Social media public opinion analysis and early warning method and system based on multi-dimensional data

Abstract

This invention relates to the field of data processing technology, specifically to a method and system for social media sentiment analysis and early warning based on multi-dimensional data. The method includes: acquiring the amplitude of an audio signal and the volume of social interaction requests; analyzing the volume interaction conversion at each moment based on the audio signal amplitude and the volume of social interaction requests, and combining this with the attenuation characteristics of the audio signal amplitude at historical moments within the time neighborhood of each moment to obtain the predicted sound source contribution at each moment; obtaining the abnormal synchronization index at the current moment based on the differences between the volume of social interaction requests and the predicted sound source contribution at each moment within a preset monitoring period, and the information distribution of these differences; and determining whether verification is triggered based on the abnormal synchronization index at the current moment to obtain the social media sentiment monitoring result for the current moment. This invention can effectively resist collaborative script attacks while avoiding accidental damage to normal business activities, ensuring a balance between public opinion security and user experience in live streaming scenarios.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, specifically to a method and system for social media sentiment analysis and early warning based on multi-dimensional data. Background Technology

[0002] In interactive live streaming scenarios, user interactions such as bullet comments, likes, and purchases are stimulated by both visual and auditory content. Natural traffic exhibits discrete, random, and high-entropy characteristics at the micro-temporal level due to individual reaction time differences and network jitter. In contrast, collaborative script attacks (CIB) use group control technology to simulate high-volume traffic, and their request generation is uniformly controlled, exhibiting highly mechanical and synchronous low-entropy characteristics. However, the two are highly similar in terms of macro-level request volume (QPS). At the same time, audio stimuli such as anchor voice announcements and countdowns can cause temporal synchronization of compliant traffic, further interfering with attack identification. Traditional traffic limiting strategies based on traffic thresholds can easily affect normal business activities, and solutions relying on text semantic analysis suffer from high processing latency and cannot defend against neutral rhetoric spoofing attacks. Existing technologies also require separate threshold calibration for live streaming rooms of different volumes, which is difficult to implement in engineering. Ultimately, this makes it difficult for live streaming platforms to distinguish between natural popularity and malicious script attacks, leading to the mistaken blocking of normal traffic or the failure to identify abnormal traffic as spoofing attacks. Summary of the Invention

[0003] To address the technical problem that existing early warning methods struggle to distinguish between natural traffic flow and malicious script attacks, leading to the mistaken blocking of legitimate traffic or the underestimation of abnormal traffic as spoofed attacks, this invention aims to provide a social media sentiment analysis and early warning method and system based on multi-dimensional data. The specific technical solution adopted is as follows: In a first aspect, the present invention provides a social media sentiment analysis and early warning method based on multi-dimensional data, including: Obtain the audio signal amplitude and social interaction request volume at each moment within the preset monitoring period prior to the current moment; Based on the audio signal amplitude and social interaction request volume at each moment, the volume interaction conversion at each moment is analyzed. Combined with the attenuation characteristics of the audio signal amplitude at historical moments in the time neighborhood of each moment, the predicted sound source contribution at each moment is obtained. Based on the differences between the number of social interaction requests and the predicted sound source contribution at each moment within the preset monitoring period, as well as the information distribution of these differences, the abnormal synchronization index at the current moment is obtained. Based on the abnormal synchronization index at the current moment, determine whether verification is triggered and obtain the social media sentiment monitoring results at the current moment.

[0004] Preferably, the step of analyzing the volume interaction conversion at each moment based on the audio signal amplitude and social interaction request volume, and combining the attenuation characteristics of the audio signal amplitude at historical moments within the time neighborhood of each moment to obtain the predicted sound source contribution at each moment, specifically includes: Initialize the volume interaction conversion coefficient. Based on the audio signal amplitude, social interaction request volume, and volume interaction conversion coefficient at each moment, iteratively update the volume interaction conversion coefficient for the next adjacent moment to obtain the volume interaction conversion coefficient at each moment. Based on the time interval between each moment and each historical moment in the time neighborhood, the audio signal amplitude at each historical moment is weighted and summed to obtain the historical audio feature value at each moment. Based on the volume interaction conversion coefficient and historical audio feature values ​​at each moment, the predicted sound source contribution at each moment is determined.

[0005] Preferably, the method for obtaining the volume interaction conversion coefficient at each moment is as follows: Initialize the volume interaction conversion coefficient. When the audio signal amplitude at the target time is greater than the preset amplitude threshold, the ratio of the number of social operation requests at the target time to the audio signal amplitude is used as the first feature term, and the volume interaction conversion coefficient at the reference time is used as the second feature term. The first feature term and the second feature term are weighted and summed using the corresponding preset weights to obtain the volume interaction conversion coefficient at the target time. The target time is any time, and the reference time is the time immediately preceding the target time; the preset weight corresponding to the second feature term is greater than the preset weight corresponding to the first feature term; When the amplitude of the audio signal at the target time is less than or equal to the preset amplitude threshold, the volume interaction conversion coefficient at the reference time is used as the volume interaction conversion coefficient at the target time.

[0006] Preferably, the step of weighted summing of the audio signal amplitude at each historical moment based on the time interval between each moment and each historical moment in the time neighborhood to obtain the historical audio feature value at each moment specifically includes: Obtain the time interval between each historical time and the target time within the time neighborhood of the target time, and use the proportion of the time decay function value of each historical time interval corresponding to the target time as the time decay weight of each historical time corresponding to the target time. Using the time decay weight, the audio signal amplitude of each historical moment corresponding to the target moment is weighted and summed to obtain the historical audio feature value of the target moment.

[0007] Preferably, the step of obtaining the abnormal synchronization index at the current moment based on the differences between the number of social interaction requests and the predicted sound source contribution at each moment within a preset monitoring period, and the information distribution of these differences, specifically includes: Within a preset monitoring period, the non-audio residual amount at each moment is determined based on the difference between the number of social interaction requests and the predicted sound source contribution at each moment. The sample entropy of the non-audio residuals at all times within the preset monitoring period is obtained as the traffic flow time-series status value at the current time. The baseline request volume for the current moment is obtained based on the social operation request volume at each moment of the preset monitoring period; Based on the non-audio residual and baseline request volume at each moment within the preset monitoring period, and combined with the traffic timing status value at the current moment, the abnormal synchronization index at the current moment is obtained.

[0008] Preferably, obtaining the baseline request volume for the current moment based on the social interaction request volume at each moment of a preset monitoring period specifically includes: The average number of social interaction requests at all times within the preset monitoring period is used as the baseline request volume for the current time.

[0009] Preferably, the step of obtaining the abnormal synchronization index at the current moment based on the non-audio residual amount and the baseline request amount at each moment within the preset monitoring period, combined with the traffic timing status value at the current moment, specifically includes: The relative flow intensity at the current moment is determined by the ratio of the mean of the non-audio residuals at all times within the preset monitoring period to the baseline request quantity. The abnormal synchronization index at the current moment is obtained based on the relative flow intensity and the flow time sequence status value at the current moment. The relative flow intensity and the abnormal synchronization index are positively correlated, while the flow time sequence status value and the abnormal synchronization index are negatively correlated.

[0010] Preferably, the step of determining whether to trigger verification based on the abnormal synchronization index at the current moment, and obtaining the social media sentiment monitoring result at the current moment, specifically includes: Based on the difference between the current abnormal synchronization index and the preset abnormal threshold, the current verification code trigger probability is determined, and the difference is positively correlated with the verification code trigger probability. If the probability of triggering the verification code at the current moment is less than or equal to the preset trigger threshold, then no verification will be performed; If the probability of triggering the verification code at the current moment is greater than the preset trigger threshold, then verification will be performed.

[0011] Preferably, the number of social operation requests is the total number of all social operation requests at the same time.

[0012] Secondly, the present invention provides a social media public opinion analysis and early warning system based on multi-dimensional data, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the computer program is executed by the processor, it implements the steps of a social media public opinion analysis and early warning method based on multi-dimensional data.

[0013] The embodiments of the present invention have at least the following beneficial effects: This invention first acquires the audio signal amplitude (reflecting the intensity of the broadcaster's voice commands) and the number of social operation requests (reflecting the user's interaction intensity) at each moment within a preset monitoring period, thereby achieving synchronous collection and time-series alignment of heterogeneous data. This provides complete and aligned basic data support for subsequent analysis of the correlation between audio and traffic, and for removing interference from compliant traffic, thus avoiding subsequent calculation distortion caused by data misalignment.

[0014] Then, by analyzing the real-time volume interaction conversion efficiency, the system adaptively matches the popularity differences of different live streaming rooms. Combined with the decay characteristics of historical audio (simulating the pattern of user attention waning), the system quantifies the compliant traffic triggered by audio commands at each moment, successfully removing this part of the synchronous traffic interference. This allows subsequent analysis to focus on visually stimulated traffic and potential script attack traffic, significantly improving the signal-to-noise ratio of risk identification. Furthermore, by calculating the difference between the amount of social operation requests and the predicted contribution of sound sources, the system focuses on non-audio-related traffic. Then, by analyzing the information distribution of this difference and quantifying its micro-order, an abnormal synchronization index with both universality and sensitivity is finally generated.

[0015] Finally, the abnormal synchronization index is used to determine whether verification is triggered, transforming the risk index into a monitoring result that balances defense effectiveness and user experience. This effectively defends against collaborative script attacks while avoiding collateral damage to normal business activities, ensuring a balance between public opinion security and user experience in live streaming scenarios. Attached Figure Description

[0016] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart illustrating the steps of a social media sentiment analysis and early warning method based on multi-dimensional data provided by the present invention. Figure 2 This is a structural block diagram of a social media public opinion analysis and early warning system based on multi-dimensional data provided by the present invention. Detailed Implementation

[0018] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of a social media public opinion analysis and early warning method and system based on multi-dimensional data proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0019] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0020] The following description, in conjunction with the accompanying drawings, details the specific scheme of a social media public opinion analysis and early warning method and system based on multi-dimensional data provided by this invention.

[0021] Please see Figure 1 The diagram illustrates a flowchart of a social media sentiment analysis and early warning method based on multi-dimensional data, according to an embodiment of the present invention. The method includes the following steps: Step S100: Obtain the audio signal amplitude and social interaction request volume for each moment within the preset monitoring period prior to the current moment.

[0022] First, to synchronously analyze continuous live stream data and discrete user interaction events, a unified discrete time axis is established in this embodiment. The time interval between any two adjacent moments is equal, set to 100 milliseconds. This embodiment obtains a preset monitoring period of moderate length before the current moment to provide a time basis for subsequent analysis of historical data, reflecting long-term trends or providing a benchmark reference. In this embodiment, the preset monitoring period is set to 200 moments, or 20 seconds. In other embodiments, implementers can set this according to the specific implementation scenario.

[0023] Then, the root mean square amplitude of all audio signals within a time interval is obtained as the audio signal amplitude at a given moment. As a concrete example, the root mean square amplitude of all audio signals within the time interval between moment t-1 and moment t is taken as the audio signal amplitude at moment t. It should be understood that the audio signal refers to the audio data collected in real-time within the live broadcast room.

[0024] It should be noted that in live interactive scenarios, user interactions are often directly triggered by the host's voice commands (such as shouting) or background sound effects (such as rousing background music). To comprehensively and accurately capture the true intensity of such acoustic stimuli, other embodiments may employ a composite quantization strategy that combines incremental and absolute features. That is, a single incremental feature will fail in scenarios with continuous high volume (such as continuous shouting). To compensate for this deficiency, other embodiments use the composite audio feature as the amplitude of the audio signal at a given moment.

[0025] As a concrete example, the method for obtaining composite audio features can be expressed by the formula: ; in, This represents the composite audio feature quantity at time t within a preset monitoring period. This represents the root mean square amplitude of all audio signals at time t. This represents the root mean square amplitude of all audio signals at time t-1. The incremental weighting coefficient is set to 0.8 in this embodiment to highlight the incentive effect of sudden instructions; The absolute weighting coefficient, set to 0.2 in this embodiment, is used to compensate for the basic excitation value under continuous high-energy environments, and is initialized. The calculated composite audio feature is a non-negative value, comprehensively reflecting the intensity of the acoustic excitation injected into the live broadcast room at time t.

[0026] Furthermore, to meet real-time processing requirements, such as avoiding extra time consumption and slowing down response speed due to parsing request text payloads, the system specifically listens for downlink message interfaces at the server gateway layer (such as the Nginx layer or API gateway) to capture every interactive request containing instructions for bullet comments, comments, likes, or gift sending. During this process, the system does not parse the text content of the request, but only extracts the arrival timestamp in the request header, thereby maximizing the compression of data processing time and ensuring real-time detection capabilities.

[0027] Specifically, the total number of all interaction requests within a time interval is taken as the social operation request count at a given moment. More specifically, the total number of all interaction requests within the time interval between moment t-1 and moment t is taken as the social operation request count at moment t.

[0028] At this point, each time point can obtain the audio signal amplitude and the number of social interaction requests for each time point within the preset monitoring period prior to the current time point.

[0029] In other embodiments, the audio signal amplitude and social interaction request volume at each moment can be used to construct a synchronization data vector, which is then stored in a first-in-first-out (FIFO) queue structure for the most recent time period (e.g., 60 seconds). Only after the audio processing and traffic statistics at each moment are completed is the synchronization data vector pushed into the queue and marked as "valid" for subsequent modules to read. This mechanism ensures that in subsequent correlation analysis, each traffic data point has a definite, time-aligned acoustic excitation data point corresponding to it, thus providing a rigorous temporal reference for causal inference.

[0030] Step S200: Based on the audio signal amplitude and social interaction request volume at each moment, analyze the volume interaction conversion at each moment, and combine the attenuation characteristics of the audio signal amplitude at historical moments in the time neighborhood of each moment to obtain the predicted sound source contribution at each moment.

[0031] The main purpose of this step is to accurately decouple the relationship between audio incentives and social operation traffic, quantify the compliant traffic contribution caused by audio, and lay the foundation for subsequent analysis that removes interference and focuses on script attack characteristics.

[0032] In live streaming scenarios, audio signals such as the host's voice commands (e.g., countdowns, shouts) can trigger synchronous user interaction. The temporal synchronicity of this type of compliant traffic can easily be confused with script attack traffic, leading to misjudgments by traditional detection methods. Furthermore, users' responses to audio have inherent delay characteristics and attention decay patterns, and are not solely determined by the audio at the current moment; a comprehensive evaluation must be made in conjunction with the attenuation effect of historical audio.

[0033] Therefore, this step requires building a predictive model through a progressive logical process. First, based on the audio signal amplitude at each moment and the corresponding social interaction request volume, the real-time volume interaction conversion efficiency is analyzed, and the differences in the popularity base of different live streaming rooms are adaptively matched. Then, using the audio signal amplitude at historical moments in the time neighborhood, combined with the decay characteristics of user responses (such as the gradual decline of attention over time), the cumulative impact of historical audio is dynamically weighted and integrated. Finally, the predicted sound source contribution caused by audio stimulation at each moment is obtained, which can accurately characterize the traffic associated with compliant audio, and provide a reliable basis for subsequent removal of this part of the traffic and highlighting potential abnormal traffic.

[0034] Therefore, the method for obtaining the predicted sound source contribution at each moment can be implemented by steps S201 to S203.

[0035] Step S201: Initialize the volume interaction conversion coefficient. Based on the audio signal amplitude and social operation request volume at each moment, as well as the volume interaction conversion coefficient, iteratively update the volume interaction conversion coefficient for the next adjacent moment to obtain the volume interaction conversion coefficient for each moment.

[0036] The volume interaction conversion coefficient characterizes the dynamic conversion efficiency from audio stimulus to user interaction traffic. More specifically, it represents the number of user interaction requests that a unit intensity of audio stimulus (i.e., audio signal amplitude) can trigger in the current live streaming scenario. Essentially, it acts as a bridge connecting acoustic stimulus signals and compliant interaction traffic, with its core function being to adapt to differences in the popularity and interactive atmosphere of different live streaming rooms. For example, a unit audio stimulus in a popular live streaming room with tens of thousands of viewers may trigger more interactions, while the conversion efficiency in a niche live streaming room with only a few hundred viewers is lower. The volume interaction conversion coefficient automatically adjusts this conversion relationship through real-time learning, providing accurate quantitative basis for predicting compliant traffic stimulated by audio in the future.

[0037] To avoid random noise (such as sporadic comments) during quiet or low-volume periods interfering with the stability of the conversion efficiency, the volume interaction conversion coefficient is updated only when certain threshold conditions are met. Specifically, this embodiment uses any moment within a preset monitoring period as an example. That is, any moment is recorded as the target moment, and the moment immediately preceding the target moment is recorded as the reference moment.

[0038] More specifically, the volume interaction conversion coefficient is initialized. When the audio signal amplitude at the target time is greater than a preset amplitude threshold, the ratio of the number of social interaction requests at the target time to the audio signal amplitude is used as the first feature term, and the volume interaction conversion coefficient at the reference time is used as the second feature term. The first and second feature terms are weighted and summed using corresponding preset weights to obtain the volume interaction conversion coefficient at the target time. Here, the target time is any time, and the reference time is the time immediately preceding the target time. The preset weight corresponding to the second feature term is greater than the preset weight corresponding to the first feature term. When the amplitude of the audio signal at the target time is less than or equal to the preset amplitude threshold, the volume interaction conversion coefficient at the reference time is used as the volume interaction conversion coefficient at the target time.

[0039] As a concrete example, taking time t as the target time and time t-1 as the reference time, the method for obtaining the volume interaction conversion coefficient at the target time can be expressed by the formula: ; in, This represents the volume interaction conversion coefficient at the target time, where t represents the t-th time within the preset monitoring period of the current time. This represents the volume interaction conversion coefficient at the reference time. This represents the number of social interaction requests at the target time. This represents the amplitude of the audio signal at the target time. The preset forgetting factor is set to 0.99 in this embodiment. The selection of this parameter can adapt to the long-term trend of the popularity of the live broadcast room, and also smooth the random fluctuations of a single interaction. This represents a preset amplitude threshold, which in this embodiment is 1.5 times the background noise of the audio signal, for example, 0.02.

[0040] It should be noted that in this embodiment, the 5th percentile value of the audio signal amplitude within the long-period sliding window before time t is used as the estimated value of the audio signal noise floor at time t. This value dynamically reflects the intensity of the ambient background noise. The length of the long-period sliding window is set to 300 time points, which is 30 seconds.

[0041] The first feature term reflects the instantaneous conversion efficiency at the target time, which is the amount of interaction corresponding to the audio stimulus at the target time. As the second feature term, the preset forgetting factor is used. The weight corresponding to the second feature term represents a greater preservation of historical conversion efficiency, smoothing out random fluctuations in short-term interactions (such as delayed responses from individual users), and ensuring... It will not fluctuate drastically due to a single traffic surge, but will adapt to the long-term trend of live stream popularity.

[0042] It should be understood that, since there is no historical data to refer to at the initial moment, this parameter is initialized to a value of 1. That is, at the moment of starting to monitor the public opinion status of social media in real time, the volume interaction conversion coefficient at that moment is initialized to a value of 1. Then, based on the above-mentioned threshold condition update strategy, the volume interaction conversion coefficient at the second moment is obtained, and so on, continuously monitoring and calculating and updating the volume interaction conversion coefficient. It can be updated when there is effective audio stimulus, eliminating meaningless fluctuations during silent periods, and ensuring that the calculation of conversion efficiency is based on the real causal relationship between audio and interaction.

[0043] Step S202: Based on the time interval between each time moment and each historical time moment in the time neighborhood, the audio signal amplitude of each historical time moment is weighted and summed to obtain the historical audio feature value of each time moment.

[0044] It should be noted that setting a time neighborhood is to capture the delayed response characteristics of users to sound stimuli. Each moment and the time window of a preset length before it are used as the time neighborhood of that moment. The preset length can be 30 moments, which is a 3-second acoustic memory window, which is sufficient to cover the neural response delay range of most users.

[0045] Specifically, the time interval between each historical moment and the target moment is obtained within the time neighborhood of the target moment, and the proportion of the time decay function value of each historical moment corresponding to the target moment is used as the time decay weight of each historical moment corresponding to the target moment. Using the time decay weight, the audio signal amplitude of each historical moment corresponding to the target moment is weighted and summed to obtain the historical audio feature value of the target moment.

[0046] As a concrete example, the scheme for obtaining historical audio feature values ​​at a target time can be expressed by the formula: ; in, This represents the historical audio feature value at the target time. This represents the number of historical moments contained within the time neighborhood of the target moment. This represents the amplitude of the audio signal at the k-th historical moment within the time neighborhood of the target moment. This represents the time interval between the k-th historical moment in the time neighborhood of the target moment and the target moment. This represents a preset memory decay rate constant. In this embodiment, The value is 0.3, an empirical value derived from large-scale live streaming data statistics, reflecting the average response decay characteristics of users to short-term commands; e is a natural constant. This represents the value of the time decay function. It represents the sum of the time decay function values ​​of historical times contained within the time neighborhood of the target time.

[0047] As k increases, the audio stimulus is further away from the target time. As the frequency and weight of audio stimuli decrease exponentially, user attention to past audio commands gradually diminishes. By using a time decay function, the system simulates user behavior characteristics where audio stimuli from closer time intervals have a greater impact, while those from farther time intervals have a smaller impact, thus avoiding misjudging outdated audio stimuli as traffic triggers for the target time.

[0048] Step S203: Based on the volume interaction conversion coefficient and historical audio feature values ​​at each moment, determine the predicted sound source contribution at each moment.

[0049] Specifically, the product of the volume interaction conversion coefficient at each moment and the historical audio feature value is used as the predicted sound source contribution at each moment. The predicted sound source contribution quantifies the amount of compliant interaction that should theoretically be triggered by sound stimuli in the temporal neighborhood at each moment. For example, when the anchor shouts "3, 2, 1" in a countdown, the model can accurately predict the subsequent traffic pulse.

[0050] Historical audio feature values ​​characterize the intensity of historical audio stimuli, reflecting the overall impact of audio on users. The volume interaction conversion coefficient characterizes the conversion efficiency from audio stimuli to interaction traffic. By multiplying these values, the stimuli intensity is converted into specific interaction traffic values. The final output is the theoretical total number of compliant interaction requests triggered by audio stimuli in the past 3 seconds (time neighborhood), matching normal traffic pulses in scenarios such as broadcasters shouting and countdowns. The predicted sound source contribution at each moment characterizes the predicted result of compliant interaction traffic triggered by audio stimuli, laying the foundation for subsequent filtering of this traffic and extraction of abnormal residuals.

[0051] It should be noted that when the time neighborhood length at a certain moment is insufficient, the predicted sound source contribution values ​​for that moment and previous moments are directly set to zero. When the time neighborhood length at a certain moment meets the above-mentioned set length, the predicted sound source contribution value for the corresponding moment is obtained according to the method in step S200.

[0052] Step S300: Based on the differences between the number of social operation requests and the predicted sound source contribution at each moment within the preset monitoring period, and the information distribution of these differences, the abnormal synchronization index at the current moment is obtained.

[0053] The main purpose of this step is to construct a nonlinear judgment index that accurately distinguishes between natural popularity and script attacks. By quantifying the residual characteristics and micro-temporal distribution patterns after audio compliance traffic stripping, it enables real-time identification of collaborative script attacks, providing a scientific basis for subsequent graded defense.

[0054] In live streaming scenarios, after filtering out compliant traffic triggered by audio, the remaining traffic includes natural traffic triggered by visual cues and potential script attack traffic. The two may be highly similar in terms of macro request volume, but their micro-order characteristics are fundamentally different: natural traffic is affected by individual reaction time and network jitter, exhibiting a high-entropy random distribution; script traffic is controlled by a unified clock, exhibiting a low-entropy synchronous characteristic.

[0055] Therefore, this step requires constructing an index through a progressive logical process. First, based on the difference between the number of social interaction requests and the predicted contribution of the sound source at each moment, the residual sequence (the core analysis object) after removing audio influence is extracted. Next, the information distribution (sample entropy) of this residual sequence is analyzed to quantify its microscopic orderliness; the lower the entropy value, the stronger the synchronicity and the greater the suspicion of an attack. Finally, dynamic normalization is used to eliminate dimensional differences, and the residual intensity (the traffic multiple relative to the historical benchmark) is non-linearly fused with the entropy value to construct an abnormal synchronization index. This allows the large volume and low entropy characteristics of script attacks to resonate, resulting in a significant jump in the index, while the large volume and high entropy characteristics of natural traffic are automatically suppressed. This ensures that the index possesses universality, sensitivity, and resistance to false alarms, providing core quantitative support for accurately identifying disguised attacks and avoiding unintended harm to normal business activities.

[0056] Therefore, the method for obtaining the abnormal synchronization index at the current moment can be implemented by steps S301 to S304.

[0057] Step S301: Within a preset monitoring period, determine the non-audio residual amount at each moment based on the difference between the number of social operation requests and the predicted sound source contribution at each moment.

[0058] As a concrete example, the difference between the number of social interaction requests and the predicted sound source contribution at each time step is used as the non-audio residual at each time step. It should be understood that when the difference between the number of social interaction requests and the predicted sound source contribution at each time step is less than 0, the remaining traffic component cannot have a negative value, so the value of the non-audio residual at this time is directly set to 0.

[0059] In other embodiments, considering the potential presence of background noise, the difference between the number of social interaction requests and the predicted sound source contribution at each time step is first calculated. This difference is then subtracted from the difference in audio signal noise at each time step to obtain the non-audio residual for each time step. For the same reason, the remaining traffic component cannot have a negative value. If the difference calculation result is less than 0, the value of the non-audio residual is directly set to 0.

[0060] The non-audio residual at each time step represents the remaining traffic components after filtering out audio effects, mainly including visually stimulated traffic (such as product displays) and potential script attack traffic.

[0061] Step S302: Obtain the baseline request volume for the current moment based on the social operation request volume at each moment of the preset monitoring period.

[0062] Specifically, to achieve universal monitoring across live streaming rooms of different scales, the system analyzes the baseline operation request volume over a longer historical maintenance period to determine the current moment. As a concrete example, the average social operation request volume across all moments within a preset monitoring period is used as the baseline request volume for the current moment.

[0063] In other embodiments, the average of the number of social operation requests in all moments within the three preset monitoring periods (i.e., 600 moments, 60 seconds) prior to the current moment can be used as the baseline request volume for the current moment.

[0064] The baseline request volume reflects the average popularity level of the live stream at the current moment and will be used as the denominator in subsequent normalization calculations to eliminate the dimensional influence of absolute traffic values. If the baseline request volume is less than 1, it will be forcibly set to 1 to avoid division by zero anomalies.

[0065] Meanwhile, to avoid invalid feature analysis under extremely low traffic (quiet period), 10% of the current baseline request volume is used as the traffic verification threshold. If the non-audio residual amount at a certain moment is less than the traffic verification threshold, the current moment is considered to be a safe quiet period, and the non-audio residual amount at that moment is directly set to zero or marked as invalid. Invalid moments do not participate in the subsequent entropy calculation process. This logic effectively prevents the risk of false alarms caused by too small a traffic base.

[0066] Step S303: Obtain the sample entropy of the non-audio residuals at all times within the preset monitoring period as the traffic flow time-series status value at the current time.

[0067] To quantify the microscopic orderliness of the non-audio residuals, the system calculates the sample entropy of the non-audio residuals at all times within a preset monitoring period. The method for calculating sample entropy is a well-known technique and will only be briefly introduced here. The embedding dimension is set to m=2, dividing the residual sequence into continuous m-dimensional vectors (e.g., ...). , Let be the non-audio residual at time t. The non-audio residual at time t+1 is used to statistically analyze the local similarity of the sequence. The similarity tolerance r is 0.2 times the standard deviation of the non-audio residual at all times within the preset monitoring period. The similarity tolerance r refers to the distance threshold for judging whether two m-dimensional vectors are similar. It should be noted that if the standard deviation of the non-audio residual at all times within the preset monitoring period is 0, the value of the direct flow time series status value is set to a safe high value, such as 2, and no subsequent entropy calculation is required, indicating that the data is stable at this time.

[0068] Among the non-audio residuals at all times within the preset monitoring period, those that satisfy the condition of distance being less than the similarity tolerance are counted. of The number of vector pairs in dimension, denoted as ; Statistics on those that meet the conditions The number of vector pairs in dimension, denoted as .

[0069] To prevent complete sequence matching ( This results in an entropy value of zero, or due to a lack of matching ( This leads to computational crashes; this embodiment introduces extremely small positive numbers. (Values) () is used as a smoothing factor in the calculation. Corrected sample entropy That is, the formula for calculating the current flow time-series state value is: .

[0070] If the temporal regularity of non-audio residuals at all times within the preset monitoring period is strong (such as the synchronization requests of script traffic), then m-dimensional similar vector pairs will still be highly likely to be similar after adding one dimension, i.e. and The ratio is close to 1; if the non-audio residuals at all times within the preset monitoring period are random (such as natural flow), then m-dimensional similar vector pairs are likely to become dissimilar after adding one dimension, i.e. much smaller The ratio approaches 0.

[0071] The quantification process of the current traffic time-series status value transforms the similarity vector ratio into an entropy value through the natural logarithm. The closer the ratio is to 1, the stronger the time-series regularity of the non-audio residuals at all times within the preset monitoring period, the closer the logarithm result is to 0, and the lower the entropy value. The closer the ratio is to 0, the more random the time-series regularity of the non-audio residuals at all times within the preset monitoring period, the more negative the logarithm result, and the higher the entropy value.

[0072] It should be noted that although network jitter of tens of milliseconds exists in public network transmission, the time interval between two adjacent moments and the preset monitoring period in this embodiment focus on the orderliness of the packet shape of traffic on the macroscopic time axis, rather than the microsecond-level packet arrival interval. Network jitter increases the randomness of natural traffic (increasing sample entropy), while for high-concurrency script attacks, even with network jitter, the sequence of "requests per unit time" will still retain periodic or bursty characteristics (low entropy). Therefore, network jitter actually enhances the system's ability to distinguish between natural traffic (high entropy) and script traffic (low entropy).

[0073] The current traffic time-series status value is a micro-temporal randomness or order quantification indicator of the non-audio residual quantity after filtering out audio-triggered compliant traffic. It focuses on residual traffic, that is, the time-series distribution of requests arriving between visually-triggered compliant traffic and potential script attack traffic on a millisecond time scale. It does not focus on the absolute value of traffic, but only measures the degree of disorder or synchronization of non-audio residual quantity.

[0074] Step S304: Based on the non-audio residual amount and baseline request amount at each moment within the preset monitoring period, and combined with the traffic timing status value at the current moment, obtain the abnormal synchronization index at the current moment.

[0075] Specifically, the relative flow intensity at the current moment is determined based on the ratio of the mean of the non-audio residuals at all times within the preset monitoring period to the baseline request quantity; the abnormal synchronization index at the current moment is obtained based on the relative flow intensity at the current moment and the flow time series status value at the current moment. The relative flow intensity and the abnormal synchronization index are positively correlated, and the flow time series status value and the abnormal synchronization index are negatively correlated.

[0076] As a concrete example, the method for obtaining the abnormal synchronization index at the current moment can be expressed by the formula: ; in, This indicates the anomalous synchronization index at the current moment. This indicates the total number of times within the preset monitoring period. This represents the non-audio residual at time i within the preset monitoring period. This represents the baseline request volume at the current moment. This represents the current traffic timing status value.

[0077] This is a preset capacity constant (100 in this embodiment). It is used to stabilize the fractional value during cold starts or periods of extremely low flow, avoiding a relative intensity explosion due to an excessively low reference flow. This is a preset cutoff constant (0.1 in this embodiment). It is used to prevent the denominator from being zero and to set the upper limit of the exponent's saturation. The preset sensitivity amplification index (2.0 in this embodiment) is used to nonlinearly amplify the influence of low-entropy characteristics.

[0078] The relative traffic intensity is calculated by dividing by the baseline request volume. The numerator is converted into a multiple of the current traffic relative to the historical average. Regardless of whether the base number of viewers in the live stream is hundreds or millions, this multiple usually fluctuates within a reasonable range (such as 0~20), making the subsequent threshold setting universal; that is, the short-term surge in residual traffic is converted into a dimensionless indicator that is universal across live streams, avoiding dimensional confusion caused by differences in the base number of viewers in the live streams.

[0079] This represents the micro-temporal synchronicity of the quantized residual flow and amplifies the low-entropy characteristics of script attacks through nonlinear processing, while avoiding computational anomalies. Furthermore, by using squaring operations, the gap between the script's low entropy and the natural high entropy is widened.

[0080] Although the relative flow intensity (numerator) increases, the exponent remains low due to the high entropy of natural flow (large denominator). A sharp increase in relative flow intensity (large numerator) and extremely low entropy due to synchronicity (denominator close to 1) further exacerbates the situation. The two factors resonate, causing a significant jump in the index. That is, random jitter in public network transmission increases the randomness of natural traffic (increases the traffic temporal state value, increases the denominator), further reducing the natural traffic index; while script traffic, even with added jitter, retains low-entropy characteristics in its non-audio residual quantity of requests per unit time (the traffic temporal state value remains small), and its contribution to the denominator remains limited. This characteristic means that network jitter not only does not interfere with the index, but also enhances the distinction between script attacks and natural traffic.

[0081] The core function of the current moment's abnormal synchronization index is to nonlinearly fuse the relative scale of residual flow with the micro-temporal order, thereby achieving accurate differentiation between natural visual heat and collaborative script attacks.

[0082] In other embodiments, after the abnormal synchronization index is calculated, a threshold condition can be set to filter out false risk signals caused by an insufficient traffic base, ensuring that subsequent warning operations are only performed when the traffic has statistically significant abnormal characteristics, thereby avoiding false alarms during the silent period from the root.

[0083] Specifically, if the sum of non-audio residuals in the current time neighborhood is less than 10% of the current baseline request volume, it indicates that the current period is a traffic quiet period or a period of slight fluctuation. The low entropy at this time may be due to artifacts caused by data sparsity. Therefore, the value of the abnormal synchronization index at the current time is set to 0 to prevent misjudgment of the quiet period.

[0084] Step S400: Based on the abnormal synchronization index at the current moment, determine whether verification is triggered and obtain the social media sentiment monitoring results at the current moment.

[0085] The main purpose of this step is to transform the quantified risk index into precise and flexible defensive actions. By dynamically matching and verifying the strength and risk level, it can accurately intercept collaborative script attacks while ensuring a seamless interactive experience for compliant users. Ultimately, it outputs social media sentiment monitoring results that combine defensive effectiveness with a good user experience.

[0086] In live streaming scenarios, the abnormal synchronization index clearly distinguishes between two types of traffic: natural traffic and script attacks. However, directly blocking all traffic at once would inadvertently harm legitimate users, while allowing it completely would fail to defend against attacks. Therefore, this step needs to achieve a risk closed loop through a progressive logic. First, based on the abnormal synchronization index, a non-linear mapping model is used to convert risk into a dynamic verification trigger probability. When the index is below a threshold, the verification probability approaches 0, ensuring that compliant users can pass without noticing. When the index is above the threshold, the verification probability surges with the risk, quickly switching to high-intensity defense. Then, precise interception is achieved through request-level random sampling and graphical CAPTCHA execution. Taking advantage of the inability of script programs to parse complex graphical interactions, machine traffic is completely blocked, while legitimate users can continue to interact through verification. Finally, a structured situation log containing the risk index and verification results is retained, providing data support for subsequent public opinion tracing and defense strategy optimization. This process achieves a closed loop of risk quantification → dynamic defense → precise interception → situation retention, solving the problems of false positives or missed detections in traditional defenses while also taking into account the real-time nature and user experience of live streaming scenarios, providing a feasible implementation solution for social media public opinion security.

[0087] First, this embodiment sets the anomaly threshold to 5. Specifically, based on a large amount of statistical data, the anomaly synchronization index during a natural traffic surge is usually less than 2.0, while the anomaly synchronization index during a coordinated attack often exceeds 10.0. Therefore, this embodiment sets 5.0 as the risk threshold.

[0088] Then, based on the difference between the abnormal synchronization index at the current moment and the preset abnormal threshold, the probability of triggering the verification code at the current moment is determined, and the difference is positively correlated with the probability of triggering the verification code.

[0089] As a concrete example, the method for obtaining the probability of a CAPTCHA being triggered at the current moment can be expressed by the formula: ; in, This indicates the probability of triggering the CAPTCHA at the current moment. This indicates the anomalous synchronization index at the current moment. This indicates the preset abnormal threshold. This represents an exponential function with the natural constant e as its base. This represents the preset response slope coefficient (1.0 in this embodiment), used to control the steepness of the increase in interception probability with the risk index, and to control... Follow The steepness of the change, the slope The larger the slope, the faster the trigger probability increases with the risk index; The smaller the size, the slower the growth.

[0090] The calculation method for the current CAPTCHA trigger probability is based on the Sigmoid function (logistic regression function), with the core being the precise definition of the risk threshold and the control of the pace of defense strength increase. Under the mapping relationship of the above formula, when the live stream is in a normal state or experiences a natural surge in popularity, The probability of triggering the CAPTCHA is close to 0, ensuring a seamless experience for compliant users. When script attack characteristics are detected, The probability of triggering the verification code quickly saturates to 1.0, automatically switching to a high-intensity defense state.

[0091] By leveraging the saturation characteristics of the S-curve, the interception probability is ensured to be close to 100% during high-intensity attacks, making it impossible for script traffic to bypass. Simultaneously, the interception probability approaches 0 in low-risk scenarios, avoiding false positives on legitimate users. Even in medium-to-high-risk scenarios (e.g., P=0.73), naturally occurring users, after being sampled and intercepted, can still complete the interaction via the CAPTCHA (without perceptible loss), while script programs are precisely eliminated because they cannot parse dynamic CAPTCHAs. This combination of probabilistic sampling and Turing-based weighting provides precise defense based on human-machine differences, rather than indiscriminate rate limiting.

[0092] Furthermore, the application layer gateway performs real-time filtering on each newly arriving interaction request. This step leverages the inability of scripts to handle complex graphical interactions by implementing physical blocking.

[0093] Specifically, if the probability of triggering the verification code at the current moment is less than or equal to the preset trigger threshold, no verification will be performed; if the probability of triggering the verification code at the current moment is greater than the preset trigger threshold, verification will be performed.

[0094] As a concrete example, for each independent interaction request arriving at the current moment, a corresponding trigger threshold Y is generated in real time to ensure that the sampling results of each request are independent and unrelated. The trigger threshold is a random sampled value that follows a uniform distribution in the range [0,1]. That is, the trigger threshold value is uniformly distributed between 0 and 1, meaning that any value within the interval has an equal probability of being selected. The purpose of generating a random trigger threshold for each interaction request is to avoid a one-size-fits-all interception strategy through random sampling. Naturally, even if a user is selected, they can still complete the interaction through the image verification code; while the script program cannot parse the verification code, and its request will be accurately intercepted, thus ensuring both the defense effect and the compliance and user experience.

[0095] like If the request is deemed not to require verification, it is directly allowed to proceed to the backend business server. The system determines that the request has triggered the blocking policy and sends a CAPTCHA challenge to the client. It should be understood that this triggers a threshold. It is a random sample value generated for a single interaction request, which follows a uniform distribution of [0,1] and is used to simulate unbiased request filtering.

[0096] Under this mechanism, even when the probability of triggering a CAPTCHA is high, naturally selected users can still pass the verification and complete the interaction based on their cognitive abilities; while script attack programs, unable to parse dynamic graphic CAPTCHAs, will have their requests dropped or suspended by the gateway, thus achieving precise removal of machine traffic.

[0097] In other embodiments, to achieve traceability and visualization of public opinion risks, the defense status can be monitored in real time while executing the interception logic. When the probability of triggering the verification code exceeds a preset warning level (e.g., 0.8), the system automatically triggers a log recording action.

[0098] Key intermediate variables at the current moment are packaged and written into a structured early warning log. Log fields include, but are not limited to: Timestamp: the specific moment the risk occurred; Baseline Request Volume: reflecting the initial popularity of the live stream; Relative Traffic Intensity: reflecting the multiple of the traffic surge; Traffic Time-Sequence Status Value: reflecting the orderliness of the traffic's micro-time sequence (i.e., the confidence level of the attack characteristics); Anomaly Synchronization Index: a comprehensive risk score. This log intuitively reveals the essence of the current traffic anomaly: not only is it "large in volume" (high relative intensity), but it is also "low in entropy" (low sample entropy). This provides operations personnel with objective data support to distinguish between "compliant viral content" and "malicious attacks," enabling real-time early warning and closed-loop handling of public opinion risks.

[0099] like Figure 2 As shown in the figure, this embodiment of the invention also provides a social media public opinion analysis and early warning system based on multi-dimensional data, including a memory, a processor, and a computer program stored in the memory and running on the processor. When the computer program is executed by the processor, it implements the steps of a social media public opinion analysis and early warning method based on multi-dimensional data. Since an embodiment of a social media public opinion analysis and early warning method based on multi-dimensional data has already been described in detail, it will not be repeated here.

[0100] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. A social media sentiment analysis and early warning method based on multi-dimensional data, characterized in that, The method includes the following steps: Obtain the audio signal amplitude and social interaction request volume at each moment within the preset monitoring period prior to the current moment; Based on the audio signal amplitude and social interaction request volume at each moment, the volume interaction conversion at each moment is analyzed. Combined with the attenuation characteristics of the audio signal amplitude at historical moments in the time neighborhood of each moment, the predicted sound source contribution at each moment is obtained. Based on the differences between the number of social interaction requests and the predicted sound source contribution at each moment within the preset monitoring period, as well as the information distribution of these differences, the abnormal synchronization index at the current moment is obtained. Based on the abnormal synchronization index at the current moment, determine whether verification is triggered and obtain the social media sentiment monitoring results at the current moment; Specifically, the step of analyzing the volume interaction conversion at each moment based on the audio signal amplitude and social interaction request volume, and combining the attenuation characteristics of the audio signal amplitude at historical moments within the time neighborhood of each moment to obtain the predicted sound source contribution at each moment, includes: Initialize the volume interaction conversion coefficient. Based on the audio signal amplitude, social interaction request volume, and volume interaction conversion coefficient at each moment, iteratively update the volume interaction conversion coefficient for the next adjacent moment to obtain the volume interaction conversion coefficient at each moment. Based on the time interval between each moment and each historical moment in the time neighborhood, the audio signal amplitude at each historical moment is weighted and summed to obtain the historical audio feature value at each moment. Based on the volume interaction conversion coefficient and historical audio feature values ​​at each moment, the predicted sound source contribution at each moment is determined. The process of obtaining the abnormal synchronization index at the current moment based on the differences between the number of social interaction requests and the predicted sound source contribution at each moment within a preset monitoring period, and the information distribution of these differences, specifically includes: Within a preset monitoring period, the non-audio residual amount at each moment is determined based on the difference between the number of social interaction requests and the predicted sound source contribution at each moment. The sample entropy of the non-audio residuals at all times within the preset monitoring period is obtained as the traffic flow time-series status value at the current time. The baseline request volume for the current moment is obtained based on the social operation request volume at each moment of the preset monitoring period; Based on the non-audio residual and baseline request volume at each moment within the preset monitoring period, and combined with the traffic timing status value at the current moment, the abnormal synchronization index at the current moment is obtained.

2. The social media sentiment analysis and early warning method based on multi-dimensional data according to claim 1, characterized in that, The method for obtaining the volume interaction conversion coefficient at each moment is as follows: Initialize the volume interaction conversion coefficient. When the audio signal amplitude at the target time is greater than the preset amplitude threshold, the ratio of the number of social operation requests at the target time to the audio signal amplitude is used as the first feature term, and the volume interaction conversion coefficient at the reference time is used as the second feature term. The first feature term and the second feature term are weighted and summed using the corresponding preset weights to obtain the volume interaction conversion coefficient at the target time. The target time is any time, and the reference time is the time immediately preceding the target time; the preset weight corresponding to the second feature term is greater than the preset weight corresponding to the first feature term; When the amplitude of the audio signal at the target time is less than or equal to the preset amplitude threshold, the volume interaction conversion coefficient at the reference time is used as the volume interaction conversion coefficient at the target time.

3. The social media sentiment analysis and early warning method based on multi-dimensional data according to claim 2, characterized in that, The step of weighted summation of the audio signal amplitude at each historical moment based on the time interval between each moment and each historical moment in the time neighborhood to obtain the historical audio feature value at each moment specifically includes: Obtain the time interval between each historical time and the target time within the time neighborhood of the target time, and use the proportion of the time decay function value of each historical time interval corresponding to the target time as the time decay weight of each historical time corresponding to the target time. Using the time decay weight, the audio signal amplitude of each historical moment corresponding to the target moment is weighted and summed to obtain the historical audio feature value of the target moment.

4. The social media sentiment analysis and early warning method based on multi-dimensional data according to claim 1, characterized in that, The step of obtaining the baseline request volume for the current moment based on the social operation request volume at each moment of a preset monitoring period specifically includes: The average number of social interaction requests at all times within the preset monitoring period is used as the baseline request volume for the current time.

5. The social media sentiment analysis and early warning method based on multi-dimensional data according to claim 4, characterized in that, The abnormal synchronization index for the current moment is obtained by combining the non-audio residual amount and the baseline request amount at each moment within the preset monitoring period with the traffic time sequence status value at the current moment, specifically including: The relative flow intensity at the current moment is determined by the ratio of the mean of the non-audio residuals at all times within the preset monitoring period to the baseline request quantity. The abnormal synchronization index at the current moment is obtained based on the relative flow intensity and the flow time sequence status value at the current moment. The relative flow intensity and the abnormal synchronization index are positively correlated, while the flow time sequence status value and the abnormal synchronization index are negatively correlated.

6. The social media sentiment analysis and early warning method based on multi-dimensional data according to claim 1, characterized in that, The process of determining whether to trigger verification based on the current abnormal synchronization index, and obtaining the current social media sentiment monitoring results, specifically includes: Based on the difference between the current abnormal synchronization index and the preset abnormal threshold, the current verification code trigger probability is determined, and the difference is positively correlated with the verification code trigger probability. If the probability of triggering the verification code at the current moment is less than or equal to the preset trigger threshold, then no verification will be performed; If the probability of triggering the verification code at the current moment is greater than the preset trigger threshold, then verification will be performed.

7. The social media sentiment analysis and early warning method based on multi-dimensional data according to claim 1, characterized in that, The number of social operation requests refers to the total number of all social operation requests at the same time.

8. A social media sentiment analysis and early warning system based on multi-dimensional data, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the computer program is executed by the processor, it implements the steps of a social media sentiment analysis and early warning method based on multi-dimensional data as described in any one of claims 1-7.

Images