A virtual identity association method based on behavior graph structure and iterative hash coding
By constructing a directed behavior graph and utilizing iterative hashing, the problems of static feature spoofing, text obfuscation, and insufficient behavior sequence structure mining in virtual identity association methods are solved, achieving efficient and accurate virtual identity association across platforms.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- NO 30 INST OF CHINA ELECTRONIC TECH GRP CORP
- Filing Date
- 2026-04-23
- Publication Date
- 2026-06-19
AI Technical Summary
Existing virtual identity association methods struggle to address issues such as static feature spoofing, text content obfuscation, lack of behavioral sequence structure mining, and low computational efficiency, making it difficult to accurately identify and track cross-platform network attackers.
A method based on behavioral graph structure and iterative hashing is adopted. By constructing a directed behavioral graph, multi-granularity codes are generated using iterative hashing, and a logistic regression model is combined to associate virtual identities, mine behavioral features, and calculate similarity.
It significantly improves resistance to malicious spoofing and obfuscation, enables efficient cross-platform behavioral structure mining, and enhances the ability to capture deep structural features and the accuracy of association determination.
Smart Images
Figure CN122069024B_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of network security technology, and in particular to a virtual identity association method based on behavioral graph structure and iterative hash encoding. Background Technology
[0002] In the field of cybersecurity, social network attackers typically create multiple virtual identities to launch cyberattacks on social networking sites, requiring the identification and association of clusters of virtual identities controlled by the same attacker. However, unlike ordinary social network users, the account information of carefully crafted virtual identities by attackers exhibits high independence and heterogeneity, making tracing and correlation difficult. Furthermore, attackers' cyber activities often span multiple social platforms, with significant differences in data structures and user interaction patterns across different platforms. Traditional methods, typically designed for a single platform, struggle to track and analyze attackers' cross-platform activities.
[0003] Existing virtual identity association methods mainly include association methods based on user static features, association methods based on text topic analysis, association methods based on multi-level attribute analysis, and social network identity association methods based on big data, which are described in detail below.
[0004] (1) The method based on user static features extracts the user profile of virtual identity by extracting the username, email, address, social relationship and other features of virtual identity, and realizes the association of virtual identity by calculating the similarity of different user profiles.
[0005] (2) The association method based on text topic analysis uses natural language processing technology to extract the sentiment, theme, and topic type of the text published by users, thereby associating virtual identities with similar sentiment and theme in the published content.
[0006] (3) A virtual identity association method based on multi-level attribute analysis combines user basic attribute similarity, user opinion similarity, and user social relationship similarity. First, a weighted method is used to calculate the similarity of user basic information, which includes username, gender, address, and age. Second, a neural network model is used to analyze the text published by users to calculate user opinion similarity. At the same time, the link information and interaction information representation between users are obtained, and a graph neural network-based method is used to calculate user social relationship similarity, where user social relationship is represented by [missing information]. Finally, considering the similarity of user basic information, user opinion, and user social relationship, a weighted calculation is used to calculate user similarity, thereby achieving user virtual identity association.
[0007] (4) The social network identity association method based on big data constructs an active time period model, a browsing preference model, a friend relationship model and a follow relationship model respectively, calculates the homogeneity of user activity features and browsing features, and determines whether all of them are greater than the preset homogeneity threshold. If not all of them are greater than the homogeneity threshold, the second iteration of user features is extracted and the homogeneity of activity features and browsing features is recalculated. If all of them are greater than the homogeneity threshold, the homogeneity of friend features and follow features is calculated, the mixed homogeneity is calculated based on the feature weight, a feature function is constructed, the mixed homogeneity is input into the feature function, the function output value is obtained, and it is determined whether the function output value is 1. If the function output value is 1, the social network identity association is confirmed.
[0008] However, the above-mentioned virtual identity association method has the following problems:
[0009] (1) Difficulty in dealing with static features and social relationship spoofing. Methods based on user static features rely on basic user information such as username, email, and address. Attackers can spoof and randomly tamper with these static features. Furthermore, due to the privacy policies of social networking sites, features such as identity information and registration information are difficult to obtain, leading to data sparsity difficulties. Therefore, when basic user information is missing or inaccurate, methods based on static features are prone to misleading and make it difficult to implement identity association and tracing. On the one hand, user relationships are explicit "follow" and "follow" relationships. In real network attack and defense scenarios, attackers control multiple virtual identities to carry out network attack activities. They will deliberately avoid establishing direct follow relationships between accounts, making this explicit social relationship graph very sparse, and it is difficult to learn relationship features using graph neural networks.
[0010] (2) Weak resistance to text content obfuscation. Text-based association methods heavily rely on user-published text content. Attackers can obfuscate an account's sentiment and topic distribution by publishing irrelevant, random, or contradictory content, making it difficult for neural networks to extract accurate semantic features. This can interfere with the accuracy of text-based association methods and even render opinion similarity calculations ineffective. Therefore, text-based association methods lack the ability to distinguish between diverse topics. Multi-level attribute analysis-based virtual identity association methods, which combine user static feature-based and text-based theme-based methods, become unreliable when attackers forge static features such as identity and geographic location and publish obfuscating text content, resulting in poor overall virtual identity association performance.
[0011] (3) Lack of in-depth mining of behavioral sequence structure. Existing methods obtain feature vectors through feature engineering, which essentially compare the similarity of "feature vectors" without mining the structural correlation between user behaviors. Social network identity association methods based on big data have constructed active time period models, browsing preference models, and friend relationship models to calculate the homogeneity of active features and browsing features. However, their homogeneity calculation is based on the Euclidean distance of predefined feature vectors, which makes it difficult to mine the correlation between user behaviors. For example, user A's "login → browse → comment" and user B's "login → browse → like" behavioral sequences are highly similar in structure, but existing methods may determine them as dissimilar because of different feature values.
[0012] (4) Low computational efficiency makes it difficult to support large-scale applications. The social network identity association method based on big data predefines user features such as browsing content type, browsing duration range, and interaction frequency level, and manually sets weights, which greatly increases the workload. Moreover, when the number of users is large, the method of extracting the second user feature set in sequence and performing iterative comparison will greatly reduce the efficiency of the method, making it unsuitable for large-scale automated mining. Summary of the Invention
[0013] To address the aforementioned issues, this invention proposes a virtual identity association method based on behavioral graph structure and iterative hash encoding, which can effectively mine the behavioral characteristics of virtual identities across different platforms and discover associated virtual accounts.
[0014] The technical solution adopted in this invention is as follows:
[0015] A virtual identity association method based on behavioral graph structure and iterative hash encoding includes:
[0016] Collect online behavior data of virtual identities and normalize them into unified behavior tags, then extract the attribute features corresponding to the behaviors;
[0017] Using individual behaviors as nodes, construct a time-weighted directed behavior graph according to the order in which the behaviors occur, and limit the size of the behavior graph according to a preset range;
[0018] The behavioral graph nodes are initially encoded, and the neighborhood information and time weight of the nodes are aggregated through multiple rounds of iterative hashing to generate multi-granularity codes and global hash fingerprints;
[0019] The similarity of behavioral graph structures is calculated based on multi-granularity coding, and the final similarity is obtained by combining auxiliary statistical feature similarity.
[0020] The final similarity, behavioral graph features, and time series features are input into the logistic regression model, and the virtual identity association is determined by the output probability and threshold of the logistic regression model.
[0021] Furthermore, the step of constructing a time-weighted directed behavior graph using individual behaviors as nodes and according to the order in which the behaviors occur includes: independently constructing an enhanced behavior graph for each virtual identity. ,in For a set of nodes, Let be a set of directed edges. A collection of node labels. For time weight set, This is a collection of node attribute vectors, as detailed below.
[0022] Node set In, each node A single network behavior is represented by a behavior label and a behavior attribute vector, which is used to distinguish different targets under the same behavior type.
[0023] Node label collection In the middle, node labels These are behavioral type tags, including login, access, like, comment, share, and download, i.e.:
[0024]
[0025] Node attribute vector set In, node attribute vector For detailed characteristics of behavior: for The node's attribute is the hash value of the second-level domain of the accessed domain; for The node has the attribute of comment length increments; for The node has a file-type hash value as its attribute.
[0026] Directed edge set In the middle, there is a directed edge A directed edge is established between two consecutive actions based on their chronological order. The direction of the directed edge represents the chronological order. ,in Indicates the current node The previous node, .
[0027] Time weight set In the middle, the time weight is ,in and They are nodes and nodes The time when the action occurred.
[0028] The step of limiting the size of the behavior graph according to a preset range includes: extracting the nearest... A behavior or recent The behavior of the sky is used to construct a behavior map to control the behavior map. Scale.
[0029] Furthermore, the initial encoding of behavioral graph nodes, followed by multiple rounds of iterative hash aggregation of node neighborhood information and time weights, includes:
[0030] Behavior diagrams Each node , node labels and node attribute vector Concatenate the strings to form a unique hexadecimal string, which will serve as the initial encoding for that node. ;
[0031] For each node Perform neighborhood information aggregation and collect the previous round encodings of all its outgoing neighbors. and the time weights of the corresponding edges ;in, , The total number of iterations is denoted by 'outgoing edge neighbor', where the outgoing edge neighbor is the target node of the directed edge.
[0032] Construct a neighborhood string, and add nodes Previous round of coding The codes of all neighbors are concatenated in a preset order, and time weight information is embedded.
[0033] Hash Update: Input the concatenated string into the SHA-256 hash function to generate a new encoding. ;
[0034] Node encoding update: using the newly generated Replace the current encoding of the node.
[0035] Furthermore, the statement regarding each node Perform neighborhood information aggregation, including:
[0036]
[0037] in, This refers to the SHA-256 hash function. This represents the SORT sorting function. This indicates string concatenation. Represents a node The set of outgoing neighbors; when When the node is in its first position, the encoding includes information about itself and its first-order neighbors; when... When, the encoding includes information about the node itself and its second-order neighbors; when At that time, the encoding includes the node itself and its... Information about neighboring units.
[0038] Furthermore, the generation of multi-granularity encoding and global hash fingerprint includes:
[0039] go through After rounds of iteration, the final encoding of each node is obtained. To preserve multi-granularity information, node-level, subtree-level, and global-level encoding sets are generated.
[0040] The node-level encoding set is:
[0041]
[0042] The node-level encoding set represents the final encoding for each node;
[0043] The subtree-level encoding set is:
[0044]
[0045] The subtree-level encoding set is represented by the encoding of all nodes in each iteration;
[0046] The global-level encoding set is:
[0047]
[0048] A global-level encoding set represents the global hash fingerprint of the entire behavioral graph; This refers to the SHA-256 hash function. This represents the SORT sorting function.
[0049] Furthermore, the calculation of behavioral graph structure similarity based on multi-granularity encoding includes:
[0050] For two virtual identities and First, perform global filtering. If the global filtering result... Then directly determine the structural similarity of the behavior graph. No further calculations will be performed.
[0051] Calculate basic similarity based on node-level encoding sets. :
[0052]
[0053] The node-level encoding set and the multi-granularity encoding set are weighted and fused to obtain the behavioral graph structure similarity:
[0054]
[0055] in, is a weighting coefficient used to balance the contributions of node-level and subtree-level encoding.
[0056] Furthermore, the process of combining auxiliary statistical feature similarity fusion to obtain the final similarity includes:
[0057] Calculate the similarity of auxiliary statistical features :
[0058]
[0059] in, As weight, and ;
[0060] The IP geographic distribution similarity is calculated using the set of geographic locations of the login IPs and the Jaccard similarity method.
[0061] The similarity of the activity time period distribution is calculated using the 24-hour activity frequency vector and the cosine similarity method.
[0062] The similarity score is determined by the stability of the device fingerprints; a score of 1 indicates that the device fingerprints are identical in uniqueness, and a score of 0 indicates otherwise.
[0063] The behavioral frequency similarity was calculated using the average number of daily behaviors and the normalized Euclidean distance.
[0064] Combining behavioral graph structural similarity Similarity with auxiliary statistical features Calculate the final similarity :
[0065]
[0066] in, These are the weighting coefficients.
[0067] Furthermore, the step of inputting the final similarity, behavioral graph features, and time-series features into the logistic regression model, and determining the virtual identity association based on the probability output by the logistic regression model and a threshold, includes:
[0068] The final similarity, behavioral graph features, and temporal features are input into the logistic regression model, which is then trained on a labeled dataset to learn the optimal decision boundary. The behavioral graph features include the number of nodes, edge density, and average degree of the behavioral graph, while the temporal features include the time span of the behavioral sequence and the variance of the behavioral frequency.
[0069] When determining the association between virtual identities, the features of the two virtual identities to be associated are input into a logistic regression model, and the association probability is output. ;like If so, it is determined that the two virtual identities are related.
[0070] The beneficial effects of this invention are as follows:
[0071] 1. Significantly enhances resistance to malicious spoofing and obfuscation. This invention does not rely on static features and semantic content that users can control, such as usernames, addresses, and text, but rather analyzes the objectively generated behavioral sequences and structural patterns. Behavioral patterns reflect users' long-term usage habits, and attackers cannot completely change their core behavioral patterns in a short period of time in order to complete their attack tasks. Compared to the shortcomings of existing methods, which are susceptible to text obfuscation attacks and evasion by predefined features, this invention has stronger robustness against attackers' spoofing and obfuscation, and can more accurately discover deep identity associations.
[0072] 2. Achieving general and efficient cross-platform behavioral structure mining. This invention directly transforms raw behavioral logs into enhanced behavioral graphs, including directed edges, time weights, and node attributes, and encodes them using iterative hash k-WL decomposition. The entire process is data-driven and automated. Compared to other existing methods that use predefined "browsing dimensions" and manually set weights, this method can automatically adapt to various platforms and new behavioral patterns, possessing stronger versatility and scalability, and enabling cross-platform behavioral pattern mining.
[0073] 3. Enhanced ability to capture deep structural features. Existing methods have not effectively mined the deep behavioral features of virtual identities. This invention uses k-round iterative hashing, where the final encoding of each node contains the structural information of its k-order neighboring nodes. This enables the capture of deeper behavioral association patterns, effectively resisting attackers' fine-tuning of local behavioral sequences and making the association method more resistant to interference.
[0074] 4. Improve the intelligence and accuracy of association determination. This method achieves adaptive association decision boundaries through multimodal similarity fusion, including structural similarity, statistical feature similarity, and machine learning determination models. Compared with the fixed threshold determination methods in other methods, the determination of this invention is more flexible and accurate, and can adapt to the differences in behavioral feature distributions of different platforms and user groups. Attached Figure Description
[0075] Figure 1 This is a flowchart of a virtual identity association method based on behavioral graph structure and iterative hash encoding according to Embodiment 1 of the present invention.
[0076] Figure 2 This is a schematic diagram of the construction of the enhanced behavior graph in Embodiment 1 of the present invention. Detailed Implementation
[0077] To provide a clearer understanding of the technical features, objectives, and effects of the present invention, specific embodiments are now described. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention; that is, the described embodiments are only a part of the embodiments of the invention, not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.
[0078] Example 1
[0079] This embodiment provides a virtual identity association method based on behavioral graph structure and iterative hash encoding, which can be referred to. Figure 1 This includes the following steps:
[0080] 1. Behavioral Data Collection: Collect online behavioral data of virtual identities and normalize them into unified behavioral tags, then extract the attribute features corresponding to the behaviors;
[0081] 2. Enhanced Behavior Graph Construction: Using individual behaviors as nodes, construct a time-weighted directed behavior graph according to the order in which behaviors occur, and limit the size of the behavior graph according to a preset range;
[0082] 3. Iterative Hash Graph Encoding and Decomposition: Initial encoding is performed on the behavioral graph nodes, and the neighborhood information and time weight of the nodes are aggregated through multiple rounds of iterative hashing to generate multi-granularity codes and global hash fingerprints;
[0083] 4. Multimodal similarity calculation: The behavioral graph structure similarity is calculated based on multi-granularity encoding, and the final similarity is obtained by combining auxiliary statistical feature similarity.
[0084] 5. Adaptive Association Determination: Input the final similarity, behavioral graph features, and time series features into the logistic regression model, and complete the virtual identity association determination based on the probability and threshold output by the logistic regression model.
[0085] Preferably, step 1 includes the following sub-steps:
[0086] 1.1 Data Acquisition
[0087] Operation logs of virtual identities are obtained from target social media platforms and forums. The collected behavioral data includes account access data, social activity data, and data transmission data. Account access data includes login IP address, access URL, access timestamp, and session ID, such as "2025-01-01 10:00:00, 192.168.1.1, http: / / xxx.com / login"; social activity data includes behavior types such as likes, favorites, reposts, and comments, as well as the target object ID and behavior timestamp, such as "2025-01-01 10:05:00, like post_id_12345"; data transmission data includes file download or upload URLs, filenames, file types, and transmission timestamps, such as "2025-01-01 10:10:00, download,report.pdf".
[0088] 1.2 Data Preprocessing and Normalization
[0089] Behavioral data from different platforms is normalized into a unified behavioral tagging system, including behaviors such as "likes," "shares," "logins," and "access," as shown in the example below:
[0090] (1) The "like" on Weibo, Twitter, and Facebook are all mapped to the tag "like";
[0091] (2) The "forward" on Weibo and the "Retweet" on Twitter are uniformly mapped to the tag "retweet";
[0092] (3) The "login" behavior on each platform is mapped to the tag "login";
[0093] (4) The “browse / access” behavior of each platform is mapped to the tag view, and the second-level domain name of the access domain is extracted as an attribute, such as “view:weibo.com”.
[0094] Preferably, step 2 includes the following sub-steps:
[0095] 2.1 Definition of Behavior Diagram
[0096] An enhanced behavior graph is constructed independently for each virtual identity. ,in For a set of nodes, Let be a set of directed edges. A collection of node labels. For time weight set, This is a collection of node attribute vectors, with each element defined as follows:
[0097] (1) Node
[0098] Node set In, each node A single network behavior is represented by a behavior label and a behavior attribute vector, which is used to distinguish different targets under the same behavior type.
[0099] Node label collection In the middle, node labels These are behavioral type tags, including login, access, like, comment, share, and download, i.e.:
[0100]
[0101] Node attribute vector set In, node attribute vector For example, for detailed characteristics of behavior. The node's attribute is the hash value of the second-level domain of the accessed domain; for The node, whose attribute is the comment length level, includes short, medium, and long; for The node has a file-type hash value as its attribute.
[0102] Specifically, the behaviors of "visiting the Weibo homepage" and "visiting the Twitter homepage" are represented as examples below, with different nodes in the behavior graph:
[0103]
[0104]
[0105] (2) Side
[0106] Directed edge set In the middle, there is a directed edge A directed edge is established between two consecutive actions based on their chronological order. The direction of the directed edge represents the chronological order. ,in Indicates the current node The previous node, ;
[0107] Time weight set In the middle, the time weight is ,in and They are nodes and nodes The time when the action occurred.
[0108] It should be noted that this invention uses directed edges to preserve the directional information of the behavior sequence and uses time weights to capture the user's operation rhythm. For example, an automated script may complete multiple actions in a very short time, in which case the time weight is small, while the operation time interval of a real user is relatively longer and fluctuates. This invention can effectively distinguish the above differences.
[0109] More preferably, the present invention takes only the nearest A behavior or recent The behavior of the day is used to construct a behavior graph in order to control the size of the graph and improve the efficiency of association.
[0110] 2.2 Example of Behavior Graph Construction
[0111] The sequence of actions of a certain virtual identity within a time window is as follows:
[0112] , , , ,
[0113] Then the nodes are:
[0114]
[0115] The directed edges and their time weights are:
[0116]
[0117]
[0118]
[0119]
[0120] Please refer to the appendix for details. Figure 2 .
[0121] Preferably, step 3 uses The idea behind the k-WL graph isomorphism test is to transform a complex behavioral graph into a structural fingerprint encoding set through multiple rounds of iterative hashing. Specifically, this includes the following sub-steps:
[0122] 3.1 Initial Node Encoding
[0123] Behavior diagrams Each node , node labels and node attribute vector Concatenate the strings to form a unique hexadecimal string, which will serve as the initial encoding for that node. .For example, The initial code is 0x8A3F. The initial code is 0x1B7C.
[0124] 3.2 Round-based iterative hashing process
[0125] For the Round iteration ( The operation process is as follows:
[0126] For each node Perform neighborhood information aggregation, collecting the previous round encoding of all its outgoing neighbors (target nodes of directed edges). and the time weights of the corresponding edges ;
[0127] Construct a neighborhood string, and add nodes Previous round of coding The codes of all neighbors are concatenated in a preset order (such as sorted by neighbor codes) and time weight information is embedded.
[0128] Hash Update: Input the concatenated string into the SHA-256 hash function to generate a new encoding. ;
[0129] Node encoding update: using the newly generated Replace the current encoding of the node.
[0130] More preferably, for each node Aggregating neighborhood information includes:
[0131]
[0132] in, This refers to the SHA-256 hash function. This represents the SORT sorting function. This indicates string concatenation. Represents a node The set of outgoing neighbors. When When the node is in its first position, the encoding includes information about itself and its first-order neighbors; when... When, the encoding includes information about the node itself and its second-order neighbors; when At that time, the encoding includes the node itself and its... Information about neighboring units.
[0133] 3.3 Generation of Multi-Granularity Coding Sets
[0134] go through After rounds of iteration, the final encoding of each node is obtained. To preserve multi-granularity information, node-level, subtree-level, and global-level encoding sets are generated.
[0135] The node-level encoding set is:
[0136]
[0137] The node-level encoding set represents the final encoding for each node;
[0138] The subtree-level encoding set is:
[0139]
[0140] The subtree-level encoding set is represented by the encoding of all nodes in each iteration;
[0141] The global-level encoding set is:
[0142]
[0143] The global-level encoding set represents the global hash fingerprint of the entire behavioral graph.
[0144] It should be noted that multi-granularity coding can capture both local behavioral patterns and cross-node structural relationships, while also providing global fast comparison capabilities.
[0145] Preferably, step 4 includes the following sub-steps:
[0146] 4.1 Behavioral graph structural similarity
[0147] For two virtual identities and First, perform global filtering. If the global filtering result... Then directly determine the structural similarity of the behavior graph. No further calculations will be performed.
[0148] Calculate basic similarity based on node-level encoding sets. :
[0149]
[0150] The node-level encoding set and the multi-granularity encoding set are weighted and fused to obtain the behavioral graph structure similarity:
[0151]
[0152] in, is a weighting coefficient used to balance the contributions of node-level and subtree-level encoding.
[0153] 4.2 Auxiliary Statistical Similarity
[0154] To enhance the robustness of the judgment, this invention introduces a set of tamper-resistant auxiliary statistical features to calculate the similarity of the auxiliary statistical features. The characteristics are shown in the table below.
[0155] Table 1 - Auxiliary Statistical Characteristics
[0156]
[0157] Calculate the similarity of auxiliary statistical features :
[0158]
[0159] in, As weight, and .
[0160] Combining behavioral graph structural similarity Similarity with auxiliary statistical features Calculate the final similarity :
[0161]
[0162] in, These are the weighting coefficients.
[0163] Preferably, step 5 includes the following sub-steps:
[0164] 5.1 Machine Learning Judgment Model
[0165] This invention uses a logistic regression model for association determination. The model input features include: final similarity. Structural similarity Auxiliary feature similarity The graph statistical characteristics of the behavioral graph, such as the number of nodes, edge density, and average degree, as well as the temporal characteristics of the behavioral sequence, such as the time span and variance of the behavioral frequency.
[0166] 5.2 Model Training and Judgment
[0167] The model is trained on a labeled dataset to learn the optimal decision boundary. When determining the association between two virtual identities, the features of the two virtual identities to be associated are input into the logistic regression model, which outputs the association probability. ;like ( If the two virtual identities are related, then it is determined that they are connected.
[0168] Example 2
[0169] This embodiment is based on embodiment 1:
[0170] This embodiment provides a computer device, including a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the virtual identity association method based on behavioral graph structure and iterative hash encoding of Embodiment 1. The computer program can be in the form of source code, object code, executable file, or some intermediate form.
[0171] Example 3
[0172] This embodiment is based on embodiment 1:
[0173] This embodiment provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the virtual identity association method based on behavioral graph structure and iterative hash encoding described in Embodiment 1. The computer program can be in the form of source code, object code, executable file, or some intermediate form. The storage medium includes any entity or device capable of carrying computer program code, a recording medium, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signals, telecommunication signals, and software distribution media, etc.
[0174] The above description is merely a preferred embodiment of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the concept described herein through the above teachings or related technologies or knowledge. Modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.
[0175] It should be noted that, for the sake of simplicity, the foregoing method embodiments are described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.
Claims
1. A virtual identity association method based on behavioral graph structure and iterative hash encoding, characterized in that, include: Collect online behavior data of virtual identities and normalize them into unified behavior tags, then extract the attribute features corresponding to the behaviors; Using individual behaviors as nodes, construct a time-weighted directed behavior graph according to the order in which the behaviors occur, and limit the size of the behavior graph according to a preset range; The behavioral graph nodes are initially encoded, and the neighborhood information and time weight of the nodes are aggregated through multiple rounds of iterative hashing to generate multi-granularity codes and global hash fingerprints; The similarity of behavioral graph structures is calculated based on multi-granularity coding, and the final similarity is obtained by combining auxiliary statistical feature similarity. The final similarity, behavioral graph features, and time series features are input into the logistic regression model, and the virtual identity association is determined by the probability and threshold output by the logistic regression model. The method of constructing a time-weighted directed behavior graph based on the order of behavior occurrence, using individual behaviors as nodes, includes: independently constructing an enhanced behavior graph for each virtual identity. ,in For a set of nodes, Let be a set of directed edges. A collection of node labels. For time weight set, A collection of node attribute vectors; Node set In, each node A single network behavior is represented by a behavior label and a behavior attribute vector, which is used to distinguish different targets under the same behavior type. Node label collection In the middle, node labels For behavior type tags, including login ,access Like ,Comment ,Forward and download ,Right now: Node attribute vector set In, node attribute vector For detailed characteristics of behavior: for The node's attribute is the hash value of the second-level domain of the accessed domain; for The node has the attribute of comment length increments; for The node has the attribute of a file type hash value; Directed edge set In the middle, there is a directed edge A directed edge is established between two consecutive actions based on their chronological order. The direction of the directed edge represents the chronological order. ,in Indicates the current node The previous node, ; Time weight set In the middle, the time weight is ,in and They are nodes and nodes The time at which the action occurred; The step of limiting the size of the behavior graph according to a preset range includes: extracting the nearest... A behavior or recent The behavior of the sky is used to construct a behavior map to control the behavior map. The scale; The initial encoding of behavioral graph nodes, followed by multiple rounds of iterative hash aggregation of node neighborhood information and time weights, includes: Behavior diagrams Each node , node labels and node attribute vector Concatenate the strings to form a unique hexadecimal string, which will serve as the initial encoding for that node. ; For each node Perform neighborhood information aggregation and collect the previous round encodings of all its outgoing neighbors. and the time weights of the corresponding edges ;in, , The total number of iterations is denoted by 'outgoing edge neighbor', where the outgoing edge neighbor is the target node of the directed edge. Construct a neighborhood string, and add nodes Previous round of coding The codes of all neighbors are concatenated in a preset order, and time weight information is embedded. Hash Update: Input the concatenated string into the SHA-256 hash function to generate a new encoding. ; Node encoding update: with newly generated Replace the current encoding of the node.
2. The virtual identity association method based on behavioral graph structure and iterative hash encoding according to claim 1, characterized in that, The for each node Perform neighborhood information aggregation, including: in, This refers to the SHA-256 hash function. This represents the SORT sorting function. This indicates string concatenation. Represents a node The set of outgoing neighbors; when When the node is in its first position, the encoding includes information about itself and its first-order neighbors; when... When, the encoding includes information about the node itself and its second-order neighbors; when At that time, the encoding includes the node itself and its... Information about neighboring units.
3. The virtual identity association method based on behavioral graph structure and iterative hash encoding according to claim 1, characterized in that, The generation of multi-granularity encoding and global hash fingerprint includes: go through After rounds of iteration, the final encoding of each node is obtained. To preserve multi-granularity information, node-level, subtree-level, and global-level encoding sets are generated. The node-level encoding set is: The node-level encoding set represents the final encoding for each node; The subtree-level encoding set is: The subtree-level encoding set is represented by the encoding of all nodes in each iteration; The global-level encoding set is: A global-level encoding set represents the global hash fingerprint of the entire behavioral graph; This refers to the SHA-256 hash function. This represents the SORT sorting function.
4. The virtual identity association method based on behavioral graph structure and iterative hash encoding according to claim 3, characterized in that, The calculation of behavioral graph structure similarity based on multi-granularity encoding includes: For two virtual identities and First, perform global filtering. If the global filtering result is... Then directly determine the structural similarity of the behavior graph. No further calculations will be performed. Calculate basic similarity based on node-level encoding sets. : The node-level encoding set and the multi-granularity encoding set are weighted and fused to obtain the behavioral graph structure similarity: in, is a weighting coefficient used to balance the contributions of node-level and subtree-level encoding.
5. The virtual identity association method based on behavioral graph structure and iterative hash encoding according to claim 1, characterized in that, The final similarity is obtained by combining auxiliary statistical feature similarity fusion, including: Calculate the similarity of auxiliary statistical features : in, As weight, and ; The IP geographic distribution similarity is calculated using the set of geographic locations of the login IPs and the Jaccard similarity method. The similarity of the activity time period distribution is calculated using the 24-hour activity frequency vector and the cosine similarity method. The similarity score is determined by the stability of the device fingerprints; a score of 1 indicates that the device fingerprints are identical in uniqueness, and a score of 0 indicates otherwise. The behavioral frequency similarity was calculated using the average number of daily behaviors and the normalized Euclidean distance. Combining behavioral graph structural similarity Similarity with auxiliary statistical features Calculate the final similarity : in, These are the weighting coefficients.
6. The virtual identity association method based on behavioral graph structure and iterative hash encoding according to claim 1, characterized in that, The step of inputting the final similarity, behavioral graph features, and time-series features into a logistic regression model, and determining the virtual identity association based on the probability output by the logistic regression model and a threshold, includes: The final similarity, behavioral graph features, and temporal features are input into the logistic regression model, which is then trained on a labeled dataset to learn the optimal decision boundary. The behavioral graph features include the number of nodes, edge density, and average degree of the behavioral graph, while the temporal features include the time span of the behavioral sequence and the variance of the behavioral frequency. When determining the association between virtual identities, the features of the two virtual identities to be associated are input into a logistic regression model, and the association probability is output. ;like If so, it is determined that the two virtual identities are related.