​can be introduced for interpretability analysis to identify key decision factors. A list of high-risk paid trolls is generated.

[0072] Step 5 includes:

[0073] Step 5-1: Risk Probability of Online Trolls When the preset threshold is exceeded, the user will be... Add them to the high-risk troll list and record key abnormal characteristics. Among them, an influence-activity ratio (IAR) < 0.01 is too low, indicating high activity but low influence; an influence mutation index (ISI) > 2.0 indicates a sudden increase, representing a short-term surge in influence but previously almost no presence, highly suspicious of coordinated hype or machine-generated traffic; a high-influence fan ratio (HIF ≈ 0) indicates that normal influential users usually attract some high-quality followers. If there are many fans but the HIF is close to 0, it means that their social relationships are very likely composed of low-quality or fake accounts.

[0074] Step 5-2: Generate a feature contribution report for each judgment result through SHAP interpretability analysis to assist in manual review.

[0075] Beneficial Effects: This invention effectively solves a key technical problem that has long plagued existing online troll identification technologies: traditional methods rely on single-dimensional features (such as behavior frequency, text content, or static graph structure), making it difficult to deal with highly realistic online trolls capable of anthropomorphic operations, natural language generation, and the construction of fake social relationships, resulting in low identification accuracy, weak generalization ability, and easy rule circumvention. Addressing this industry pain point, this invention proposes for the first time a unified identification framework centered on "user influence," integrating multi-dimensional heterogeneous features such as dissemination, structure, behavior, and content. Through the essential criterion of "inconsistency between influence and activity," it accurately captures the inherent contradiction of highly realistic online trolls—"high activity but low real influence"—significantly improving the identification accuracy and recall rate for trolls engaging in click fraud, deception, and collaborative manipulation. In engineering implementation, a hybrid architecture of Redis and graph database is adopted, supporting millisecond-level response and high-concurrency processing, and integrating SHAP interpretability analysis and feedback loop mechanisms. This not only outputs auditable key anomalies such as IAR and ISI but also enables continuous iterative optimization of the model. The above-mentioned technical solutions work together to overcome the core bottlenecks that existing technologies cannot simultaneously achieve high precision, strong generalization, fast response, and interpretability. They have outstanding substantive features and significant progress, and meet the inventiveness and practicality requirements for patent authorization. Attached Figure Description

[0076] Figure 1 This is a flowchart of the method. Detailed Implementation

[0077] This invention provides a method for identifying online trolls based on user influence. By integrating static user attributes and dynamic behavioral data, it constructs a multi-dimensional evaluation system centered on influence. The system first cleans and standardizes the raw social data, removing invalid accounts and extracting structured features. Then, it calculates the user's comprehensive influence score I(u) from three dimensions: dissemination influence, structural influence, and temporal stability, deriving key anomaly indicators such as the influence-activity ratio (IAR) and the influence mutation index (ISI). Based on this, it integrates multiple features, including account, behavior, graph structure, and content semantics, to form a unified feature vector. The LightGBM learning model is used to predict the probability of online trolls, and the optimal identification strategy is dynamically selected through information entropy and weight optimization mechanisms. Compared to traditional rule-based or single-model methods, this invention achieves full-scene, adaptive, and high-precision online troll identification, significantly improving the detection capability of highly realistic and covert online trolls, and providing an efficient and scalable technical solution for content security governance on social media platforms.

[0078] This invention aims to address the problems of weak generalization ability, rigid rules, and inability to cope with highly realistic intelligent online trolls in existing technologies for identifying online trolls. Current methods mostly rely on single-dimensional features (such as behavior frequency, text content, or graph structure), which are easily evaded by sophisticated trolls capable of anthropomorphic operations, natural language generation, and the construction of fake social relationships. To address this, this invention proposes a dynamic evaluation system that integrates dissemination influence, structural influence, and temporal stability, using "user influence" as the core criterion. By quantifying a user's real social value and information dissemination ability, it accurately identifies abnormal patterns such as "high activity but low influence" or "sudden increase in influence without a basis." Simultaneously, by combining multi-source heterogeneous features and an adaptive weight optimization mechanism, it achieves unified, efficient, and interpretable identification of various types of trolls, including those involved in boosting traffic, deception, and collaboration. This method not only improves detection accuracy and robustness but also supports millisecond-level response and continuous model evolution, providing social media platforms with a highly adaptable, highly adversarial, and engineering-feasible content security governance solution.

[0079] Step 1: Data Collection and Preprocessing: Collect full-dimensional data of social media users through data access devices based on a crawler architecture, including static attributes and dynamic behaviors, and clean, unify and aggregate this data;

[0080] Step 2: Text Analysis and Directed Social Graph Construction: The collected text content is segmented, stop words are removed, sentiment analysis is performed, and the BERT model is called to extract semantic features; at the same time, a directed social graph G=(V,E) is constructed based on the attention relationships between users to provide a foundation for subsequent user influence calculation;

[0081] Step 3: User Influence Modeling: Define the user's comprehensive influence score I(u), which is a weighted fusion of three sub-dimensions: dissemination influence, structural influence, and time stability;

[0082] Step 4: Anomaly Indicator Extraction and Classification: Based on the comprehensive influence score I(u) and activity level A(u), calculate the influence-activity ratio (IAR) and influence mutation index (ISI), and use the LightGBM model combined with multidimensional feature vectors. Classify users according to their risk level (e.g., those who use online trolls).

[0083] Step 5: Result Output and Feedback Optimization: Generate a list of high-risk online trolls, and continuously optimize the judgment threshold and feature weights through a closed-loop manual review feedback system to achieve adaptive evolution of recognition capabilities.

[0084] Step 1 includes:

[0085] Step 1-1: Static attribute data includes: account registration information, authentication status, nickname / avatar hash value, device fingerprint, and historical activity period;

[0086] Steps 1-2: Receive dynamic behavior data in real time through the user dynamic behavior interface, including operation logs such as posting, forwarding, commenting, liking, @mention, following / unfollowing, etc.

[0087] Steps 1-3: Collect social media platform account metadata (such as user ID prefix, special naming patterns, authentication tags, etc.) based on the crawler architecture, identify official accounts through predefined regular expressions or keyword lists, filter invalid accounts from the raw data, and remove official platform bots, system notification accounts, and test accounts.

[0088] Steps 1-4: Unify the multi-source timestamp format, aggregate user behavior frequency and total interaction volume at the hourly or daily granularity to form structured time-series data.

[0089] Step 2 includes:

[0090] Step 2-1: Perform Chinese word segmentation and stop word removal on the user-posted content, and calculate the text length, punctuation density, and character entropy;

[0091] Step 2-2: Call the pre-trained BERT model to extract the semantic vector of each piece of content, and realize the data extraction of entities, relationships and attributes to form a directed social graph;

[0092] Steps 2-3: Calculate cross-content text similarity based on the SimHash algorithm to identify templated or batch-generated text;

[0093] Steps 2-4: Construct a directed social graph G=(V,E) based on the attention relationships, where nodes v∈V represent users and edges (v→u)∈E represent users v following users u, and store the graph in the graph database.

[0094] Step 3, user influence modeling, includes:

[0095] Step 3-1: Calculate the impact of the communication ,in This represents the average interaction volume over the past 7 days. For maximum forwarding depth, The percentage of reposts at level two or above. and These are adjustable weighting coefficients used to balance the contributions of depth and breadth propagation, with default values. =0.3、 =0.2, the value range is [0,1], and satisfies + =1;

[0096] Step 3-2: Calculate the structural influence This includes: obtaining the PageRank algorithm. Calculate betweenness centrality using the Brandes algorithm. And based on the global influence threshold Calculate high-influence fans (those with influence exceeding the local influence threshold) The percentage of users who are high-influence fans ; where PR(u) represents the influence score of user u in the directed social graph G=(V,E), and its value is derived by weighted passing of the PageRank values ​​of all neighboring nodes (i.e. followers) pointing to u.

[0097] Calculate the percentage of high-influence fans :

[0098]

[0099] :user The collection of fans (i.e., those who follow) (users)

[0100] :user Influence score (such as PageRank)

[0101] High influence threshold, which can be set based on global distribution (such as the top 10%, 90th percentile, fixed value, etc.).

[0102] The three indicators are normalized and then weighted and combined.

[0103] Step 3-3: Calculate time stability:

[0104]

[0105] in This is a daily influence sequence for users over the past 30 days. and These are its standard deviation and mean, respectively. To prevent positive numbers with a denominator of 0; It is a daily granular influence score sequence calculated for user u over the past 30 calendar days;

[0106] It is the standard deviation of the sequence, which measures the degree of volatility;

[0107] It is the mean of the sequence, reflecting the average level;

[0108] It is a very small positive number used to prevent the denominator from being zero and to improve numerical stability.

[0109] when When the value is relatively small: This indicates that the user behavior is relatively stable over time (with small fluctuations compared to the average level).

[0110] when A large number indicates significant fluctuations in user behavior, which may manifest as intermittent activity or irregular usage.

[0111] It reflects the degree of influence fluctuation over the past 30 days. The lower the value, the more unstable it is and the higher the probability of an anomaly.

[0112] Steps 3-4: Impact of the dissemination Perform Min-Max normalization, combined with time stability Based on the user's overall influence score:

[0113]

[0114] in, To determine the weight of dissemination influence, this controls the contribution of content spreadability to the total influence, with a value range of [0,1], and a default value. =0.5; β is the structural influence weight, reflecting the importance of social network status, with a value range of [0,1], and the default β=0.3; γ is the time stability penalty coefficient, used to suppress abnormal behavior with drastic fluctuations, with a value range of [0,1], and the default γ=0.3.

[0115] The activity level A(u) mentioned in step 4 is the total number of user operations per unit time, including posting, forwarding, commenting, and liking.

[0116] Step 4 specifically includes:

[0117] Step 4-1: Calculate the activity A(u);

[0118] Step 4-2: Calculate the influence-activity ratio Through ratio Identify anomalous patterns of high activity with low impact;

[0119] Step 4-3: Calculate the impact mutation index The short-term impact of detection without a basis has surged; The comprehensive influence score I(u) is calculated for user u in the most recent week (e.g., the past 7 days), reflecting its current level of influence; This represents user u's overall influence score over the previous week (i.e., the 7 days prior to the most recent week), reflecting their historical baseline influence; the "+1" in the denominator is to avoid [unclear meaning - possibly a missing word or phrase]. A division-by-zero error occurred, and numerical smoothing was performed for users with low basic knowledge.

[0120] Step 4-4: Constructing multidimensional feature vectors This vector fusion influence-activity ratio Influence mutation index User overall influence score The inputs are account characteristics, behavioral characteristics, directed social graphs, and semantic features of text content. These are then fed into a LightGBM model trained with SMOTE-Tomek balance, and the output is the probability of being a paid online troll. ;

[0121] Account characteristics include: number of days since registration, authentication status (0 / 1), and nickname character entropy;

[0122] Behavioral characteristics include: average daily number of posts and nighttime activity ratio (22:00-6:00).

[0123] Features of directed social graphs include: local clustering coefficient: measures the tightness of the connections between users' neighbors; in directed graphs, the directed clustering coefficient calculation method proposed by Fagiolo is adopted, taking into account the closure of triples formed by inbound edges, outbound edges and bidirectional edges; average neighbor influence: the average comprehensive influence score of all objects followed by the user (outbound neighbors) or followers (inbound neighbors).

[0124] Content features: sentiment polarity variance, text repetition rate (calculated based on SimHash).

[0125] Influence-Activity Ratio ( )

[0126]

[0127] normal users Typically >0.05, A value less than 0.01 is considered high risk.

[0128] Influence Mutation Index (ISI)

[0129]

[0130] If the ISI > 2.0 (i.e., a week-on-week increase of over 200%) and has a low historical influence, it is marked as an abnormal surge.

[0131] Local clustering coefficient Real users are usually in close social circles (such as mutual friends following each other), and have a higher LCC; while the followers / followers of fake accounts are mostly one-way and not interconnected, and their LCC is close to 0.

[0132] Average Neighbor Influence Regular users tend to follow content creators with a certain influence; while paid trolls often follow a large number of low-quality or similar paid troll accounts, resulting in a significantly lower MNI.

[0133] The LightGBM model (comparing paid trolls to normal users) is employed, and the SMOTE-Tomek hybrid sampling strategy is used to alleviate the sample imbalance problem. The model outputs the risk probability Pbot(u)∈[0,1] of paid trolls, and a threshold is set to classify them as paid trolls. Optionally, SHAP values ​​can be introduced for interpretability analysis to identify key decision factors. A list of high-risk paid trolls is generated.

[0134] Step 5 includes:

[0135] Step 5-1: Risk Probability of Online Trolls When the preset threshold is exceeded, the user will be... Add them to the high-risk troll list and record key abnormal characteristics. Among them, an influence-activity ratio (IAR) < 0.01 is too low, indicating high activity but low influence; an influence mutation index (ISI) > 2.0 indicates a sudden increase, representing a short-term surge in influence but previously almost no presence, highly suspicious of coordinated hype or machine-generated traffic; a high-influence fan ratio (HIF ≈ 0) indicates that normal influential users usually attract some high-quality followers. If there are many fans but the HIF is close to 0, it means that their social relationships are very likely composed of low-quality or fake accounts.

[0136] Step 5-2: Generate a feature contribution report for each judgment result through SHAP interpretability analysis to assist in manual review.

[0137] Figure 1 This is the system data flow diagram of the present invention. Detailed Implementation

[0138] (1) Collection and preprocessing of multi-source social data

[0139] After the system starts, it uses the configured web crawler nodes to scrape user data from target social media platforms (such as Weibo, Douyin, Xiaohongshu, Twitter, etc.) across all dimensions.

[0140] Static attribute data includes user ID, registration time, authentication status (whether it is blue V / gold V), nickname / avatar features (such as whether it contains special symbols, default avatar detection), historical activity period, etc.

[0141] Dynamic behavioral data includes hourly / daily logs of posting, forwarding, commenting, liking, tagging others, following / unfollowing, etc., as well as interaction metrics (number of reposts, comments, and likes, dissemination depth, and proportion of reposts above the second level) and text semantic features (sentiment polarity, topic tags, and text similarity) for each piece of content.

[0142] The collected data is stored on the local disk in a structured format (such as JSON) and pushed to the data processing device in real time via a message queue.

[0143] (2) Data cleaning and feature engineering

[0144] The data processing device performs the following operations on the received raw data:

[0145] Invalid account filtering: Removes non-real users such as official bots, system notification accounts, and test accounts;

[0146] Time alignment and aggregation: Unify multi-source timestamps, aggregate user behavior at the daily granularity, and generate daily activity vectors;

[0147] Text semantic processing: User-posted content is segmented and stop words are removed. A pre-trained BERT model is then used to extract multi-dimensional semantic embedding vectors, enabling the extraction of entity, relation, and attribute data to form entity-relationship topology data.

[0148] Social graph construction: A directed graph G=(V,E) is constructed based on the attention relationship, where nodes v∈V represent users and edges (v→u)∈E represent users v following users u. The graph is stored in the Neo4j graph database for subsequent analysis.

[0149] (3) 3D modeling of user influence

[0150] The online troll identification device reads comprehensive user data from the storage device and calculates the comprehensive influence score I(u) of user u, specifically including:

[0151] Spreading influence :

[0152]

[0153] in This represents the average interaction volume over the past 7 days. For maximum forwarding depth, The percentage of forwardings at level 2 and above, with default weight. =0.3, =0.2.

[0154] Structural influence :

[0155] Calculate PageRank value Calculate betweenness centrality And statistics on the percentage of high-influence fans. :

[0156]

[0157] in Take the 90th percentile of the global high-impact score. The three indicators are normalized and then weighted and combined (default weights are 1 / 3 for each).

[0158] Time stability S :

[0159] Based on daily influence over the past 30 days For sequences, calculate the coefficient of variation:

[0160]

[0161] The larger the value, the more unstable the behavior and the higher the risk of abnormal behavior.

[0162] It reflects the degree of influence fluctuation over the past 30 days. The lower the value, the more unstable it is and the higher the probability of an anomaly.

[0163] The final overall influence score is:

[0164]

[0165] Default parameters =0.5, =0.3, =0.3, supports online optimization.

[0166] (4) Anomaly indicator extraction and feature vector construction

[0167] Based on I(u) and user activity A(u) (total number of operations per unit time), two types of key anomaly indicators are extracted:

[0168] Influence-Activity Ratio (IAR):

[0169]

[0170] For normal users, IAR is typically > 0.05; if it is < 0.01, it is marked as high risk.

[0171] Influence Mutation Index (ISI):

[0172]

[0173] If the ISI > 2.0 and has a low historical influence, it is considered an abnormal surge.

[0174] Then, user feature vectors are constructed. It includes five major categories and more than 20 dimensions of features:

[0175] Key metrics: IAR, ISA, , S ;

[0176] Account characteristics: Number of days since registration, authentication status (0 / 1), nickname character entropy;

[0177] Behavioral characteristics: average number of posts per day, proportion of nighttime activity (22:00-6:00);

[0178] Social graph structural features: local clustering coefficient, average neighbor influence, and cross-link ratio;

[0179] Content semantic features: sentiment polarity variance, text repetition rate, and topic jump frequency.

[0180] All features are normalized using Z-score or Min-Max and then concatenated into a unified input vector.

[0181] (5) Risk prediction and results output of naval forces

[0182] eigenvectors Input the LightGBM classification model and output the probability of being a paid troll, Pbot(u)∈[0,1]. If Pbot(u)≥0.7, it is considered a high-risk paid troll.

[0183] This invention effectively addresses the core bottleneck of existing methods for identifying fake accounts that are highly realistic, collaborative, and dynamically evolving through three key original processes: First, it proposes a multi-dimensional dynamic fusion evaluation mechanism centered on user influence, breaking through the limitations of traditional methods that rely on static indicators or single behavioral features. By introducing adaptively adjustable weight parameters (α, β, γ) to dynamically fuse content dissemination power, structural embedding degree, and behavioral activity, it significantly improves the sensitivity to disguised influence. Second, it uses graph neural networks (GNNs) to replace traditional centrality indicators to model the structural influence of users in the social graph, which can capture high-order neighborhood relationships and abnormal collaboration patterns, thereby accurately identifying highly realistic fake accounts that evade detection by constructing "pseudo-normal" topologies. Third, it designs a behavioral authenticity verification module that integrates textual semantics (such as BERT), interaction time series, and multimodal interaction data to cross-verify the consistency and naturalness of user behavior from multiple dimensions, effectively combating complex disguise strategies that are only realistic in a single modality but contradictory in overall behavioral logic. The aforementioned innovations collectively constitute a robust identification framework for highly realistic online trolls, addressing the issues of low identification accuracy and weak generalization ability of existing technologies when facing new types of online trolls that are highly realistic, structurally concealed, and behaviorally variable. Other components, such as web crawlers, Kafka message queues, Neo4j graph database, and LightGBM classifiers, are all mature technologies that can be directly integrated and deployed without requiring creative effort, fully ensuring the feasibility and scalability of this solution in industrial scenarios.

[0184] This invention provides a method for identifying online trolls based on user influence. Many methods and approaches exist for implementing this technical solution; the above description is merely a preferred embodiment. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention. All components not explicitly stated in this embodiment can be implemented using existing technologies.

Claims

1. A method for identifying online trolls based on user influence, characterized in that, The method includes the following steps: Step 1: Data Collection and Preprocessing: Collect full-dimensional data from social media users, including static attribute data and dynamic behavior data, and clean, unify and aggregate this data; Step 2: Text Analysis and Directed Social Graph Construction: The text content of the full-dimensional data is segmented, stop words are removed, sentiment polarity is obtained through sentiment analysis, and semantic features are extracted; at the same time, a directed social graph is constructed based on the attention relationships between users. Step 3: User Influence Modeling: Define a comprehensive user influence score, which is a weighted fusion of three sub-dimensions: dissemination influence, structural influence, and time stability. Step 4: Anomaly indicator extraction and classification: Based on the comprehensive influence score and activity level, calculate the influence-activity ratio and influence mutation index, and combine multi-dimensional feature vectors to classify users as potential trolls; Step 5: Result Output and Feedback Optimization: Generate a list of high-risk online trolls, and continuously optimize the judgment threshold and feature weights through a closed-loop manual review feedback system to achieve adaptive evolution of recognition capabilities.

2. The method for identifying online trolls based on user influence according to claim 1, characterized in that, The static attribute data mentioned in step 1 includes: account registration information, authentication status, nickname / avatar hash value, device fingerprint, and historical activity period.

3. The method for identifying online trolls based on user influence according to claim 1, characterized in that, The dynamic behavior data mentioned in step 1 includes operation logs such as posting, forwarding, commenting, liking, mentioning, and following / unfollowing.

4. The method for identifying online trolls based on user influence according to claim 1, characterized in that, Step 2 specifically includes: Step 1-1: Collect social media platform account metadata based on a web crawler architecture, identify official accounts through predefined regular expressions or keyword lists, filter invalid accounts from the raw data, and remove official platform bots, system notification accounts, and test accounts. Steps 1-2: Unify the multi-source timestamp format, aggregate user behavior frequency and total interaction volume by time granularity to form structured time-series data.

5. The method for identifying online trolls based on user influence according to claim 1, characterized in that, Step 2 includes: Step 2-1: Perform Chinese word segmentation and stop word removal on the user-posted content, and calculate the text length, punctuation density, and character entropy; Step 2-2: Extract the semantic vector of each piece of content to extract data on entities, relationships, and attributes to form a directed social graph; Steps 2-3: Calculate cross-content text similarity to identify templated or batch-generated text; Steps 2-4: Construct a directed social graph G=(V,E) based on the attention relationships, where nodes v∈V represent users and edges (v→u)∈E represent users v following users u.

6. The method for identifying online trolls based on user influence according to claim 3, characterized in that, Step 3, user influence modeling, includes: Step 3-1: Calculate the impact of the communication ,in This represents the average interaction volume over the past n days. For maximum forwarding depth, The percentage of reposts at level two or above. and These are adjustable weighting coefficients used to balance the contributions of depth and breadth propagation, with values ​​ranging from [0,1], and satisfying the following conditions: + =1; Step 3-2: Calculate the structural influence This includes: using the PageRank algorithm to obtain an influence score. Calculate betweenness centrality using the Brandes algorithm. And based on the global influence threshold Calculate the percentage of high-influence fans ; where PR(u) represents the influence score of user u in the directed social graph G=(V,E), and its value is derived by weighted passing of the PageRank values ​​of all neighboring nodes pointing to u; Step 3-3: Calculate time stability: in This is a daily influence sequence for users over the past 30 days. and These are its standard deviation and mean, respectively. To prevent positive numbers with a denominator of 0; It is a daily granular influence score sequence calculated for user u over the past 30 calendar days; Steps 3-4: Impact of the dissemination Perform Min-Max normalization, combined with time stability Based on the user's overall influence score: in, β is the influence weight, which controls the contribution of content dissemination ability to the total influence, with a value range of [0,1]; β is the structural influence weight, which reflects the importance of social network status, with a value range of [0,1]; γ is the time stability penalty coefficient, which is used to suppress abnormal behavior with drastic fluctuations, with a value range of [0,1].

7. The method for identifying online trolls based on user influence according to claim 6, characterized in that, The activity level A(u) mentioned in step 4 is the total number of user operations per unit time, including posting, forwarding, commenting, and liking.

8. The method for identifying online trolls based on user influence according to claim 7, characterized in that, Step 4 specifically includes: Step 4-1: Calculate the activity A(u); Step 4-2: Calculate the influence-activity ratio Through ratio Identify abnormal patterns; Step 4-3: Calculate the impact mutation index ; Step 4-4: Constructing multidimensional feature vectors This vector fusion influence-activity ratio Influence mutation index User overall influence score The inputs are account characteristics, behavioral characteristics, directed social graphs, and semantic features of text content. These are then fed into a LightGBM model trained with SMOTE-Tomek balance, and the output is the probability of being a paid online troll. .

9. The method for identifying online trolls based on user influence according to claim 8, characterized in that, The account features include: number of days since registration, authentication status, and nickname character entropy; The behavioral characteristics include: average daily number of posts and proportion of nighttime activity; The directed social graph features include: local clustering coefficient: measures the tightness of the connections between users' neighbors; in the directed graph, the directed clustering coefficient calculation method is adopted, taking into account the closure of triples formed by incoming edges, outgoing edges and bidirectional edges; and average neighbor influence: the average comprehensive influence score of all the users' followers or fans. Content characteristics: emotional polarity variance, text repetition rate.

10. The method for identifying online trolls based on user influence according to claim 9, characterized in that, Step 5 includes: Step 5-1: Risk Probability of Online Trolls When the preset threshold is exceeded, the user will be... Add them to the list of high-risk online trolls and record any unusual characteristics; Step 5-2: Generate a feature contribution report for each judgment result through SHAP interpretability analysis to assist in manual review.

Images