A GCN-based steganographer discovery method for social networks

Abstract

This invention discloses a GCN-based method for detecting stegchmakers in social networks, addressing the challenge of stegchmaker detection in these networks. First, a social network graph is constructed, with active users and comments designated as nodes, and user replies as directed edges with attributes (interaction frequency, content similarity, and reply time) to analyze social interactions and potential steganographic behavior. A personalized PageRank algorithm is employed, using known stegchmaker nodes as seeds to construct vectors. Weights are adjusted based on edge attributes, and the PageRank value of each node is iteratively calculated to determine the association between the node and the stegchmaker. Simultaneously, GCN is utilized to capture syntactic and semantic connections between words, and features are processed using ResNet to fuse local and global information, optimizing the understanding and processing capabilities for complex graph structures. Experiments determine the weights of text feature scores and PageRank values, comparing the performance of different methods on Reddit and Twitter datasets. This verifies that the proposed method effectively captures steganographic behavior and improves detection accuracy under different loads and encoding strategies, providing a new approach and technical support for steganalysis in social networks.

Description

Technical Field

[0001] This invention relates to the field of social network security technology, and in particular to a method for detecting stegans in social networks. Background Technology

[0002] With the rapid development of social networks, they play a crucial role in information dissemination and exchange, but also face numerous security threats. Steganography, a technique for hiding information in public channels to achieve covert communication, poses a serious challenge to cybersecurity when misused on social networks.

[0003] Currently, traditional steganalysis methods mainly rely on feature analysis of text content. However, in the complex environment of social networks, these methods struggle to cope with the massive amount of information and the highly concealed nature of steganographic information. Social networks contain complex social relationships and dynamically changing information flows, making steganographic detection extremely difficult, akin to finding a needle in a haystack. Traditional methods often fail to adapt effectively to this complex environment, resulting in low accuracy and efficiency in steganalysis detection. Summary of the Invention

[0004] This invention aims to improve the accuracy of steganography detection in social networks by integrating social relationships and textual features. We construct a social network graph, defining active users as user nodes and their posted comments as comment nodes, with the two connected. User replies form directed edges, which are appended with attributes such as interaction frequency, content similarity, and reply time to analyze social interactions and potential steganographic behavior, thereby identifying steganographic activities.

[0005] In applying the personalized PageRank algorithm, we constructed a vector with the same dimension as the total number of network nodes, setting known steganographic nodes as seed nodes and marking them as 1, while others were marked as 0. Based on content similarity, interaction frequency, and interaction frequency over a specific time period, we adjusted the edge weights to highlight the social connections related to steganographic behavior. The algorithm starts from each node and proportionally distributes PageRank values ​​to neighboring nodes until convergence, recording the personalized PageRank value of each node to characterize the degree of association between the node and the steganographic writer.

[0006] Furthermore, this scheme utilizes Graph Convolutional Networks (GCNs) to capture complex syntactic and semantic relationships between words, updating the representation of each word node to accurately reflect its meaning in a specific context. Residual Networks (ResNet) process the features extracted by GCNs, capturing broader semantic connections within the text. The sequential combination of GCNs and ResNets, embedding ResNet modules after each GCN layer output, constructs a personalized enhanced graph structure that integrates local and global information, improving the understanding and processing capabilities for complex graph structure data.

[0007] Through experimental analysis, we determined the relative weights of text feature scores and PageRank values ​​in stegwriter detection and constructed a series of weight combinations for testing. After preprocessing the Twitter and Reddit datasets, we extracted tweets and comments from active users and simulated stegwriter behavior to generate content containing secret information. By extracting users' text feature scores and PageRank values ​​and calculating a combined score, we compared the performance of different methods, verifying the effectiveness of the method that integrates social relationships and text features, thereby improving the accuracy of stegwriter detection in social networks. This approach provides new technical support for steganalysis in social networks, helping to identify and prevent potential steganalytic communication behaviors in social networks. Attached Figure Description

[0008] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the relevant technologies will be introduced below. The accompanying drawings described below are merely embodiments of the present invention.

[0009] Figure 1 Example image of illegal activities on social networks

[0010] Figure 2 Example of a social network conversation: Hidden secrets in everyday conversation

[0011] Figure 3 Example of a social network graph: This example demonstrates the structure of the constructed social network graph, including user nodes, comment nodes, user-user edges and their attributes (interaction frequency, content similarity, content reply time), user-comment edges, etc., intuitively presenting social relationships and related attribute information. Figure 4 A schematic diagram illustrating the feature fusion of the personalized PageRank algorithm: This diagram shows the various features fused by the personalized PageRank algorithm during execution, such as frequency, content, sentiment, and response time, and how they affect the algorithm's judgment of node importance. Figure 5 The diagram shows the feature fusion architecture of residual graph neural networks: it presents the serial combination structure of GCN and ResNet, and shows how each layer of GCN extracts local features, and how the subsequent ResNet module refines and adjusts these features to achieve the fusion of local and global information. Figure 6 Algorithm framework diagram: This diagram shows the overall framework structure of the method of this invention, including the text feature extraction module (top) and the social relationship analysis module (bottom), and how they work together to achieve stegwriter detection. Detailed Implementation Plan

[0012] The technical solutions of the present invention will now be described in detail with reference to the accompanying drawings.

[0013] In the social network graph construction phase, user nodes and comment nodes are determined based on social platform data. Interaction relationships between users are accurately recorded, and attributes such as interaction frequency, content similarity, and content reply time are calculated and added. User posting and reply records are retrieved from the social platform's database. Comment content similarity is calculated using text processing techniques, and the number of replies is counted to obtain interaction frequency. Reply times are recorded and their temporal characteristics are analyzed.

[0014] The personalized PageRank algorithm takes as input the following information: node information of the social graph (sets of user nodes and comment nodes), edge information (including user-user edges and user-comment edges, with attributes such as direction, interaction frequency, content similarity, and response time), a personalized vector with the same dimension as the total number of nodes, where the node corresponding to the known steganologist is set to a higher value while other nodes are set to 0, and edge weights adjusted according to edge attributes. Starting from each node in the social network, based on the edge weights and the personalized vector, the current PageRank value is allocated to neighboring nodes in a certain proportion. This allocation process follows an iterative calculation mechanism, continuing until the PageRank value reaches convergence, meaning that the node's PageRank value changes very little and approaches stability in consecutive iterations. The PageRank value update formula is:

[0015]

[0016] PR(i) is the PageRank value of node i, d is the damping factor, N is the total number of nodes, M(i) is the set of nodes pointing to node i, and w ij This represents the weight of the edge from node j to node i. In each iteration, a single node allocates a portion of its current PageRank value to its neighboring nodes based on the edge weights, while also receiving PageRank values ​​from its neighbors, thus enabling information propagation and updating within the network. After the algorithm converges, the personalized PageRank value of each node is meticulously recorded. This value accurately characterizes the degree of relevance between each node and known stegwriters (seed nodes) at the graph structure level. Generally, the higher a node's personalized PageRank value, the stronger its connection to stegwriters in the social relationship network structure. Through publish-response relationships and content-based inference connections, the node is more potentially influenced by stegwriters, thus increasing its likelihood of becoming a potential stegwriter.

[0017] For feature fusion based on nested residual graph neural networks, the node features of the GCN are initialized using a pre-trained word vector model. An adjacency matrix is ​​constructed based on the graph structure information, and appropriate GCN layers, ResNet blocks, and weight parameters ω are set. The GloVe word vector model is selected, with 3 GCN layers and 2 ResNet blocks. The model parameters are optimized through training to enable the model to effectively fuse local and global features.

[0018] In Graph Convolutional Networks (GCNs), the basic operation of each layer involves updating node features, which is typically achieved by aggregating information from neighboring nodes. The formula for feature update is as follows:

[0019]

[0020] H (l) Here, A is the feature matrix of the nodes in layer l, A is the adjacency matrix plus self-loops plus preprocessing, σ usually represents a non-linear activation function, D is the degree matrix of A, and W is the feature matrix of the nodes in layer l. (l) It is the trainable weight matrix of the l-th layer.

[0021] The Residual Network (ResNet) block addresses the degradation problem in deep networks by introducing skip connections. The feature update formula is as follows:

[0022] X' = ​​X + F(X)

[0023] X is the input feature, X' is the output feature, and F(X) represents a series of operations within the ResNet block, such as convolution, batch normalization, and non-linear activation. Feature fusion between the GCN layer and the ResNet block can enhance the model's ability to capture both local and global features. The formula for feature fusion is as follows:

[0024] H (l+1) =ResNet(H (l) )

[0025] ResNet(·) represents a ResNet block, used for further processing of the output features of the GCN layer.

[0026] Features from different sources can be fused through weighted combination to enhance the model's representational power. The formula is as follows:

[0027] H (fused) =ωH GCN +(1-ω)H ResNet

[0028] ω is a weighting parameter used to balance the importance of the two features.

[0029] The entire nested fusion architecture achieves deep feature extraction and refinement through a combination of multiple layers of GCN and ResNet blocks. The overall workflow formula is as follows:

[0030] H (L) =GCN L (ResNet L-1 (··ResNet1GCN1(X))··)

[0031] X is the input feature, ResNet i and GCN i Let L represent the GCN and ResNet blocks in the i-th layer, respectively. L is the total number of layers or blocks, and H... (L) It is the final feature representation.

[0032] This study aims to accurately determine the relative weights of text feature scores and PageRank values ​​in stegonist identification. We employ a sample set-based experimental analysis method, randomly dividing the sample set, which includes known stegonists and normal users, into a 70% training set, a 10% validation set, and a 20% test set to ensure the representativeness and randomness of the data distribution. The weights of the text feature scores (ω) are set as follows: TF ) and PageRank value weight (ω) PR The values ​​of ) are all in the range of 0 to 1, with a step size of 0.1, and a series of weight combinations to be tested are constructed.

[0033] For each weight combination, we calculate the comprehensive score for each user in the training set according to the weighted summation formula:

[0034] S=ω TF ·TF+ω PR ·PRS

[0035] Where TF represents the text feature score and PR represents the PageRank value.

[0036] After determining the weights, we extracted the corresponding text feature score and PageRank value for each user in the entire dataset, and strictly calculated the comprehensive score for each user according to the determined weights and formulas. This process quantifies and integrates the information contained in text features and social relationships in the form of a comprehensive score, providing a data foundation for subsequent accurate identification of stegwriters.

[0037] This study extensively tested the performance of three different steganalysis methods—traditional steganalysis, convolutional neural network-based methods (TS-CNN), and recurrent neural network-based methods (TS-RNN)—along with our proposed method that integrates social relationships and text features, on the Reddit and Twitter datasets, targeting fixed-length encoding (FLC) and variable-length encoding (VLC) strategies at different workload levels. The main performance evaluation metrics included accuracy (AC), recall (PR), and F1 score (RE). Detailed experimental results are shown in Table 1.

[0038]

[0039] Table 1 Experimental Data

[0040] Experimental results on the Reddit dataset demonstrate that our proposed method has significant advantages in steganography detection. Our method effectively improves the performance of steganalysis under both fixed-length encoding (FLC) and variable-length encoding (VLC) strategies. Especially under high load conditions, our method can more accurately identify steganography, demonstrating good robustness and adaptability. Furthermore, our method exhibits the best overall performance on comprehensive evaluation metrics, validating the importance of integrating social relationships and textual features for improving steganalysis detection accuracy. Experimental results on the Twitter dataset confirm the effectiveness of our proposed method. Our method demonstrates superior detection performance under both fixed-length encoding (FLC) and variable-length encoding (VLC) strategies. Whether under low or high load conditions, our method can accurately identify steganography, demonstrating good adaptability and robustness. Moreover, our method outperforms existing techniques in key performance metrics such as accuracy, recall, and F1 score, indicating the importance of integrating social relationships and textual features for improving steganalysis detection accuracy. These findings not only confirm the effectiveness of our method, but also provide new technical means for steganography analysis in social networks, which can help identify and prevent potential steganographic communication behaviors in social networks.

[0041] In summary, the method integrating social relationships and textual features can effectively capture steganographic behavior in social networks, demonstrating high accuracy and reliability under different load levels and encoding strategies. This finding confirms the importance of social relationship information in steganalysis and provides a new technical approach for social network steganalysis. Our research provides strong technical support for identifying and preventing potential steganographic communication behaviors in social networks.

Claims

1. A GCN-based steganographer discovery for social networks, characterized in that, include: A. When constructing the social network graph, we defined user nodes and comment nodes, and established directed edges between users due to reply interactions. These edges carry attributes such as interaction frequency, content similarity, and reply time to capture the social interaction characteristics between users. B. In the application of the personalized PageRank algorithm, we first set known steganographic nodes as seed nodes and create a vector where seed nodes are marked as 1 and others as 0. Next, we adjust the edge weights based on content similarity, interaction frequency, and interaction frequency over a specific time period to highlight connections related to steganographic behavior. The algorithm iteratively calculates the PageRank value of each node until convergence and combines textual and behavioral features for comprehensive analysis to identify potential steganographic actors. C. This study employs a nested residual graph neural network, utilizing GCN to capture inter-word syntactic and semantic connections, and then processes these features through ResNet to capture broader semantic associations. The GCN layer is combined with the ResNet module in series to construct a personalized enhanced graph structure that integrates local and global information. D. In our study integrating social relationships and text features, we preprocessed the Twitter and Reddit datasets and then simulated stegwriters generating steganographic text. We experimentally determined the weights of text features and PageRank values, constructed a comprehensive user score, and used it to distinguish between stegwriters and non-steganwriters. Finally, by comparing the performance of different methods, we verified the effectiveness of the method integrating social relationships and text features.

2. The GCN-based steganographer discovery of claim 1, wherein, Step A further includes the following steps: (1) Node definition: Users who actively participate in social interaction are established as independent user nodes, and each comment posted by a user is a comment node and is connected to the corresponding poster user node; (2) Edge construction: When a user replies to another user's comment, a directed user-user edge is constructed between the two user nodes, and a user-comment edge is also established between the user node and the node where it posted the comment; (3) Attribute addition: The user-user side has the attributes of interaction frequency, content similarity and content reply time. The interaction frequency records the number of replies. The content similarity is calculated by the text similarity algorithm to determine the similarity of the comment content. The content reply time records the time interval or specific time features of the replies.

3. The GCN-based steganographer discovery of claim 1, wherein, Step B further includes the following steps: (1) Personalized vector construction: The user node corresponding to the known steganist is established as the seed node. A vector with the same dimension as the total number of nodes in the social relationship network is constructed. The seed node is assigned a value of 1 at the corresponding position and 0 at the rest. (2) Graph weight adjustment strategy: Adjust the edge weights based on the content similarity attribute, with edges that are more similar having a larger weight; assign a higher weight coefficient to post-reply edges with high interaction frequency; assign a higher weight coefficient to edges corresponding to the reply time attribute of content that is frequently interacted within a specific time period; (3) Personalized PageRank algorithm execution: Input the node information, edge information, personalized vector and adjusted edge weight information of the social relationship graph. Starting from each node, distribute its own PageRank value to the adjacent nodes in proportion. Iterate until convergence and record the personalized PageRank value of each node. (4) Comprehensive analysis and judgment of results: Taking into account the text feature analysis results of tweet content and reply content as well as user behavior pattern characteristics, a comprehensive judgment is made on potential steganalysts.

4. The GCN-based steganographer discovery of claim 1, wherein, Step C further includes the following steps: (1) Graph Convolutional Network (GCN) is used to capture the complex syntactic and semantic relationships between words. Each word node updates its own representation by aggregating information from its neighboring nodes. (2) Residual networks (ResNet) are used to process the features extracted by GCN to capture a wider range of semantic relationships in the text; (3) By combining GCN and ResNet in sequence, a residual network module is embedded after the output of each layer of the graph convolutional network to construct a personalized enhanced graph structure that integrates local and global information.

Images