Online platform real-time detection method based on dynamic adversarial graph collaborative network

Abstract

This invention proposes a real-time detection method for online platforms based on dynamic adversarial graph collaborative networks. The method includes: constructing a static global graph based on historical data and caching key local subgraphs; when a new node arrives, dynamically matching the optimal cached subgraph based on coverage and similarity, and performing local integration and feature updates; generating adversarial examples by injecting gradient-based adversarial perturbations into the node features and adjacency matrix of the local subgraph, and fusing the loss of the original data and adversarial examples to optimize model robustness; and using the optimized model to perform fast inference on the updated local subgraph to achieve real-time determination of whether a new node is spurious. This invention introduces an adversarial training mechanism based on gradient information, generating adversarial examples by injecting perturbations into node features and graph structure, enhancing the model's ability to identify unconventional data patterns and complex interference behaviors, and effectively resisting targeted interference at the feature level and structure level.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence and cybersecurity, and in particular to a real-time detection method for online platforms based on dynamic adversarial graph collaborative networks. Background Technology

[0002] With the rapid expansion of e-commerce and O2O services, online user reviews have become a key mechanism for information filtering in the digital economy. Globally, approximately 87% of consumers use them as a primary reference when making purchasing decisions, with their influence being particularly significant in sectors such as catering, tourism, and electronics. However, profit-driven misinformation dissemination has become widespread across the industry. According to relevant market research data, a considerable proportion of consumer decision-making disputes stem from misleading information sources. This behavior not only disrupts the objective and orderly market information environment but also affects the information judgment of consumers and compliant businesses. Therefore, developing intelligent and efficient information credibility verification systems has become an urgent need for both academia and industry.

[0003] Early online comment credibility analysis primarily relied on rule-based methods, using preset keyword filtering (such as extreme sentiment words) or behavioral pattern recognition (such as comments posted during peak time periods) for judgment. However, these methods heavily depend on domain expertise, requiring the manual construction of complex rule systems, and are ill-suited to rapidly evolving misinformation dissemination strategies. To overcome these bottlenecks, researchers turned to machine learning, attempting to address comment credibility judgment using algorithms such as SVM, KNN, and CNN, and proposing a series of improvements to address common issues like data imbalance. While these efforts achieved some success, they failed to fully capture the complex topological and relational relationships between users and comments. In recent years, Graph Neural Networks (GNNs) have become a research hotspot due to their powerful relational reasoning capabilities. Researchers have employed basic models such as GCN, GraphSAGE, and GAT, combined with strategies like meta-path learning and semi-supervised learning, to effectively improve the performance of credibility analysis.

[0004] However, existing methods for analyzing the credibility of information on online platforms still have significant limitations: First, most adopt offline batch processing, requiring pre-storage of complete graph data, resulting in extremely high memory consumption and an inability to adapt to the real-time stream of new comments and dynamically changing user relationship networks in online systems. Second, while existing models can detect obvious abnormal patterns such as automated account manipulation of reviews, they struggle to identify carefully disguised information dissemination behaviors, such as businesses hiring real users to write biased reviews or competitors hiring specific groups to publish unconventional content, lacking fine-grained differentiation capabilities. Third, machine learning models and graph neural network models are vulnerable to targeted interference, easily misled by maliciously constructed data, leading to a significant drop in analytical performance. These problems make it difficult for existing methods to meet the stringent requirements of online platforms for real-time performance and robustness, necessitating an information credibility analysis solution that can dynamically adapt to data changes and effectively resist such interference. Summary of the Invention

[0005] In view of the above situation, the main objective of this invention is to propose a real-time detection method for online platforms based on dynamic adversarial graph cooperative networks to solve the above-mentioned technical problems.

[0006] This invention proposes a real-time detection method for online platforms based on dynamic adversarial graph cooperative networks, the method comprising the following steps: Step 1: Obtain offline historical data and construct a static global graph. Then, generate initial node embeddings and calculate a set of node scores using a graph neural network. Based on the set of node scores, select nodes to construct local subgraphs and cache them to obtain an initial subgraph cache pool. Step 2: When a new node is received, calculate the edge weights between the new node and each node in the static global graph, and perform filtering and local neighborhood definition to obtain the local neighborhood of the new node; select local subgraphs that have intersection with the local neighborhood of the new node from the initial subgraph cache pool, and calculate the association strength with the new node, and select the local subgraph with the highest association strength as the optimal subgraph. Step 3: Integrate the new node into the optimal subgraph and update the optimal subgraph to obtain the updated optimal subgraph; input the updated optimal subgraph into the GraphSAGE model, and perform forward propagation through neighborhood sampling and aggregation operations to obtain preliminary prediction results; Step 4: Construct the original loss function based on the preliminary prediction results; generate the adversarial feature matrix and adversarial adjacency matrix based on the original loss and the updated optimal subgraph, respectively; input the adversarial feature matrix and adversarial adjacency matrix into the GraphSAGE model for forward propagation to obtain the prediction output of the adversarial examples; construct the adversarial loss function based on the prediction output of the adversarial examples. Step 5: Optimize the GraphSAGE model using the original loss function and the adversarial loss function to obtain the optimized GraphSAGE model; input the updated optimal subgraph into the optimized GraphSAGE model for processing to obtain the determination result of whether the new node has false behavior.

[0007] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. The initial subgraph cache pool designed in this invention avoids the dependence of offline batch processing on complete graph data through local subgraph caching and incremental update strategies, significantly reducing memory consumption. At the same time, it only performs local calculations on the affected areas, so that the average inference latency meets the real-time requirements of online systems, solving the pain point that existing methods are difficult to adapt to dynamic comment streams and user relationship networks. 2. This invention introduces an adversarial training mechanism based on gradient information. By injecting perturbations into node features and graph structure to generate adversarial samples, it enhances the model's ability to identify unconventional data patterns and complex interference behaviors. Compared with the traditional GNN model, its robustness is significantly improved, and it can effectively resist targeted interference at the feature level and structure level. 3. This invention does not rely on manually designed rules or domain expertise. It captures the complex topological relationships between users and comments through the relational reasoning capabilities of graph neural networks. Combined with dynamic adaptation and adversarial enhancement strategies, it can maintain excellent detection performance even in scenarios with limited labeled data. It balances recognition accuracy, real-time performance, and generalization ability, and is suitable for information credibility judgment scenarios on various online platforms.

[0008] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by means of embodiments of the invention. Attached Figure Description

[0009] Figure 1 This is a flowchart illustrating the steps of a real-time detection method for an online platform based on a dynamic adversarial graph cooperative network proposed in this invention. Figure 2 This is a diagram illustrating the overall framework of an online platform real-time detection method based on a dynamic adversarial graph cooperative network proposed in this invention. Detailed Implementation

[0010] Embodiments of the present invention are described in detail below. Examples of these embodiments are shown in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and are only used to explain the present invention, and should not be construed as limiting the present invention.

[0011] These and other aspects of the embodiments of the present invention will become clear from the following description and accompanying drawings. In these descriptions and drawings, some specific embodiments of the present invention are specifically disclosed to illustrate some ways of implementing the principles of the embodiments of the present invention; however, it should be understood that the scope of the embodiments of the present invention is not limited thereto.

[0012] Please see Figure 1 This embodiment provides a real-time detection method for online platforms based on dynamic adversarial graph cooperative networks. The method includes the following steps: Step 1: Obtain offline historical data and construct a static global graph. Then, generate initial node embeddings and calculate a set of node scores using a graph neural network. Based on the set of node scores, select nodes to construct a local subgraph and cache it to obtain an initial subgraph cache pool.

[0013] In step 1, offline historical data is acquired and a static global graph is constructed. Then, an initial node embedding is generated using a graph neural network, and a node score set is calculated. Based on the node score set, nodes are selected to construct a local subgraph and cached to obtain an initial subgraph cache pool. Specifically, this includes the following sub-steps: Obtain offline historical datasets and construct a static global graph based on them. The static global graph includes a set of nodes, a set of edges, and a node feature matrix; in, Represents a static global graph. Represents a set of nodes. Denotes the set of edges. Represents the node feature matrix; An initialization time window is defined based on a static global graph, and the historical interaction frequency between nodes is counted to construct a global adjacency matrix. The following relationship exists in the corresponding process. ; in, Represents the global adjacency matrix The elements in the table are used to count the historical interaction frequency between nodes; and Each represents any node in the static global graph. Indicates the timestamp of the interaction. This indicates the initialization of the time window. Indicates an indicator function, when Belongs to the initial edge set When the value is 1, the indicator function is 1; otherwise, it is 0. Represents the initial set of edges; Based on the node feature matrix and the global adjacency matrix, the initial node embedding matrix is ​​calculated using the first layer of the graph convolutional neural network. The following relationship exists in the corresponding process. ; in, This represents the initial embedding matrix of the nodes. This indicates that the data has been processed using the ReLU function. Represents the global adjacency matrix. This represents the weight matrix of the first layer; Based on the initial embedding matrix of the nodes, the initial embedding vector of each node is processed using the L2 norm to obtain the node score set. The following relationship exists in the corresponding process. ; in, Indicates the first The importance score of each node Indicates the index of the node. Describing the L2 norm, Indicates the first The initial embedding vector of each node; Based on the node score set, all nodes are sorted in descending order according to their score, and the top K (K is a preset positive integer) nodes are selected to obtain the high-scoring node set. Based on each node in the high-scoring node set and its corresponding one-hop neighbor node, a local subgraph is constructed, and the following relationship exists in the corresponding process; ; in, Represents a node With nodes The corresponding local subgraph formed by one-hop neighbor nodes. Represents the first high-scoring node in the set. 1 node Represents the union, Represents a node The set of one-hop neighbor nodes, Representing a local subgraph The corresponding adjacency matrix, Representing a local subgraph The corresponding feature matrix; All constructed local subgraphs are stored in a cache to obtain the initial subgraph cache pool.

[0014] Step 2: When a new node is received, calculate the edge weights between the new node and each node in the static global graph, and perform filtering and local neighborhood definition to obtain the local neighborhood of the new node; select local subgraphs that have intersection with the local neighborhood of the new node from the initial subgraph cache pool, and after calculating the association strength with the new node, select the local subgraph with the highest association strength as the optimal subgraph.

[0015] In step 2, when a new node is received, the edge weights between the new node and each node in the static global graph are calculated, and then filtered and defined as local neighborhoods to obtain the local neighborhood of the new node. Local subgraphs that intersect with the local neighborhood of the new node are selected from the initial subgraph cache pool, and after calculating the association strength with the new node, the local subgraph with the highest association strength is selected as the optimal subgraph. Specifically, this includes the following sub-steps: When a new node is received, the edge weights between the new node and each node in the static global graph are calculated based on the global adjacency matrix to obtain the edge weight set. The following relationship exists in the corresponding process. ; in, Indicates a new node With nodes edge weights, Indicates a new node. Represents the node similarity function; It should be noted that the node similarity function uses cosine similarity to calculate the similarity between the feature vector of a new node and the feature vector of any node in the static global graph. The higher the similarity, the stronger the correlation between nodes.

[0016] Based on the edge weight set, nodes in the static global graph whose edge weight with the new node is greater than the edge weight threshold are selected to construct the set of one-hop neighbor nodes of the new node. The following relationship exists in the corresponding process. ; in, Indicates a new node The set of one-hop neighbor nodes, Represents a set of nodes The nodes in Indicates a new node With nodes edge weights, This represents the edge weight threshold, and ; The local neighborhood of a new node is defined based on the set of its one-hop neighbors, and the following relationship exists in the correspondence process; ; in, This represents the local neighborhood of the new node. The local neighborhood is used to limit the local structural range related to the new node and avoid interference from irrelevant nodes. Represents a node With nodes The shortest path length between them. Indicates the preset number of jumps; The local subgraphs that intersect with the local neighborhood of the new node are selected from the initial subgraph cache pool to obtain a set of candidate local subgraphs. The following relationship exists in the corresponding process. ; in, Represents the set of candidate local subgraphs. Indicates the first A local subgraph, This represents the initial subgraph cache pool. Indicates the first The set of nodes in a local subgraph Indicates intersection, Represents the empty set; If the candidate local subgraph set is empty, then it is based on the node set. Generate a new subgraph and add it to the cache pool; If the candidate local subgraph set is a non-empty set, then calculate the association strength between each candidate local subgraph in the candidate local subgraph set and the new node to obtain the association strength set. The following relationship exists in the corresponding process. ; in, Represents candidate local subgraphs With new nodes The strength of the association, Indicates a candidate local subgraph. and Both represent preset weighting coefficients, and , ; This indicates the calculation of cosine similarity. Indicates a new node eigenvectors, Represents candidate local subgraphs The average eigenvector; Based on the set of association strengths, the candidate local subgraph with the highest association strength with the new node is selected as the optimal subgraph.

[0017] Step 3: Integrate the new node into the optimal subgraph and update the optimal subgraph to obtain the updated optimal subgraph; input the updated optimal subgraph into the GraphSAGE model, and perform forward propagation through neighborhood sampling and aggregation operations to obtain preliminary prediction results.

[0018] In step 3, the new node is integrated into the optimal subgraph, and the optimal subgraph is updated to obtain the updated optimal subgraph. The updated optimal subgraph is then input into the GraphSAGE model, and forward propagation is performed through neighborhood sampling and aggregation operations to obtain preliminary prediction results. Specifically, this includes the following sub-steps: Add the new node to the node set Integrate into the optimal subgraph, and update the node set and edge set of the optimal subgraph to obtain the updated node set and edge set. The following relationship exists in the correspondence process. ; in, This represents the updated set of nodes. Represents the set of nodes in the optimal subgraph. This represents the updated edge set. This represents the edge set of the optimal subgraph. Indicates the relationship between the optimal subgraph and the new node Directly connected neighbor nodes, Indicates a new node With nodes Edge weights; The feature vector of the new node is updated to obtain the updated features of the new node. The following relationship exists in the correspondence process. ; in, This indicates the updated characteristics of the new node. Represents a node eigenvectors; The updated feature matrix is ​​constructed by using the feature matrix of the optimal subgraph and the updated features of the new nodes. The following relationship exists in the correspondence process. ; in, This represents the updated feature matrix. The feature matrix representing the optimal subgraph; The updated optimal subgraph is constructed using the updated node set, the updated edge set, and the updated feature matrix; The updated optimal subgraph is input into the GraphSAGE model, and forward propagation is performed through neighborhood sampling and aggregation operations to obtain preliminary prediction results. The following relationship exists in the corresponding process. ; in, This indicates the preliminary forecast results. This represents the forward propagation function of the GraphSAGE model. Represents the learnable parameters of the model. This represents the adjacency matrix of the updated optimal subgraph; Step 4: Construct the original loss function based on the preliminary prediction results; generate the adversarial feature matrix and adversarial adjacency matrix based on the original loss and the updated optimal subgraph, respectively; input the adversarial feature matrix and adversarial adjacency matrix into the GraphSAGE model for forward propagation to obtain the prediction output of the adversarial examples; construct the adversarial loss function based on the prediction output of the adversarial examples.

[0019] In step 4, the original loss function is constructed based on the preliminary prediction results; adversarial feature matrix and adversarial adjacency matrix are generated based on the original loss and the updated optimal subgraph, respectively; the adversarial feature matrix and adversarial adjacency matrix are input into the GraphSAGE model for forward propagation to obtain the prediction output of adversarial examples; the adversarial loss function is constructed based on the prediction output of adversarial examples, specifically including the following sub-steps: The original loss function is constructed based on the preliminary prediction results, and the following relationship exists in the corresponding process; ; in, Indicates the original loss. This represents the number of nodes in the updated optimal subgraph. Indicates the first The predicted probability vector of each node. Indicates the first The real label of each node Represents the cross-entropy loss function. This represents the parameter regularization term. Indicates L2 regularization terms; The gradient is calculated based on the original loss and the feature matrix of the updated optimal subgraph to obtain the gradient of the original loss with respect to the feature matrix; the adversarial perturbation of the feature matrix is ​​generated based on the gradient of the original loss with respect to the feature matrix, and the following relationship exists in the corresponding process. ; in, This represents the adversarial perturbation of the eigenma. This indicates the upper limit of the characteristic perturbation amplitude. Represents a symbolic function. This represents the gradient of the original loss with respect to the feature matrix; The adversarial perturbation of the feature matrix is ​​superimposed with the feature matrix of the updated optimal subgraph to obtain the adversarial feature matrix. The following relationship exists in the corresponding process. ; in, Represents the adversarial feature matrix; The gradient is calculated based on the original loss and the updated adjacency matrix of the optimal subgraph to obtain the gradient of the original loss with respect to the adjacency matrix; the adversarial perturbation of the adjacency matrix is ​​generated based on the gradient of the original loss with respect to the adjacency matrix, and the following relationship exists in the corresponding process. ; in, This represents the adversarial perturbation of the adjacency matrix. This represents the magnitude of the perturbation in the adjacency matrix; The adversarial perturbation of the adjacency matrix is ​​superimposed with the updated adjacency matrix of the optimal subgraph to obtain the adversarial adjacency matrix. The following relationship exists in the corresponding process. ; in, Represents an adversarial adjacency matrix; The adversarial feature matrix and the adversarial adjacency matrix are input into the GraphSAGE model for forward propagation to obtain the predicted output of the adversarial sample. The following relationship exists in the corresponding process. ; in, This represents the predicted output of the adversarial example; The adversarial loss function is constructed based on the predicted output of adversarial examples, and the following relationship exists in the corresponding process; ; in, Indicating resistance to loss, Indicates the first The predicted probability of a node under adversarial examples Represents the structure regularization weights. Represents the KL divergence regularization term; Furthermore, the expression for the total loss function is: ; in, Indicates the total loss. and Both represent the balancing hyperparameters, and , .

[0020] Step 5: Optimize the GraphSAGE model using the original loss function and the adversarial loss function to obtain the optimized GraphSAGE model; input the updated optimal subgraph into the optimized GraphSAGE model for processing to obtain the determination result of whether the new node has false behavior.

[0021] In step 5, the updated optimal subgraph is input into the GraphSAGE model for processing to determine whether the new node exhibits spurious behavior. This process includes the following sub-steps: The updated optimal subgraph is then fed into the GraphSAGE model for processing to obtain new nodes. The category probability distribution; New node The category probability distribution is compared with a preset judgment threshold. If the category probability is greater than the preset judgment threshold, the new node is judged to have false behavior; otherwise, it is judged to be normal behavior.

[0022] It should be understood that although the steps in the flowcharts of the various embodiments of the present invention are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the various embodiments may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these sub-steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least a portion of the sub-steps or stages of other steps.

[0023] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0024] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0025] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A real-time detection method for online platforms based on dynamic adversarial graph cooperative networks, characterized in that, The method includes the following steps: Step 1: Obtain offline historical data and construct a static global graph. Then, generate initial node embeddings and calculate a set of node scores using a graph neural network. Based on the set of node scores, select nodes to construct local subgraphs and cache them to obtain an initial subgraph cache pool. Step 2: When a new node is received, calculate the edge weights between the new node and each node in the static global graph, and perform filtering and local neighborhood definition to obtain the local neighborhood of the new node; select local subgraphs that have intersection with the local neighborhood of the new node from the initial subgraph cache pool, and calculate the association strength with the new node, and select the local subgraph with the highest association strength as the optimal subgraph. Step 3: Integrate the new node into the optimal subgraph and update the optimal subgraph to obtain the updated optimal subgraph; input the updated optimal subgraph into the GraphSAGE model, and perform forward propagation through neighborhood sampling and aggregation operations to obtain preliminary prediction results; Step 4: Construct the original loss function based on the preliminary prediction results; generate the adversarial feature matrix and adversarial adjacency matrix based on the original loss and the updated optimal subgraph, respectively; input the adversarial feature matrix and adversarial adjacency matrix into the GraphSAGE model for forward propagation to obtain the prediction output of the adversarial examples; construct the adversarial loss function based on the prediction output of the adversarial examples. Step 5: Optimize the GraphSAGE model using the original loss function and the adversarial loss function to obtain the optimized GraphSAGE model; input the updated optimal subgraph into the optimized GraphSAGE model for processing to obtain the determination result of whether the new node has false behavior.

2. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 1, characterized in that, In step 1, offline historical data is acquired and a static global graph is constructed. Then, an initial node embedding is generated using a graph neural network, and a node score set is calculated. Based on the node score set, nodes are selected to construct a local subgraph and cached to obtain an initial subgraph cache pool. Specifically, this includes the following sub-steps: Obtain offline historical datasets and construct a static global graph based on them. The static global graph includes a set of nodes, a set of edges, and a node feature matrix; in, Represents a static global graph. Represents a set of nodes. Denotes the set of edges. Represents the node feature matrix; An initialization time window is defined based on a static global graph, and the historical interaction frequency between nodes is counted to construct a global adjacency matrix. Based on the node feature matrix and the global adjacency matrix, the initial node embedding matrix is ​​calculated using the first layer of the graph convolutional neural network; Based on the initial embedding matrix of the nodes, the initial embedding vector of each node is processed using the L2 norm to obtain the node score set; Based on the node score set, all nodes are sorted in descending order according to their score, and the top K nodes are selected to obtain the set of high-scoring nodes. Based on each node in the high-scoring node set and its corresponding one-hop neighbor node, a local subgraph is constructed. All constructed local subgraphs are stored in a cache to obtain the initial subgraph cache pool.

3. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 2, characterized in that, In the steps of defining an initialization time window based on a static global graph and counting the historical interaction frequency between nodes to construct a global adjacency matrix, the following relationship exists; ； in, Represents the global adjacency matrix The elements in and Each represents any node in the static global graph. Indicates the timestamp of the interaction. This indicates the initialization of the time window. Indicates an indicator function, Represents the initial set of edges; In the step of calculating the initial embedding matrix of nodes using the first layer of a graph convolutional neural network based on the node feature matrix and the global adjacency matrix, the following relationship exists; ； in, Represents the initial embedding matrix of the nodes. This indicates that the data has been processed using the ReLU function. express, This represents the weight matrix of the first layer; In the step of processing the initial embedding vector of each node using the L2 norm based on the initial embedding matrix of the node to obtain the node score set, the following relationship exists; ； in, Indicates the first The importance score of each node Indicates the index of the node. Represents the L2 norm. Indicates the first The initial embedding vector of each node; In the step of constructing a local subgraph based on each node in the high-scoring node set and its corresponding one-hop neighbor node, the following relationship exists; ； in, Represents a node With nodes The corresponding local subgraph formed by one-hop neighbor nodes. Represents the first high-scoring node in the set. 1 node Represents the union, Represents a node The set of one-hop neighbor nodes, Representing a local subgraph The corresponding adjacency matrix, Representing a local subgraph The corresponding feature matrix.

4. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 3, characterized in that, In step 2, when a new node is received, the edge weights between the new node and each node in the static global graph are calculated, and then filtered and defined as local neighborhoods to obtain the local neighborhood of the new node. Local subgraphs that intersect with the local neighborhood of the new node are selected from the initial subgraph cache pool, and after calculating the association strength with the new node, the local subgraph with the highest association strength is selected as the optimal subgraph. Specifically, this includes the following sub-steps: When a new node is received, the edge weights between the new node and each node in the static global graph are calculated based on the global adjacency matrix to obtain the edge weight set. Based on the edge weight set, nodes in the static global graph whose edge weight with the new node is greater than the edge weight threshold are selected to construct a set of one-hop neighbor nodes of the new node. The local neighborhood of a new node is defined based on the set of its one-hop neighbors. Select local subgraphs that intersect with the local neighborhood of the new node from the initial subgraph cache pool to obtain a set of candidate local subgraphs; If the candidate local subgraph set is empty, a new subgraph is generated based on the set of one-hop neighbor nodes of the new node and added to the cache pool; If the candidate local subgraph set is a non-empty set, then calculate the association strength between each candidate local subgraph in the candidate local subgraph set and the new node to obtain the association strength set; Based on the set of association strengths, the candidate local subgraph with the highest association strength with the new node is selected as the optimal subgraph.

5. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 4, characterized in that, In the step of calculating the edge weights of the new node and each node in the static global graph based on the global adjacency matrix to obtain the edge weight set, the following relationship exists; ； in, Indicates a new node With nodes edge weights, Indicates a new node. Represents the node similarity function; In the step of selecting nodes in the static global graph whose edge weights with the new node are greater than the edge weight threshold based on the edge weight set, in order to construct the set of one-hop neighbor nodes of the new node, the following relationship exists; ； in, Indicates a new node The set of one-hop neighbor nodes, Represents a set of nodes The nodes in Indicates a new node With nodes edge weights, Indicates the edge weight threshold; In the step of defining the local neighborhood of a new node based on the set of its one-hop neighbors, the following relation exists; ； in, Represents the local neighborhood of the new node. Represents a node With nodes The shortest path length between them. Indicates the preset number of jumps; In the step of selecting local subgraphs that intersect with the local neighborhood of the new node from the initial subgraph cache pool to obtain a set of candidate local subgraphs, the following relationship exists; ； in, Represents the set of candidate local subgraphs. Indicates the first A local subgraph, This represents the initial subgraph cache pool. Indicates the first The set of nodes in a local subgraph Indicates intersection, Indicates the empty set; In the step of calculating the association strength between each candidate local subgraph and the new node in the candidate local subgraph set if the candidate local subgraph set is not empty, in order to obtain the association strength set, the following relationship exists; ； in, Represents candidate local subgraphs With new nodes The strength of the association, Indicates a candidate local subgraph. and All represent preset weighting coefficients. This indicates the calculation of cosine similarity. Indicates a new node eigenvectors, Represents candidate local subgraphs The average eigenvector.

6. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 5, characterized in that, In step 3, the new node is integrated into the optimal subgraph, and the optimal subgraph is updated to obtain the updated optimal subgraph. The updated optimal subgraph is then input into the GraphSAGE model, and forward propagation is performed through neighborhood sampling and aggregation operations to obtain preliminary prediction results. Specifically, this includes the following sub-steps: Add the new node to the node set Integrate into the optimal subgraph, and update the node set and edge set of the optimal subgraph to obtain the updated node set and edge set; The feature vector of the new node is updated to obtain the updated features of the new node; The updated feature matrix is ​​constructed by using the feature matrix of the optimal subgraph and the updated features of the new nodes. The updated optimal subgraph is constructed using the updated node set, the updated edge set, and the updated feature matrix; The updated optimal subgraph is input into the GraphSAGE model, and forward propagation is performed through neighborhood sampling and aggregation operations to obtain preliminary prediction results.

7. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 6, characterized in that, In linking new nodes with node sets In the steps of integrating into the optimal subgraph and updating the node set and edge set of the optimal subgraph to obtain the updated node set and edge set, the following relationship exists; ； in, This represents the updated set of nodes. Represents the set of nodes in the optimal subgraph. This represents the updated edge set. This represents the edge set of the optimal subgraph. Indicates the relationship between the optimal subgraph and the new node Directly connected neighbor nodes, Indicates a new node With nodes Edge weights; In the step of updating the feature vector of a new node to obtain the updated features of the new node, the following relationship exists; ； in, This indicates the updated characteristics of the new node. Represents a node eigenvectors; In the step of constructing the updated feature matrix using the feature matrix of the optimal subgraph and the updated features of the new nodes, the following relationship exists; ； in, This represents the updated feature matrix. The feature matrix representing the optimal subgraph; In the step of inputting the updated optimal subgraph into the GraphSAGE model and performing forward propagation through neighborhood sampling and aggregation operations to obtain preliminary prediction results, the following relationship exists; ； in, This indicates the preliminary forecast results. This represents the forward propagation function of the GraphSAGE model. Represents the learnable parameters of the model. This represents the adjacency matrix of the updated optimal subgraph.

8. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 7, characterized in that, In step 4, an original loss function is constructed based on the preliminary prediction results; adversarial feature matrices and adversarial adjacency matrices are generated based on the original loss and the updated optimal subgraph, respectively; the adversarial feature matrices and adversarial adjacency matrices are input into the GraphSAGE model for forward propagation to obtain the predicted output of adversarial examples; and an adversarial loss function is constructed based on the predicted output of adversarial examples, specifically including the following sub-steps: The original loss function is constructed based on the preliminary prediction results; The gradient is calculated based on the original loss and the feature matrix of the updated optimal subgraph to obtain the gradient of the original loss with respect to the feature matrix; the adversarial perturbation of the feature matrix is ​​generated based on the gradient of the original loss with respect to the feature matrix. The adversarial perturbation of the feature matrix is ​​superimposed with the feature matrix of the updated optimal subgraph to obtain the adversarial feature matrix; The gradient is calculated based on the original loss and the updated adjacency matrix of the optimal subgraph to obtain the gradient of the original loss with respect to the adjacency matrix; the adversarial perturbation of the adjacency matrix is ​​generated based on the gradient of the original loss with respect to the adjacency matrix. The adversarial perturbation of the adjacency matrix is ​​superimposed with the updated adjacency matrix of the optimal subgraph to obtain the adversarial adjacency matrix. The adversarial feature matrix and adversarial adjacency matrix are input into the GraphSAGE model for forward propagation to obtain the predicted output of the adversarial examples; The adversarial loss function is constructed based on the predicted output of the adversarial examples.

9. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 8, characterized in that, In the step of constructing the original loss function based on the preliminary prediction results, the following relationship exists; ； in, Indicates the original loss. This represents the number of nodes in the updated optimal subgraph. Indicates the first The predicted probability vector of each node. Indicates the first The real label of each node Represents the cross-entropy loss function. This represents the parameter regularization term. Indicates L2 regularization terms; In the step of calculating the gradient based on the original loss and the feature matrix of the updated optimal subgraph to obtain the gradient of the original loss with respect to the feature matrix, and generating the adversarial perturbation of the feature matrix based on the gradient of the original loss with respect to the feature matrix, the following relationship exists; ； in, This represents the adversarial perturbation of the eigenma. This indicates the upper limit of the characteristic perturbation amplitude. Represents a symbolic function. This represents the gradient of the original loss with respect to the feature matrix; In the step of superimposing the adversarial perturbation of the feature matrix with the updated feature matrix of the optimal subgraph to obtain the adversarial feature matrix, the following relationship exists; ； in, Represents the adversarial feature matrix; In the step of generating the adversarial perturbation adjacency matrix based on the gradient calculation of the original loss and the updated optimal subgraph, the following relationship exists: ； in, This represents the adversarial perturbation of the adjacency matrix. This represents the magnitude of the perturbation in the adjacency matrix; In the step of superimposing the adversarial perturbation of the adjacency matrix with the updated adjacency matrix of the optimal subgraph to obtain the adversarial adjacency matrix, the following relationship exists; ； in, Represents an adversarial adjacency matrix; In the step of inputting the adversarial feature matrix and the adversarial adjacency matrix into the GraphSAGE model for forward propagation to obtain the predicted output of the adversarial sample, the following relationship exists; ； in, This represents the predicted output of the adversarial example; In the step of constructing the adversarial loss function based on the predicted output of adversarial examples, the following relationship exists; ； in, Indicating resistance to loss, Indicates the first The predicted probability of a node under adversarial examples Represents the structure regularization weights. This represents the KL divergence regularization term.

10. The online platform real-time detection method based on dynamic adversarial graph cooperative network according to claim 9, characterized in that, In step 5, the updated optimal subgraph is input into the GraphSAGE model for processing to obtain a determination result on whether the new node exhibits spurious behavior. This specifically includes the following sub-steps: The updated optimal subgraph is input into the GraphSAGE model for processing to obtain the class probability distribution of the new nodes; The category probability distribution of the new node is compared with a preset judgment threshold. If the category probability is greater than the preset judgment threshold, the new node is judged to have false behavior. Otherwise, it is considered normal behavior.

Images