Text propagation traceability analysis method and device, electronic equipment and storage medium

Abstract

The invention discloses a traceability analysis method and device for text propagation, electronic equipment and a storage medium, and relates to the field of natural language processing and big data analysis, and the method comprises the steps: obtaining and extracting multi-dimensional features, including statistical features, semantic features and spatial-temporal features, of streaming text data; a composite fingerprint is generated on the basis of the multi-dimensional features, similarity matching and clustering are executed on the basis of the composite fingerprint and the dynamic propagation graph, a clustering result is obtained, the dynamic propagation graph is updated, and the dynamic propagation graph comprises user nodes and content cluster nodes. And extracting propagation characteristics of the abnormal content cluster nodes, and determining a propagation mode according to the propagation characteristics. And positioning a propagation source node through reverse traversal based on the propagation mode and the updated dynamic propagation graph so as to generate a traceability result and a response instruction. By applying the technical scheme of the invention, the streaming text clustering efficiency and accuracy can be improved, and rapid identification of a propagation mode and efficient positioning of a propagation source are realized.

Description

Technical Field

[0001] This application relates to the fields of natural language processing and big data analysis technology, and in particular to a method and apparatus for tracing the source of text transmission, an electronic device, and a storage medium. Background Technology

[0002] Natural Language Processing (NLP) and Big Data Analytics technologies aim to process continuously generated streams of text data, accurately identify information dissemination patterns, track dissemination paths, and locate information sources, providing core technical support for risk management and decision-making in business scenarios.

[0003] In related technologies, the propagation analysis of massive streaming text mainly relies on two core technical approaches. One is a content-based hashing clustering method, which uses algorithms such as SimHash and MinHash to extract text content features to generate hash fingerprints, and then uses similarity indicators such as Hamming distance to complete text clustering. The other is a batch processing and static graph analysis method, which requires offline batch processing after the data has accumulated to a certain scale. It first constructs a static propagation graph with users as nodes and forwarding or referencing relationships as edges, and then uses complex graph algorithms or machine learning models to carry out post-analysis such as community discovery and key node identification.

[0004] However, the above methods are insufficient to meet the practical application needs of streaming text propagation analysis and source tracing scenarios. They cannot simultaneously achieve real-time analysis, accurate and robust identification, flexible pattern determination, and interpretability of source tracing results. As a result, when faced with dynamically changing propagation scenarios, it is difficult to respond quickly, accurately identify risks, and provide clear intervention basis, thus affecting the effectiveness of streaming text propagation analysis and source tracing. Summary of the Invention

[0005] In view of this, this application provides a method, apparatus, electronic device, and storage medium for tracing the source of text propagation, in order to solve the problem of poor performance in streaming text propagation analysis and tracing.

[0006] Firstly, this application provides a method for tracing the source of text propagation, including: Retrieve streaming text data; Extract multidimensional features from the streaming text data, including statistical features, semantic features, and spatiotemporal features; Generate a composite fingerprint based on the multidimensional features; Similarity matching and clustering are performed based on the composite fingerprint and dynamic propagation graph to obtain the clustering result; the dynamic propagation graph includes user nodes and content cluster nodes. Update the dynamic propagation graph based on the clustering results; Extract the propagation characteristics of abnormal content cluster nodes in the content cluster nodes, and determine the propagation mode based on the propagation characteristics; Based on the propagation mode and the updated dynamic propagation graph, the source node of the propagation is located by reverse traversal in order to generate the tracing result and response instruction.

[0007] The above method acquires streaming text data and extracts statistical, semantic, and spatiotemporal multidimensional features, breaking through the limitations of traditional methods that rely solely on the single dimension of text content. This effectively resists recognition failures caused by minor text modifications (such as rewriting and synonym replacement), improving the comprehensiveness and robustness of feature representation. Then, a composite fingerprint is generated based on the multidimensional features. Using this fingerprint as the core, similarity matching and clustering are performed in conjunction with a dynamic propagation graph containing user nodes and content cluster nodes. This efficiently completes rapid clustering of hundreds of millions of streaming data points and updates the dynamic propagation graph in real time through the clustering results, ensuring that the propagation status is synchronized with data changes and meeting the real-time processing requirements of low latency and high throughput. Subsequently, the propagation features of abnormal content cluster nodes are extracted to determine the propagation mode. This allows for accurate identification of different propagation types, such as viral and star-shaped propagation, without relying on labeled data, reducing model maintenance costs and the difficulty of adapting to emerging propagation modes. Finally, based on the propagation mode and the updated dynamic propagation graph, the propagation source node is located through reverse traversal and a response command is generated, improving the accuracy, real-time performance, and interpretability of text propagation tracing.

[0008] Optionally, obtaining the streaming text data includes: obtaining a text data tuple carrying propagation context information to obtain the streaming text data; wherein the propagation context information includes text content, timestamp, sender identifier, receiver identifier, and location information.

[0009] Optionally, before extracting the multidimensional features of the streaming text data, the method further includes: cleaning the text content in the streaming text data; and identifying functional blocks of the cleaned streaming text data based on a lightweight conditional random field model, wherein the functional blocks include at least a title, body text, and emphasized text.

[0010] Optionally, the extraction of multidimensional features from the streaming text data includes: determining basic weights based on the type of the functional blocks; calculating authority based on historical dissemination data; calculating block weights according to the authority and the basic weights; performing word segmentation on the cleaned streaming text data; and dynamically discovering new words and updating the temporary dictionary within a sliding window based on mutual information and left and right entropy to obtain candidate words; and extracting statistical features, semantic features, and spatiotemporal features of the candidate words based on the block weights.

[0011] Optionally, generating a composite fingerprint based on the multidimensional features includes: determining a semantic fingerprint based on the semantic features; determining a spatiotemporal fingerprint based on the spatiotemporal features; and generating the composite fingerprint using the semantic fingerprint and the spatiotemporal fingerprint.

[0012] Optionally, determining the semantic fingerprint based on the semantic features includes: filtering core semantic information from the semantic features; concatenating the core semantic information into a string in lexicographical order; performing a hash operation on the string to obtain the operation result; and determining the semantic fingerprint based on the operation result.

[0013] Optionally, determining the spatiotemporal fingerprint based on the spatiotemporal features includes: generating a time period code according to the timestamp of the streaming text data; generating a geohash string based on the location information of the streaming text data; performing a hash operation on the geohash string to obtain a regional code; and determining the spatiotemporal fingerprint based on the time period code and the regional code.

[0014] Optionally, generating the composite fingerprint from the semantic fingerprint and the spatiotemporal fingerprint includes: performing an extension process on the spatiotemporal fingerprint to obtain an extended spatiotemporal fingerprint; and performing bitwise operations on the extended spatiotemporal fingerprint and the semantic fingerprint to obtain the composite fingerprint.

[0015] Optionally, the step of performing similarity matching and clustering based on the composite fingerprint and dynamic propagation graph includes: constructing a hash index based on the semantic fingerprint; determining candidate content clusters through the hash index; calculating the basic similarity between the candidate content clusters and the streaming text data, wherein the basic similarity includes semantic similarity and spatiotemporal similarity, the semantic similarity is calculated based on the Hamming distance of the semantic fingerprint, and the spatiotemporal similarity is calculated based on the consistency of the spatiotemporal fingerprint; calculating a comprehensive similarity based on the basic similarity; in response to the comprehensive similarity of all candidate content clusters being greater than a preset threshold, classifying the streaming text data into the corresponding target candidate content cluster to obtain the clustering result; in response to the comprehensive similarity of all candidate content clusters being less than or equal to the preset threshold, creating a new content cluster to obtain the clustering result.

[0016] Optionally, the edges of the dynamic propagation graph are directed edges from user nodes to content cluster nodes; updating the dynamic propagation graph according to the clustering result includes: in response to the clustering result being the creation of a new content cluster, creating a first content cluster node in the dynamic propagation graph, creating an edge in the dynamic propagation graph from the user node to the first content cluster node, and initializing the popularity of the first content cluster node; the first content cluster node is the content cluster node corresponding to the new content cluster; in response to the clustering result being assigned to the corresponding target candidate content cluster, creating an edge in the dynamic propagation graph from the user node to a second content cluster node, and increasing the popularity of the second content cluster node; the second content cluster node is the content cluster node corresponding to the target candidate content cluster.

[0017] Optionally, extracting the propagation features of abnormal content cluster nodes in the content cluster nodes includes: determining an outbreak coefficient, maximum out-degree, propagation depth, and propagation entropy based on the abnormal content cluster nodes; and defining the outbreak coefficient, maximum out-degree, propagation depth, and propagation entropy as the propagation features; wherein the outbreak coefficient is determined based on the timestamps of the edges associated with the abnormal content cluster nodes; the maximum out-degree is determined based on the out-degree of the user nodes associated with the abnormal content cluster nodes, where the out-degree is the total number of content cluster nodes pointed to by a single user node; the propagation depth is determined based on the number of edges contained in the target propagation path, where the target propagation path is the longest propagation path starting from the abnormal content cluster node; and the propagation entropy is determined based on the proportion of the number of times a single user node propagates in the abnormal content cluster node to the total number of times all user nodes propagate in the abnormal content cluster node.

[0018] Optionally, determining the propagation mode based on the propagation characteristics includes: determining the propagation mode as viral propagation in response to the burst coefficient, the propagation depth, and the maximum out-degree satisfying a first condition; determining the propagation mode as star-shaped propagation in response to the burst coefficient, the propagation entropy, and the maximum out-degree satisfying a second condition; and determining the propagation mode as chain propagation in response to the burst coefficient, the maximum out-degree, and the propagation depth satisfying a third condition.

[0019] Optionally, locating the propagation source node through reverse traversal includes: generating a propagation geographic heatmap and a propagation timeline for the abnormal content cluster nodes, wherein the propagation geographic heatmap is used to characterize the propagation distribution of streaming text data in different regions, and the propagation timeline is used to characterize the propagation sequence of streaming text data in different time periods; in the updated dynamic propagation map, performing a reverse breadth-first search starting from the abnormal content cluster node to determine the propagation source node; the propagation source node is the user node that first established an association with the abnormal content cluster node; generating a response instruction according to the propagation pattern; and integrating the propagation source node, the propagation geographic heatmap, the propagation timeline, and the response instruction to obtain the tracing result.

[0020] Optionally, generating response instructions based on the propagation mode includes: generating a traffic limiting instruction and a high-level alarm instruction in response to the propagation mode being viral propagation; generating a core node influence analysis report generation instruction in response to the propagation mode being star-shaped propagation; and generating a complete propagation path drawing instruction in response to the propagation mode being chain propagation.

[0021] Secondly, this application provides a source tracing and analysis device for text propagation, comprising: The data processing module is configured to acquire streaming text data and extract multidimensional features from the streaming text data, the multidimensional features including statistical features, semantic features and spatiotemporal features; The fingerprint generation module is configured to generate a composite fingerprint based on the multidimensional features; The analysis module is configured to perform similarity matching and clustering based on the composite fingerprint and the dynamic propagation graph to obtain a clustering result; the dynamic propagation graph includes user nodes and content cluster nodes; update the dynamic propagation graph according to the clustering result; extract the propagation features of abnormal content cluster nodes in the content cluster nodes, and determine the propagation mode according to the propagation features; The output module is configured to locate the source node of the propagation by reverse traversal based on the propagation mode and the updated dynamic propagation graph, so as to generate the tracing result and response instruction.

[0022] Thirdly, this application provides an electronic device, comprising: At least one processor; and A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method described in the first aspect embodiment.

[0023] Fourthly, this application provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause the computer to perform the method described in the first aspect embodiment.

[0024] As can be seen from the above technical solutions, the text propagation source tracing analysis method, apparatus, electronic device, and storage medium disclosed in this application relate to the fields of natural language processing and big data analysis. The method acquires and extracts multi-dimensional features of streaming text data, including statistical features, semantic features, and spatiotemporal features. Then, a composite fingerprint is generated based on the multi-dimensional features, and similarity matching and clustering are performed based on the composite fingerprint and the dynamic propagation graph to obtain the clustering result and update the dynamic propagation graph, which includes user nodes and content cluster nodes. Propagation features of abnormal content cluster nodes are extracted, and propagation patterns are determined based on these features. Then, based on the propagation pattern and the updated dynamic propagation graph, the propagation source node is located through reverse traversal to generate source tracing results and response instructions. By applying the technical solutions of this application, the efficiency and accuracy of streaming text clustering can be improved, propagation patterns can be quickly identified, propagation sources can be efficiently located, and real-time, accurate text propagation source tracing and timely response can be achieved.

[0025] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0026] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0027] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0028] Figure 1 The illustration shows a flowchart of a text propagation source tracing analysis method provided in an embodiment of this application; Figure 2 This illustration shows a schematic diagram of the graph structure of the dynamic propagation graph provided in an embodiment of this application; Figure 3 The flowchart illustrating the implementation of the text propagation tracing analysis method provided in this application embodiment is shown. Figure 4 A schematic diagram of the structure of a text propagation tracing analysis device provided in an embodiment of this application is shown; Figure 5 A schematic block diagram of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0029] The embodiments of this application will now be described in more detail with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0030] The embodiments described in this application are not exhaustive, but merely illustrative of some embodiments, and are not intended to limit the scope of protection of this application. Unless otherwise specified, each step in a particular embodiment can be implemented as an independent embodiment, and the steps can be arbitrarily combined. For example, a solution after removing some steps in a particular embodiment can also be implemented as an independent embodiment, and the order of the steps in a particular embodiment can be arbitrarily interchanged. Furthermore, the optional implementation methods in a particular embodiment can be arbitrarily combined; moreover, the embodiments can be arbitrarily combined with each other. For example, some or all steps of different embodiments can be arbitrarily combined, and a particular embodiment can be arbitrarily combined with the optional implementation methods of other embodiments.

[0031] In each embodiment of this application, unless otherwise specified or in case of logical conflict, the terminology and / or descriptions of the embodiments are consistent and can be referenced by each other. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships. The terminology used in the embodiments of this application is for the purpose of describing specific embodiments only and is not intended to limit the scope of this application. In the embodiments of this application, unless otherwise stated, elements expressed in the singular form, such as "a," "an," "the," "the," "the," "the aforementioned," "this," etc., can mean "one and only one," or "one or more," "at least one," etc. For example, when using articles such as "a," "an," "the," etc. in translation, the noun following the article can be understood as either a singular expression or a plural expression. In some embodiments, the terms “in response to…”, “in response to determining…”, “in the case of…”, “when…”, “if…”, “if…”, etc., can be used interchangeably. In some embodiments, the terms “greater than,” “greater than or equal to,” “not less than,” “more than,” “more than or equal to,” “not less than,” “higher than,” “higher than or equal to,” “not lower than,” and “above” can be used interchangeably, as can the terms “less than,” “less than or equal to,” “not greater than,” “less than,” “less than or equal to,” “not more than,” “lower than,” “lower than or equal to,” “not higher than,” and “below”. The prefixes "first" and "second" used in the embodiments of this application are merely for distinguishing different descriptive objects and do not constitute restrictions on the position, order, priority, number, or content of the descriptive objects. For the description of the descriptive objects, please refer to the description in the claims or the context of the embodiments. The use of prefixes should not constitute unnecessary restrictions.

[0032] In the embodiments of this application, "multiple" refers to two or more. In the embodiments of this application, the terms "import", "input", and "read in" can be used interchangeably.

[0033] In some embodiments, devices, etc., can be interpreted as physical or virtual, and their names are not limited to the names recorded in the embodiments. Terms such as “device”, “equipment”, “circuit”, “network element”, “node”, “function”, “unit”, “section”, “system”, “network”, “chip”, “chip system”, “entity”, and “subject” can be used interchangeably.

[0034] In some embodiments, the terms "terminal", "terminal device", "user equipment (UE)", "user terminal", "mobile station (MS)", "mobile terminal (MT)", "subscriber station", "mobile unit", "subscriber unit", "wireless unit", "remote unit", "mobile device", "wireless device", "wireless communication device", "remote device", "mobile subscriber station", "access terminal", "mobile terminal", "wireless terminal", "remote terminal", "handset", "useragent", "mobile client", and "client" can be used interchangeably.

[0035] In related technologies, propagation analysis of massive streaming text mainly relies on two technical approaches. One is content hash-based clustering methods, which rely solely on the text content itself to generate hash fingerprints and then cluster text by calculating the similarity between fingerprints (such as Hamming distance). This approach has a single analytical dimension, only answering the question of "whether the content is similar." The other approach is based on batch processing and static graph analysis, which performs offline batch processing after the data has accumulated to a certain scale. For example, it first constructs a complete, static propagation graph (nodes represent users, edges represent forwarding / referencing relationships), and then uses complex graph algorithms or machine learning models to perform community discovery, key node identification, and other analyses—a post-hoc analysis.

[0036] The aforementioned methods cannot effectively meet the practical needs of real-time, accurate analysis and source tracing of streaming text. For example, hashing methods are only sensitive to content; any slight modification (such as rewriting or replacing synonyms) can lead to drastic changes in fingerprints, causing clustering to fail and making them easy to circumvent maliciously. Batch graph analysis methods have high latency and severely delayed results, making it impossible to monitor and intervene in real time during the propagation process, missing the golden window for controlling the situation. Models relying on supervised learning require a large amount of labeled data, which is costly and difficult to adapt to rapidly evolving emerging propagation patterns, lacking flexibility and generalization ability. They are difficult to accurately reconstruct propagation paths, have poor interpretability of analysis results, cannot clearly locate the source and key nodes, and are difficult to guide actual intervention actions.

[0037] To address the aforementioned issues, this application provides a method for tracing the source of text propagation. By extracting and fusing multi-dimensional features from streaming text data, a lightweight composite fingerprint is generated. Then, incremental graph learning technology is used to dynamically construct and update a dynamic propagation graph of dual-type nodes in real time. Finally, based on an unsupervised quantization rule engine, real-time identification, accurate source tracing, and automated response to propagation patterns are achieved, thus improving the poor performance of streaming text propagation analysis and source tracing.

[0038] like Figure 1 As shown, in some embodiments, the method may include steps S101-S107.

[0039] S101, Obtain streaming text data.

[0040] The process involves acquiring streaming text data, which can consist of text data tuples.

[0041] In one implementation, after obtaining the text data tuples, preprocessing is performed on the text data tuples, such as data cleaning and feature extraction, for subsequent processing.

[0042] S102. Extract multidimensional features from streaming text data.

[0043] The multidimensional features include statistical features, semantic features, and spatiotemporal features. The statistical features use the inverse cluster frequency (ICF) dynamically adjusted by time decay to measure the cross-text distinguishability of words. The semantic features calculate the semantic correlation strength (SCS) of words within the syntactic co-occurrence window to capture their contextual semantic richness. The spatiotemporal features include the time decay factor λ_time, the geographical affinity λ_geo, and the approximation.

[0044] The time decay factor λ_time is calculated based on an exponential decay model, giving more weight to recent texts; the geographic affinity λ_geo is calculated using a Gaussian kernel function to determine the maximum approximation between the text's geographic location and all hotspot areas, thus quantifying the geographic relevance of information and prioritizing the selection of texts closest to the target hotspot area.

[0045] S103. Generate composite fingerprints based on multidimensional features.

[0046] After extracting multidimensional features from the streaming text data, a composite fingerprint is generated based on these features. This composite fingerprint can be encoded by both semantic and spatiotemporal information.

[0047] S104. Perform similarity matching and clustering based on composite fingerprints and dynamic propagation graphs to obtain clustering results.

[0048] The dynamic propagation graph includes user nodes and content cluster nodes, as well as edges between user nodes and content cluster nodes. In one implementation, the edges are pointer edges that point from user nodes to content cluster nodes.

[0049] By performing similarity matching and clustering based on the generated composite fingerprint and dynamic propagation graph, the corresponding clustering results can be obtained, such as classifying the text into the existing content cluster with the highest similarity or creating a new content cluster.

[0050] S105. Update the dynamic propagation graph based on the clustering results.

[0051] After obtaining the clustering results, the graph structure of the dynamic propagation graph is updated based on the clustering results, thereby providing data support for subsequent complex topology queries and in-depth analysis.

[0052] S106. Extract the propagation characteristics of abnormal content cluster nodes in the content cluster nodes, and determine the propagation mode based on the propagation characteristics.

[0053] When a statistically significant anomaly is detected in the propagation rate of a content cluster C_i within a short period (e.g., the number of new propagation events exceeds two standard deviations of the historical average within a 1-minute time window), this content cluster is identified as an anomalous content cluster node. Propagation characteristics (such as temporal burst characteristics and network topology characteristics) of the anomalous content cluster node are extracted, and the corresponding propagation mode (such as viral propagation, star-shaped propagation, or chain propagation) is determined based on these characteristics.

[0054] S107. Based on the propagation mode and the updated dynamic propagation graph, the source node of the propagation is located by reverse traversal in order to generate the source tracing result and response command.

[0055] After determining the propagation pattern and updating the dynamic propagation graph, the propagation source node u_origin is located by traversing backwards based on the propagation pattern and the updated dynamic propagation graph, so as to generate the corresponding tracing results and response instructions.

[0056] In this embodiment, streaming text data consisting of text data tuples is first acquired, and statistical features including inverse cluster frequency (ICF), semantic features including semantic association strength (SCS), and spatiotemporal features including time decay factor or geographic affinity are extracted to break the limitation of a single content dimension. Then, a composite fingerprint integrating semantic and spatiotemporal information is generated based on multi-dimensional features as a unified identifier for the text. Subsequently, relying on a dynamic propagation graph containing user nodes, content cluster nodes, and directed edges, similarity matching and clustering are performed in real time, and the graph structure is incrementally updated according to the clustering results to synchronize the global state. Finally, for content clusters with abnormal propagation rates, the propagation mode is determined by unsupervised extraction of temporal burstiness and network topology features, and the earliest associated source node is located by traversing the dynamic propagation graph in reverse.

[0057] Thus, by fusing multidimensional features with composite fingerprints, the anti-interference capability and accuracy of text clustering can be improved, avoiding clustering failures caused by minor text modifications. Streaming clustering and incremental graph update mechanisms enable real-time processing of each incoming data, completely solving the lag problem of offline batch processing and meeting real-time intervention requirements. Unsupervised propagation feature extraction and pattern determination logic eliminates dependence on labeled data, adapts to rapidly evolving propagation patterns, and reduces operation and maintenance costs. Based on reverse traversal tracing of the dynamic propagation graph, combined with visualized tracing results and differentiated response instructions, the propagation path is clearly restored and the source node is accurately located, improving the interpretability and intervention guidance of the analysis results, thereby supporting the security management of malicious information in scenarios such as 5G messages.

[0058] In some embodiments, for step S101, when acquiring streaming text data, a text data tuple carrying propagation context information is acquired to obtain the streaming text data. The propagation context information includes text content, timestamp, sender identifier, receiver identifier, and location information.

[0059] For example, receive streaming data tuple: data record = (text content, timestamp, sender identifier, receiver identifier, location information).

[0060] In some embodiments, before extracting multidimensional features from streaming text data, the text content in the streaming text data is cleaned to remove useless characters and tags, and the encoding format is standardized. Then, based on a lightweight conditional random field model, functional blocks of the cleaned streaming text data are identified, wherein the functional blocks include at least a title, body text, and emphasized text.

[0061] For example, a lightweight CRF (Conditional Random Field) model is used to identify text blocks (such as headings, body text, and emphasized text).

[0062] In some embodiments, when extracting multidimensional features from streaming text data, basic weights are determined based on the type of functional blocks, such as the block basic weight α_basic(block) based on a predefined type. Authority is then calculated based on historical dissemination data (such as number of followers, post quality, number of citations, etc.). Block weights are calculated according to authority and basic weights, where the block weight can be the basic weight multiplied by (the product of the adjustment coefficient and authority plus one).

[0063] For example, the base weight α_base(block) is based on a predefined type and incorporates a sender authority factor. Authority (sender) is calculated based on historical data such as the number of followers, post quality, and number of citations, with a value range of [0,1]. The optimized block weight is calculated as: α_optimized(block) = α_base(block) × (1 + γ × authority (sender)), where γ is an adjustment coefficient. The optimized text block weight combines the basic importance of the block with the sender's authority, further amplifying the weight of important blocks (such as the title) in texts sent by authoritative users, which helps to extract key information more accurately in the future.

[0064] Then, word segmentation is performed on the cleaned streaming text data, and new words are dynamically discovered and the temporary dictionary is updated within a sliding window based on mutual information and left and right entropy to obtain candidate words. Statistical features, semantic features, and spatiotemporal features of the candidate words are then extracted based on block weights.

[0065] For example, a word segmentation tool is used to perform basic word segmentation to obtain candidate words; then, new words are dynamically discovered within a sliding window based on mutual information and left and right entropy, and a temporary dictionary is updated as all candidate words.

[0066] In some embodiments, the comprehensive score Score_total(w) of candidate words (integrating multidimensional features) is calculated, and the maximum marginal relevance (MMR) algorithm is used for rearrangement to maximize the diversity of the keyword set while ensuring relevance, and the final keyword set K_final is output.

[0067] For step S103, in some embodiments, a semantic fingerprint is determined based on semantic features, a spatiotemporal fingerprint is determined based on spatiotemporal features, and a composite fingerprint is generated by combining the semantic fingerprint and the spatiotemporal fingerprint.

[0068] For semantic fingerprints, in some embodiments, core semantic information is filtered from semantic features, then the core semantic information is concatenated into a string in lexicographical order, and then a hash operation is performed on the string to obtain the result. The semantic fingerprint is determined based on the result.

[0069] In one implementation, core semantic information is selected from the semantic features of multidimensional features, sorted lexicographically, and concatenated into a string. The MurmurHash3_x64_128 (Murmur Hash 3) algorithm is used to perform a hash operation on the string, and the lower 16 bits of the result are taken as the semantic fingerprint.

[0070] For example, sort K_final (core semantic information) lexicographically and concatenate them into a string S. Calculate the MurmurHash3 hash value: hash = MurmurHash3_x64_128(S). Take the lower 16 bits of the hash value as the semantic fingerprint _F_sem.

[0071] For spatiotemporal fingerprinting, in some embodiments, a time period code is generated based on the timestamp of the streaming text data, and a geohash string is generated based on the location information of the streaming text data. A hash operation is then performed on the geohash string to obtain a regional code. The spatiotemporal fingerprint is determined based on the time period code and the regional code.

[0072] In one implementation, a day is divided into four 6-hour time slots based on the timestamps of the streaming text data. The time slot to which the current text belongs is encoded using 4 bits to obtain a time slot code. A Geohash string is generated based on the location information of the streaming text data. The Geohash string is hashed, and the lower 8 bits of the result are used as the location code. The time slot code is used as the higher 4 bits, and the location code as the lower 8 bits, and these are concatenated using bitwise operations to form a 12-bit spatiotemporal fingerprint. For example, a 12-bit spatiotemporal fingerprint (F_st) is generated based on time period and geographical information for content similarity determination.

[0073] The time segment (4 bits) represents the propagation time of the encoded message. The day is divided into four time segments (each 6 hours): 0-6 AM, 6-12 PM, 12-6 PM, and 6-12 AM. The hour number of the message timestamp is taken, the integer is divided by 6 and rounded down to obtain a value between 0 and 3. This value is then encoded using 4 bits (e.g., 0 is encoded as 0000, 1 as 0001, 2 as 0010, and 3 as 0011). Formula: F_hr = (hour(t) / / 6)&0x0F.

[0074] The geographic segment (8 bits) encodes the location where the message was propagated. Based on the Geohash string representing the message's origin, its hash value is calculated (e.g., using MD5 (Message-Digest Algorithm 5) or SHA-1 (Secure Hash Algorithm 1) hash functions), and the last 8 bits (or the lowest 8 bits) of the hash value are used as the encoding. Formula: F_reg = Hash(Geohash(loc)) & 0xFF.

[0075] Fingerprint combination refers to combining a time segment and a geographical segment into a 12-bit fingerprint, with the time segment being the high 4 bits and the geographical segment being the low 8 bits. Formula: F_st = (F_hr << 8) | F_reg.

[0076] In some embodiments, for the generation of composite fingerprints, an extension process is performed on the spatiotemporal fingerprint to obtain an extended spatiotemporal fingerprint. Bitwise operations are then performed on the extended spatiotemporal fingerprint and the semantic fingerprint to obtain the composite fingerprint.

[0077] For example, a 32-bit composite fingerprint (F_compound) is generated for unique identification and similarity matching of text information. Its generation uses bit concatenation operations, with the formula: F_compound = (F_st_padded<<16) |F_sem, implemented as follows: Spatiotemporal fingerprint expansion: The original 12-bit spatiotemporal fingerprint (F_st) is shifted left by 4 bits, and the lower 4 bits are padded with zeros to expand it into a 16-bit F_st_padded. That is: F_st_padded = F_st << 4. Semantic fingerprint concatenation: The expanded 16-bit spatiotemporal fingerprint is used as the high 16 bits, and the original 16-bit semantic fingerprint (F_sem) is used as the low 16 bits. They are then combined into a 32-bit integer by bitwise OR operation.

[0078] By using compact binary encoding, the propagation context of text (when and where) is deeply integrated with the semantics of content (what it is), providing a solid foundation for similarity calculations such as Hamming distance comparison based on bit operations.

[0079] In some embodiments, the identifier of a user node in the dynamic propagation graph is the sender identifier of the streaming text data, with attributes including username, registration time, and location; the unique identifier of a content cluster node is a composite fingerprint, with attributes including creation time, latest update time, and popularity, with popularity measured by the number of user nodes associated with the content cluster node; the edges of the dynamic propagation graph are directed edges from user nodes to content cluster nodes, with edge attributes including the timestamp of the streaming text data.

[0080] For example, a dynamic propagation graph with a dual-type graph structure is constructed as shown in Table 1:

[0081] Table 1 Table 1 includes node types for user nodes and content cluster nodes. Different node types correspond to different identifiers, descriptions, and attributes. like Figure 2 As shown, an edge is formally defined as a triple: E = (source user node u_id, target content cluster node F_compound, timestamp). Each edge represents a specific propagation action; the direction of the u-edge is from the user node to the content cluster node, indicating that "a user participated in the propagation of a content cluster"; the source of the u-edge is always the ID of a user node (u_id), and the target is always the ID of a content cluster node (F_compound); the most important attribute (weight) of the u-edge is the timestamp, which records the exact time when the propagation action occurred.

[0082] For step S104, in some embodiments, a hash index (Locality-Sensitive Hashing (LSH) index) is constructed based on the semantic fingerprint, and candidate content clusters are determined through the hash index. That is, the semantic fingerprint F_sem is used to perform a Locality-Sensitive Hashing (LSH) index to quickly retrieve candidate similar content clusters. The basic similarity between the candidate content clusters and the streaming text data is calculated. The basic similarity includes semantic similarity and spatiotemporal similarity. Semantic similarity is calculated based on the Hamming distance of the semantic fingerprint, and spatiotemporal similarity is calculated based on the consistency of the spatiotemporal fingerprint. Finally, a comprehensive similarity is calculated based on the basic similarity.

[0083] For example, for each candidate cluster, calculate the overall similarity: Sim_total=α*Sim_sem+β*Sim_st The above formula defines a new metric for text similarity, where Sim_sem is based on semantic fingerprint similarity (obtained by calculating Hamming distance, etc.), and Sim_st is based on behavioral spatiotemporal fingerprint similarity (e.g., high similarity is achieved when two locations have the same encoding). By adjusting the weights α and β, the matching strategy can be flexibly controlled (satisfying α+β=1): emphasizing semantic similarity (larger α) or propagation context similarity (larger β). This fusion matching model is more robust and accurate than matching that relies solely on content.

[0084] After calculating the overall similarity, if the overall similarity of all candidate content clusters is greater than a preset threshold, the streaming text data is assigned to the corresponding target candidate content cluster to obtain the clustering result; if the overall similarity of all candidate content clusters is less than or equal to the preset threshold, a new content cluster is created to obtain the clustering result.

[0085] In other words, if max(Sim_total) > θ (preset threshold), the new text is assigned to the content cluster with the highest similarity (target candidate content cluster), and the propagation record of that cluster is updated; otherwise, a new cluster (new content cluster) is created.

[0086] For step S105, in some embodiments, in response to the clustering result being the creation of a new content cluster, a first content cluster node is created in the dynamic propagation graph, and an edge pointing from the user node to the first content cluster node is created in the dynamic propagation graph, and the popularity of the first content cluster node is initialized; in response to the clustering result being assigned to the corresponding target candidate content cluster, an edge pointing from the user node to the second content cluster node is created in the dynamic propagation graph, and the popularity of the second content cluster node is increased. Here, the first content cluster node is the content cluster node corresponding to the new content cluster, and the second content cluster node is the content cluster node corresponding to the target candidate content cluster.

[0087] For example, an incremental graph update engine is used to update the dynamic propagation graph. This engine is a downstream module of the information processing pipeline, and its input directly depends on the decision results of upstream similarity matching and clustering. The core task is to transform the clustering decision into a change ΔG in the graph structure and apply an incremental algorithm to update the global state.

[0088] The graph change ΔG = (ΔV, ΔE) is generated by the engine parsing each input and generating corresponding graph operation instructions. If the decision is to add a new cluster, a new content cluster node is added to ΔV; an edge (u_s, F_compound_new, t) is added to ΔE, indicating that user u_s created a new cluster (the first content cluster node). If the decision is to update a cluster, ΔV is empty (no new node), and an edge (u_s, F_compound_exist, t) is added to ΔE, indicating that user u_s propagated an existing cluster (the second content cluster node).

[0089] In some embodiments, the global state of the dynamic propagation graph is also updated, including the latest popularity and latest update time of each content cluster node.

[0090] For example, the engine maintains a global state I(G_{t-1}) and stores a dictionary Cluster_Degree (with the key F_compound and the value the number of connected users) representing the current popularity of each content cluster. For the current input ΔG, the engine performs an incremental update operation: iterates through all newly added edges ΔE contained in the change ΔG of the current input. For each newly added edge (in the form of (user ID, content cluster ID, timestamp)), the following operations are performed: Query and judgment: Check whether the content cluster identifier pointed to by the edge already exists in the currently maintained global content cluster heat status dictionary (Cluster_Degree). If it exists, increment the heat value (i.e., the number of connected users) corresponding to the content cluster identifier by 1. If it does not exist, the edge must come from a newly created content cluster node (belonging to ΔV). Initialize a new entry for the content cluster identifier in the dictionary and set its heat value to 1.

[0091] The aforementioned traversal process itself involves modifying and updating the global state I(G_{t-1}) (i.e., the Cluster_Degree dictionary) in-situ. Therefore, after all newly added edges have been processed, the state stored in the current Cluster_Degree dictionary is the new global index I(G_t) after incorporating the latest changes. The entire merging operation is implicitly completed during the data update process, requiring no additional explicit computation steps.

[0092] In some embodiments, the change ΔG generated by this batch processing is applied to the global graph structure (dynamic propagation graph) to complete the data layer update, ensuring that the graph state and the indicator state evolve synchronously. This includes updating the node set: V_t = V_{t-1}∪ΔV, and updating the edge set: E_t = E_{t-1}∪ΔE. ΔV and ΔE are written to the graph database or the graph data structure in memory is updated. The updated graph structure G_t provides data support for subsequent complex topology queries and in-depth analysis.

[0093] In some embodiments, the method further includes unsupervised propagation pattern quantitative identification and response, which does not require pre-labeled training data. By real-time quantitative analysis of the propagation timing and topological characteristics of content clusters, it automatically identifies their propagation patterns and triggers precise source tracing and differentiated response strategies.

[0094] For the propagation feature extraction in step S106, in some embodiments, the burst coefficient, maximum out-degree, propagation depth and propagation entropy are determined based on the abnormal content cluster nodes, and then the burst coefficient, maximum out-degree, propagation depth and propagation entropy are determined as propagation features.

[0095] The burst coefficient is determined based on the timestamps of the edges associated with the abnormal content cluster nodes. For example, from the updated dynamic propagation graph, the timestamps of all edges associated with the target content cluster nodes are obtained, a timestamp sequence is formed and sorted in chronological order, and the difference between adjacent timestamps is calculated to obtain the propagation time interval sequence. The 20th percentile and median of the propagation time interval sequence are calculated, and the ratio of the 20th percentile to the median is used as the burst coefficient.

[0096] The maximum out-degree is determined based on the out-degree of the user nodes associated with the abnormal content cluster node. The out-degree is the total number of content cluster nodes pointed to by a single user node. For example, to calculate the out-degree of all user nodes associated with the abnormal content cluster node, the out-degree is the total number of content cluster nodes pointed to by a single user node, and the maximum value among all out-degrees is taken as the maximum out-degree.

[0097] The propagation depth is determined based on the number of edges contained in the target propagation path. The target propagation path is the longest propagation path starting from the abnormal content cluster node. For example, starting from the abnormal content cluster node, all propagation paths are traversed, and the number of edges contained in the longest path is taken as the propagation depth.

[0098] Propagation entropy is determined based on the proportion of the number of times a single user node propagates within the abnormal content cluster nodes to the total number of times all user nodes propagate within the abnormal content cluster nodes. For example, the propagation entropy is calculated based on the proportion of each user node's propagation count within the abnormal content cluster to the total number of times all user nodes propagate within the abnormal content cluster. For example, when the monitoring system detects a statistically significant anomaly in the propagation rate of a content cluster C_i (an anomalous content cluster) within a short period (e.g., the number of new propagation events exceeds two standard deviations of the historical average within a one-minute time window), it automatically triggers the feature extraction process. The data foundation directly comes from the dynamic propagation graph G_t and the cluster's propagation records. The feature extraction process is as follows: The burst-like characteristics of the time series are analyzed by extracting the timestamp sequence T=[t1, t2, ..., t] from the propagation records of the anomalous content cluster C_i (i.e., the set of timestamp attributes of all edges connected to the cluster node F_compound). n The process includes sorting the timestamp sequence T and calculating the difference between adjacent times to obtain the propagation time interval sequence Δt_seq, calculating the 20th quantile P20(Δt_seq) and median P50(Δt_seq) of the sequence, and finally calculating the burst coefficient B=P20(Δt_seq) / P50(Δt_seq).

[0099] The outbreak coefficient B quantifies the suddenness of transmission by measuring the ratio of the tail to the middle of the time interval distribution. An extremely low B value (e.g., B < 0.3) indicates that a large number of transmission events occur intensively within a very short period of time, which is a typical time marker of viral spread.

[0100] Network topology features are derived from the global graph structure G_t maintained by the incremental graph update engine. A propagation subgraph centered on the content cluster node C_i (containing all participating user nodes and associated edges) is extracted, and the following features are calculated: Maximum out-degree (d_max) = max(out_degree(u) for u in U_c), calculating the maximum out-degree of all participating user nodes in the anomalous content cluster to identify super-propagators; Propagation depth: depth = longest_path_length(u_origin), after locating the source node u_origin, the longest path from the source node to the farthest node is calculated by traversing the propagation subgraph, reflecting the level of information penetration; Propagation entropy (H_prop) is calculated based on the proportion of propagation times p_i of users in the anomalous content cluster, with the entropy value H_prop = -Σ(p_i*ln(p_i)). This measures the concentration of propagation behavior: lower entropy indicates more concentrated propagation; higher entropy indicates more dispersed propagation.

[0101] Regarding the determination of the propagation mode in step S106, in some embodiments, in response to the burst coefficient, propagation depth, and maximum out-degree satisfying a first condition, the propagation mode is determined to be viral propagation; in response to the burst coefficient, propagation entropy, and maximum out-degree satisfying a second condition, the propagation mode is determined to be star-shaped propagation; and in response to the burst coefficient, maximum out-degree, and propagation depth satisfying a third condition, the propagation mode is determined to be chain propagation.

[0102] In one implementation, the first condition is that the burst coefficient is less than 0.3, the propagation depth is greater than or equal to 4, and the maximum out-degree is greater than or equal to 10; the second condition is that the burst coefficient is greater than or equal to 0.3, the propagation entropy is less than 1.0, and the maximum out-degree is greater than 50; the third condition is that the burst coefficient is greater than or equal to 0.3, the maximum out-degree is less than or equal to 2, and the propagation depth is greater than 4.

[0103] For example, the system performs logical operations on quantified features based on a pre-defined set of rules, determines the propagation pattern of content clusters in real time, and maps it to predefined business response actions, as shown in Table 2:

[0104] Table 2 Table 2 includes viral, star-shaped, and chain-like propagation patterns. Different propagation patterns correspond to different quantitative propagation conditions and predefined business response actions.

[0105] For step S107, in some embodiments, a propagation geographic heatmap and propagation timeline of the abnormal content cluster nodes are generated. In the updated dynamic propagation map, a reverse breadth-first search is performed starting from the abnormal content cluster nodes to determine the propagation source node. The propagation geographic heatmap is used to characterize the distribution of streaming text data across different regions, and the propagation timeline is used to characterize the propagation sequence of streaming text data at different time periods; the propagation source node is the user node that first established an association with the abnormal content cluster nodes. Then, a response command is generated based on the propagation pattern, and the propagation source node, propagation geographic heatmap, propagation timeline, and response command are integrated to obtain the source tracing result.

[0106] In other words, based on the spatiotemporal characteristics of streaming text data, a geographic heatmap and a timeline of the spread of the target content cluster are generated. The geographic heatmap is used to visualize the spread distribution of text in different regions, and the timeline of the spread is used to visualize the spread sequence of text in different time periods. In the updated dynamic spread map, a reverse breadth-first search is performed starting from the abnormal content cluster node to select the user node that was first associated with the abnormal content cluster node, and this user node is used as the source node of the spread.

[0107] In some embodiments, in response to a viral propagation pattern, a flow limiting command and a high-level alarm command are generated; in response to a star-shaped propagation pattern, a core node influence analysis report generation command is generated; and in response to a chain-like propagation pattern, a complete propagation path drawing command is generated.

[0108] In other words, response instructions are generated based on the propagation pattern: if it is viral propagation, traffic restriction instructions and high-level alert instructions are generated; if it is star-shaped propagation, instructions to generate a core node influence analysis report are generated; if it is chain propagation, instructions to draw a complete propagation path are generated; the propagation source node, propagation geographic heat map, propagation timeline and response instructions are integrated to form the source tracing result.

[0109] For example, based on the regional (F_reg) and time period (F_hr) encoding in the behavioral spatiotemporal fingerprint F_st, a propagation geographic heatmap and timeline are automatically generated to achieve multi-dimensional visual source tracing. The source node u_origin is accurately located by performing a reverse breadth-first search (BFS) from cluster node C_i on the dynamic propagation graph G_t. The system pushes pattern determination results, source tracing reports, and feature data to the decision-making system in real time through a standardized API interface, driving subsequent automated processing or manual analysis. The response strategy is flexibly configurable, supporting fully automated execution or decision support.

[0110] Based on the above embodiments, such as Figure 3As shown in the embodiments of this application, the text propagation source tracing analysis method first performs text preprocessing and multi-dimensional feature extraction, then performs weight calculation and lightweight composite fingerprint generation, then promotes the dynamic construction and maintenance of the streaming propagation graph, and then enters the incremental similarity matching and clustering stage; in this stage, if the matching is successful, the existing content cluster is updated, and if the matching fails, a new content cluster is created. After completing the corresponding operations, the graph structure and global indicators are incrementally updated, and finally the unsupervised propagation mode quantitative identification and source tracing are realized.

[0111] Based on the aforementioned method for tracing the source of text propagation, this application also provides a device for tracing the source of text propagation, such as... Figure 4 As shown, in some embodiments, the device 400 includes a data processing mode 401, a fingerprint generation module 402, an analysis module 403, and an output module 404, wherein: Data processing module 401 is configured to acquire streaming text data; extract multidimensional features of the streaming text data, the multidimensional features including statistical features, semantic features and spatiotemporal features; The fingerprint generation module 402 is configured to generate a composite fingerprint based on the multidimensional features; Analysis module 403 is configured to perform similarity matching and clustering based on the composite fingerprint and dynamic propagation graph to obtain clustering results; the dynamic propagation graph includes user nodes and content cluster nodes; update the dynamic propagation graph according to the clustering results; extract the propagation features of abnormal content cluster nodes in the content cluster nodes, and determine the propagation mode according to the propagation features; Output module 404 is configured to locate the source node of the propagation by reverse traversal based on the propagation mode and the updated dynamic propagation graph, so as to generate tracing results and response instructions.

[0112] In some embodiments, the data processing module 401 is configured to acquire a text data tuple carrying propagation context information to obtain the streaming text data; wherein the propagation context information includes text content, timestamp, sender identifier, receiver identifier, and location information.

[0113] In some embodiments, the data processing module 401 is configured to clean the text content in the streaming text data; and based on a lightweight conditional random field model, identify functional blocks of the cleaned streaming text data, wherein the functional blocks include at least a title, body text, and emphasized text.

[0114] In some embodiments, the data processing module 401 is configured to determine basic weights based on the type of the functional blocks; calculate authority based on historical propagation data; calculate block weights according to the authority and the basic weights; perform word segmentation on the cleaned streaming text data; and dynamically discover new words and update the temporary dictionary within a sliding window based on mutual information and left and right entropy to obtain candidate words; and extract statistical features, semantic features, and spatiotemporal features of the candidate words based on the block weights.

[0115] In some embodiments, the fingerprint generation module 402 is configured to determine a semantic fingerprint based on the semantic features; determine a spatiotemporal fingerprint based on the spatiotemporal features; and generate the composite fingerprint using the semantic fingerprint and the spatiotemporal fingerprint.

[0116] In some embodiments, the fingerprint generation module 402 is configured to: filter core semantic information from the semantic features; concatenate the core semantic information into a string in lexicographical order; perform a hash operation on the string to obtain the operation result; and determine the semantic fingerprint based on the operation result.

[0117] In some embodiments, the fingerprint generation module 402 is configured to generate a time period code according to the timestamp of the streaming text data; generate a geohash string based on the location information of the streaming text data; perform a hash operation on the geohash string to obtain a regional code; and determine the spatiotemporal fingerprint according to the time period code and the regional code.

[0118] In some embodiments, the fingerprint generation module 402 is configured to perform an extension process on the spatiotemporal fingerprint to obtain an extended spatiotemporal fingerprint; and to perform bitwise operations on the extended spatiotemporal fingerprint and the semantic fingerprint to obtain the composite fingerprint.

[0119] In some embodiments, the analysis module 403 is configured to construct a hash index based on the semantic fingerprint; determine candidate content clusters through the hash index; calculate the basic similarity between the candidate content clusters and the streaming text data, the basic similarity including semantic similarity and spatiotemporal similarity, the semantic similarity being calculated based on the Hamming distance of the semantic fingerprint, and the spatiotemporal similarity being calculated based on the consistency of the spatiotemporal fingerprint; calculate a comprehensive similarity based on the basic similarity; in response to the comprehensive similarity of all candidate content clusters being greater than a preset threshold, classify the streaming text data into the corresponding target candidate content cluster to obtain the clustering result; in response to the comprehensive similarity of all candidate content clusters being less than or equal to the preset threshold, create a new content cluster to obtain the clustering result.

[0120] In some embodiments, the analysis module 403 is configured to, in response to the clustering result being the creation of a new content cluster, create a first content cluster node in the dynamic propagation graph, and create an edge in the dynamic propagation graph pointing from the user node to the first content cluster node, and initialize the popularity of the first content cluster node; the first content cluster node is the content cluster node corresponding to the new content cluster; in response to the clustering result being assigned to the corresponding target candidate content cluster, create an edge in the dynamic propagation graph pointing from the user node to a second content cluster node, and increase the popularity of the second content cluster node; the second content cluster node is the content cluster node corresponding to the target candidate content cluster.

[0121] In some embodiments, the analysis module 403 is configured to determine an outbreak coefficient, maximum out-degree, propagation depth, and propagation entropy based on the abnormal content cluster nodes; and to determine the outbreak coefficient, maximum out-degree, propagation depth, and propagation entropy as the propagation features; wherein the outbreak coefficient is determined based on the timestamps of the edges associated with the abnormal content cluster nodes; the maximum out-degree is determined based on the out-degree of the user nodes associated with the abnormal content cluster nodes, where the out-degree is the total number of content cluster nodes pointed to by a single user node; the propagation depth is determined based on the number of edges contained in the target propagation path, where the target propagation path is the longest propagation path starting from the abnormal content cluster node; and the propagation entropy is determined based on the proportion of the number of times a single user node propagates in the abnormal content cluster node to the total number of times all user nodes propagate in the abnormal content cluster node.

[0122] In some embodiments, the analysis module 403 is configured to determine the propagation mode as viral propagation in response to the outbreak coefficient, the propagation depth, and the maximum out-degree satisfying a first condition; to determine the propagation mode as star propagation in response to the outbreak coefficient, the propagation entropy, and the maximum out-degree satisfying a second condition; and to determine the propagation mode as chain propagation in response to the outbreak coefficient, the maximum out-degree, and the propagation depth satisfying a third condition.

[0123] In some embodiments, the output module 404 is configured to generate a propagation geographic heatmap and a propagation timeline of the abnormal content cluster nodes. The propagation geographic heatmap is used to characterize the propagation distribution of streaming text data in different regions, and the propagation timeline is used to characterize the propagation sequence of streaming text data in different time periods. In the updated dynamic propagation map, a reverse breadth-first search is performed starting from the abnormal content cluster nodes to determine the propagation source node. The propagation source node is the user node that first established an association with the abnormal content cluster nodes. A response instruction is generated according to the propagation mode. The propagation source node, the propagation geographic heatmap, the propagation timeline, and the response instruction are integrated to obtain the source tracing result.

[0124] In some embodiments, the output module 404 is configured to generate a flow limiting instruction and a high-level alarm instruction in response to the propagation mode being viral propagation; to generate a core node influence analysis report generation instruction in response to the propagation mode being star propagation; and to generate a complete propagation path drawing instruction in response to the propagation mode being chain propagation.

[0125] It should be noted that the foregoing explanation of the method embodiments also applies to the apparatus of the embodiments of this application, and the principle is the same. Therefore, the embodiments of this application are not limited thereto.

[0126] According to embodiments of this application, this application also provides an electronic device, a readable storage medium, and a computer program product.

[0127] Figure 5 A schematic block diagram of an example electronic device 500 that can be used to implement embodiments of this application is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the application described and / or claimed herein.

[0128] like Figure 5 As shown, the electronic device 500 includes a computing unit 501, which can perform various appropriate actions and processes based on a computer program stored in ROM (Read-Only Memory) 502 or a computer program loaded from storage unit 508 into RAM (Random Access Memory) 503. The RAM 503 can also store various programs and data required for the operation of the electronic device 500. The computing unit 501, ROM 502, and RAM 503 are interconnected via a bus 504. An I / O (Input / Output) interface 505 is also connected to the bus 504.

[0129] Multiple components in electronic device 500 are connected to I / O interface 505, including: input unit 506, such as keyboard, mouse, etc.; output unit 507, such as various types of monitors, speakers, etc.; storage unit 508, such as disk, optical disk, etc.; and communication unit 509, such as network card, modem, wireless transceiver, etc. Communication unit 509 allows electronic device 500 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0130] The computing unit 501 can be various general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of the computing unit 501 include, but are not limited to, CPUs (Central Processing Units), GPUs (Graphics Processing Units), various special-purpose AI (Artificial Intelligence) computing chips, various computing units running machine learning model algorithms, DSPs (Digital Signal Processors), and any suitable processor, controller, microcontroller, etc. The computing unit 501 performs the various methods and processes described above, such as the text propagation tracing analysis method. For example, in some embodiments, the text propagation tracing analysis method can be implemented as a computer software program tangibly contained in a machine-readable medium, such as storage unit 508. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 500 via ROM 502 and / or communication unit 509. When the computer program is loaded into RAM 503 and executed by the computing unit 501, one or more steps of the methods described above can be performed. Alternatively, in other embodiments, the computing unit 501 may be configured to perform the aforementioned text propagation source analysis method by any other suitable means (e.g., by means of firmware).

[0131] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, FPGAs (Field Programmable Gate Arrays), ASICs (Application-Specific Integrated Circuits), ASSPs (Application-Specific Standard Products), SOCs (System-on-Chips), CPLDs (Complex Programmable Logic Devices), computer hardware, firmware, software, and / or combinations thereof. These various implementations may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0132] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0133] In the context of this application, a machine-readable medium can be a tangible medium that may contain or store a program for use by or in conjunction with an instruction execution system, apparatus, or device. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, RAM, ROM, EPROM (Electrically Programmable Read-Only Memory) or flash memory, optical fiber, CD-ROM (Compact Disc Read-Only Memory), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0134] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device for displaying information to the user (e.g., a CRT (Cathode-Ray Tube) or LCD (Liquid Crystal Display) monitor); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the computer. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0135] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include LANs (Local Area Networks), WANs (Wide Area Networks), the Internet, and blockchain networks.

[0136] Computer systems can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. A server can be a cloud server, also known as a cloud computing server or cloud host, a hosting product within the cloud computing service system that addresses the shortcomings of traditional physical hosts and VPS (Virtual Private Server) services, such as high management difficulty and weak business scalability. Servers can also be servers for distributed systems or servers incorporating blockchain technology.

[0137] It's important to note that artificial intelligence (AI) is the study of enabling computers to simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily include computer vision, speech recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graph technologies.

[0138] As can be seen from the above technical solutions, the text propagation source tracing analysis method, device, electronic device, and storage medium disclosed in this application can achieve more accurate and robust identification from a single content dimension to a multimodal fusion dimension; can achieve real-time response and intervention from batch post-processing analysis to streaming real-time processing; can reduce costs and improve generalization ability from relying on labeled data to unsupervised quantitative identification; and can provide clear decision-making basis from black-box model to interpretable and traceable transparent analysis.

[0139] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.

[0140] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for tracing the source of text propagation, characterized in that, include: Retrieve streaming text data; Extract multidimensional features from the streaming text data, including statistical features, semantic features, and spatiotemporal features; Generate a composite fingerprint based on the multidimensional features; Similarity matching and clustering are performed based on the composite fingerprint and dynamic propagation graph to obtain the clustering result; the dynamic propagation graph includes user nodes and content cluster nodes. Update the dynamic propagation graph based on the clustering results; Extract the propagation characteristics of abnormal content cluster nodes in the content cluster nodes, and determine the propagation mode based on the propagation characteristics; Based on the propagation mode and the updated dynamic propagation graph, the source node of the propagation is located by reverse traversal in order to generate the tracing result and response instruction.

2. The method according to claim 1, characterized in that, The acquisition of streaming text data includes: Obtain the text data tuple carrying the propagation context information to obtain the streaming text data; The propagation context information includes text content, timestamp, sender identifier, receiver identifier, and location information.

3. The method according to claim 1, characterized in that, Before extracting the multidimensional features of the streaming text data, the method further includes: Clean the text content in the streaming text data; Based on a lightweight conditional random field model, functional blocks of the cleaned streaming text data are identified, and the functional blocks include at least a title, body text, and emphasized text.

4. The method according to claim 3, characterized in that, The extraction of multidimensional features from the streaming text data includes: The basic weights are determined based on the type of the functional blocks; Authority is calculated based on historical dissemination data; Calculate the block weight according to the aforementioned authority and the aforementioned basic weight; The cleaned streaming text data is segmented, and new words are dynamically discovered and the temporary dictionary is updated based on mutual information and left and right entropy within a sliding window to obtain candidate words. Based on the block weights, the statistical features, semantic features, and spatiotemporal features of the candidate words are extracted.

5. The method according to claim 1, characterized in that, The generation of composite fingerprints based on the multidimensional features includes: Determine the semantic fingerprint based on the semantic features; Determine the spatiotemporal fingerprint based on the spatiotemporal characteristics; The composite fingerprint is generated using the semantic fingerprint and the spatiotemporal fingerprint.

6. The method according to claim 5, characterized in that, Determining the semantic fingerprint based on the semantic features includes: Filter core semantic information from the semantic features; The core semantic information is concatenated into a string in lexicographical order; Perform a hash operation on the string to obtain the result; The semantic fingerprint is determined based on the calculation result.

7. The method according to claim 5, characterized in that, The step of determining the spatiotemporal fingerprint based on the spatiotemporal features includes: Generate time period codes based on the timestamps of the streaming text data; Generate a geohash string based on the location information of the streaming text data; Perform a hash operation on the geographic hash string to obtain the geographic code; The spatiotemporal fingerprint is determined based on the time period code and the geographical code.

8. The method according to claim 5, characterized in that, The step of generating the composite fingerprint using the semantic fingerprint and the spatiotemporal fingerprint includes: The spatiotemporal fingerprint is extended to obtain an extended spatiotemporal fingerprint. Bitwise operations are performed on the extended spatiotemporal fingerprint and the semantic fingerprint to obtain the composite fingerprint.

9. The method according to any one of claims 5-8, characterized in that, The similarity matching and clustering based on the composite fingerprint and dynamic propagation graph includes: Construct a hash index based on the semantic fingerprint; Candidate content clusters are determined using the hash index; Calculate the basic similarity between the candidate content cluster and the streaming text data. The basic similarity includes semantic similarity and spatiotemporal similarity. The semantic similarity is calculated based on the Hamming distance of the semantic fingerprint, and the spatiotemporal similarity is calculated based on the consistency of the spatiotemporal fingerprint. Calculate the overall similarity based on the aforementioned basic similarity: In response to the overall similarity of all candidate content clusters being greater than a preset threshold, the streaming text data is assigned to the corresponding target candidate content cluster to obtain the clustering result; In response to the overall similarity of all candidate content clusters being less than or equal to the preset threshold, a new content cluster is created, and the clustering result is obtained.

10. The method according to claim 9, characterized in that, The edges of the dynamic propagation graph are directed edges pointing from user nodes to content cluster nodes; updating the dynamic propagation graph according to the clustering result includes: In response to the clustering result being the creation of a new content cluster, a first content cluster node is created in the dynamic propagation graph, and an edge is created in the dynamic propagation graph pointing from the user node to the first content cluster node, and the popularity of the first content cluster node is initialized; the first content cluster node is the content cluster node corresponding to the new content cluster. In response to the clustering result being assigned to the corresponding target candidate content cluster, an edge is created in the dynamic propagation graph pointing from the user node to the second content cluster node, and the popularity of the second content cluster node is increased; the second content cluster node is the content cluster node corresponding to the target candidate content cluster.

11. The method according to claim 1, characterized in that, The step of extracting the propagation characteristics of abnormal content cluster nodes in the content cluster nodes includes: The burst coefficient, maximum out-degree, propagation depth, and propagation entropy are determined based on the abnormal content cluster nodes. The burst coefficient, maximum outgoing degree, propagation depth, and propagation entropy are defined as the propagation characteristics. The burst coefficient is determined based on the timestamps of the edges associated with the abnormal content cluster nodes; the maximum out-degree is determined based on the out-degree of the user nodes associated with the abnormal content cluster nodes, where the out-degree is the total number of content cluster nodes pointed to by a single user node; the propagation depth is determined based on the number of edges contained in the target propagation path, where the target propagation path is the longest propagation path starting from the abnormal content cluster node; and the propagation entropy is determined based on the proportion of the number of times a single user node propagates in the abnormal content cluster node to the total number of times all user nodes propagate in the abnormal content cluster node.

12. The method according to claim 11, characterized in that, Determining the propagation pattern based on the propagation characteristics includes: In response to the outbreak coefficient, the propagation depth, and the maximum outgoing degree satisfying a first condition, the propagation mode is determined to be viral propagation; In response to the burst coefficient, the propagation entropy, and the maximum out-degree satisfying the second condition, the propagation mode is determined to be star propagation; In response to the burst coefficient, the maximum outgoing degree, and the propagation depth satisfying the third condition, the propagation mode is determined to be chain propagation.

13. The method according to claim 12, characterized in that, The process of locating the source node of the propagation through reverse traversal includes: Generate a geographical heatmap and a timeline for the propagation of abnormal content cluster nodes. The geographical heatmap is used to characterize the propagation distribution of streaming text data in different regions, and the timeline is used to characterize the propagation sequence of streaming text data in different time periods. In the updated dynamic propagation graph, a reverse breadth-first search is performed starting from the abnormal content cluster node to determine the propagation source node; the propagation source node is the earliest user node that established an association with the abnormal content cluster node. Generate response instructions based on the propagation pattern: The source node of the propagation, the geographical heat map of the propagation, the propagation timeline, and the response command are integrated to obtain the source tracing result.

14. The method according to claim 13, characterized in that, The step of generating response instructions based on the propagation mode includes: In response to the propagation mode being viral propagation, a rate limiting command and a high-level alert command are generated; In response to the propagation mode being the star-shaped propagation, a core node influence analysis report generation command is generated; In response to the propagation mode being the chain propagation, a complete propagation path drawing instruction is generated.

15. A text propagation source tracing and analysis device, characterized in that, include: The data processing module is configured to acquire streaming text data; Extract multidimensional features from the streaming text data, including statistical features, semantic features, and spatiotemporal features; The fingerprint generation module is configured to generate a composite fingerprint based on the multidimensional features; The analysis module is configured to perform similarity matching and clustering based on the composite fingerprint and the dynamic propagation graph to obtain the clustering result; the dynamic propagation graph includes user nodes and content cluster nodes; The dynamic propagation graph is updated based on the clustering results; the propagation characteristics of abnormal content cluster nodes in the content cluster nodes are extracted, and the propagation mode is determined based on the propagation characteristics; The output module is configured to locate the source node of the propagation by reverse traversal based on the propagation mode and the updated dynamic propagation graph, so as to generate the tracing result and response instruction.

16. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1-14.

17. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1-14.

Images