Social text-oriented multi-source behavior domestic violence feature anomaly detection method

Abstract

The application relates to the technical field of artificial intelligence, in particular to a multi-source behavior domestic violence feature anomaly detection method for social text. By extracting multi-dimensional behavior features corresponding to a target user, a standardized feature vector of each multi-dimensional behavior feature is created, the standardized feature vector is input into an isolation forest model, the feature contribution degree of the feature vector is calculated, a weighted isolated tree is constructed through recursion, the integrated weight of m groups of isolation forests is calculated by combining the performance factors of the m groups of isolation forests, finally, multi-scale fusion is carried out by combining m groups of abnormal scores of a to-be-detected user, the final abnormal score of the to-be-detected user is obtained, risk prediction is carried out on the to-be-detected user based on the final abnormal score, a multi-dimensional feature system is constructed for domestic violence hidden behaviors, self behavior mutation detection logic is adopted, domestic violence core anomalies are captured, a dynamic threshold judgment mechanism is adopted, historical risks and trends of the user are adaptively adjusted, and the early warning sensitivity of long-term high-risk objects is improved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and more specifically, to a method for detecting anomalies in multi-source behavioral characteristics of domestic violence in social text. Background Technology

[0002] With the widespread adoption of social networks, open-source behavioral data generated by users on public platforms, such as posts, interaction records, and activity patterns, has become an important vehicle for depicting individual life status. In the fields of social governance and rights protection, there is a desire to leverage these limited public texts and behavioral traces to conduct targeted analysis of changes in the status of specific groups of concern, especially for issues like domestic violence that are highly concealed and slow to detect. This aims to achieve early warning and timely intervention by identifying typical abnormal characteristics. In the field of data processing, technologies such as social text mining, user behavior time-series analysis, and lightweight data collection are constantly developing, providing support for extracting key signals from open-source data. Against this backdrop, how to quickly and efficiently identify abnormal characteristics of domestic violence based on publicly available social network data and targeted analysis of target information has become a research hotspot in the fields of public safety and social governance.

[0003] Existing technologies have many shortcomings in identifying domestic violence risks based on open-source data from social networks. The analysis of social behavior lacks a feature system specific to domestic violence scenarios, and it has not made quantitative models around typical abnormal features such as "late-night activity, sudden changes in posting, decreased interaction, and closed social circles." It is unable to accurately capture the hidden features related to domestic violence, making it difficult for general detection algorithms to combine with the specific features of domestic violence scenarios when conducting risk identification. This results in low accuracy in identifying domestic violence risks, making it difficult to make rapid and accurate judgments and failing to meet the actual needs of safety prevention and control for vulnerable groups. Summary of the Invention

[0004] The purpose of this invention is to provide a method for detecting anomalies in multi-source behavioral domestic violence features in social text, in order to solve the problems mentioned in the background art.

[0005] To address the aforementioned technical problems, one objective of this invention is to provide a method for detecting anomalies in multi-source behavioral domestic violence features in social text, comprising: S1: Set the collection parameters, and collect multi-source heterogeneous behavioral data of the target user through incremental sampling based on the collection parameters. Introduce a behavioral fingerprint adaptive modulation strategy to adjust the collection parameters. By extracting data from the multi-source heterogeneous behavioral data, multiple standardized behavioral data are obtained. S2: Extract the corresponding multi-dimensional behavioral features based on the standardized behavioral data of each target user, and standardize the multi-dimensional behavioral features to create a standardized feature vector for each multi-dimensional behavioral feature; S3: Create an isolated forest model; S4: Input the standardized feature vector of the target user into the isolated forest model, calculate the feature contribution of the feature vector through the isolated forest model, construct weighted isolated trees recursively, create m groups of isolated forests based on multiple weighted isolated trees, define the performance factor of each group of isolated forests, and calculate the ensemble weight of the m groups of isolated forests by combining the performance factors of the m groups of isolated forests, and obtain the trained isolated forest model. S5: Collect multi-source heterogeneous behavioral data of the users to be tested, input the multi-source heterogeneous behavioral data of the users to be tested into the trained Isolation Forest model, calculate the path length and average path length of the users to be tested, and correct them by normalization factor to obtain the group anomaly score of the m-th group of the users to be tested, and perform multi-scale fusion by combining the m-th group anomaly scores to obtain the final anomaly score of the users to be tested, and perform risk prediction on the users to be tested based on the final anomaly score.

[0006] Preferably, step S1 includes the following steps: S1.1: Define the sampling number N. Based on the sampling number N, incremental sampling is performed on the public behavior data of the target user through an information entropy-driven adaptive scrolling strategy to obtain the multi-source heterogeneous behavior data of the target user. S1.2: Dynamically adjust the current collection status parameters, time distribution information entropy, and entropy upper bound based on the target user's behavioral characteristics; S1.3: Construct a behavioral event model, which expresses the multi-source heterogeneous behavioral data of the target user as a five-dimensional feature vector structure: ;in, For behavioral events, For user identifier vectors, For event type vectors, The vector of the target object, For time feature vectors, Metadata dictionary vector; S1.4: For each piece of multi-source heterogeneous behavioral data, the core fields are located and extracted using cascading style sheets to obtain structured behavioral data: ,in, For structured behavioral data oriented towards users, This is the main behavioral data set, where "fans" represents the number of followers a user has. For behavioral events, N is the number of samples; Specifically, ,in, This represents the feature vector of the i-th post. To standardize release times, For the number of likes, This refers to the number of comments and interactions.

[0007] Preferably, the multi-dimensional behavioral features include time-based behavioral dynamics features, social interaction topology features, and comprehensive correlation features. The time-based behavioral dynamics features include posting time discrete entropy, diurnal rhythm deviation, posting interval mutation index, recent silence duration, and posting rhythm stability. The social interaction topology features include interaction fluctuation coefficient, interaction decay trend, proportion of posts with zero interaction, interaction / follower ratio deviation, and social diversity index. The comprehensive correlation features include time-interaction correlation and social network cohesion index.

[0008] Preferably, step S2 includes the following steps: S2.1: Based on structured behavioral data The behavioral dynamics features, social interaction topology features, and comprehensive correlation features of the target users are extracted respectively. S2.2: Combine the target user's behavioral dynamics features, social interaction topology features, and comprehensive correlation features to obtain the target user's original feature vector F; S2.3: Standardize the original feature vector of the target user, transforming it into a standardized feature vector. .

[0009] Preferably, step S4 includes the following steps: S4.1: Input the standardized feature vectors of multiple target users as a normal user sample library into the isolated forest model; S4.2: For each target user, calculate the feature contribution weight of that target user based on its standardized feature vector using Formula 1; Formula 1; in, It is the feature contribution weight of the d-th eigenvector. It is the variance of the d-th eigenvector; S4.3: Randomly select from the normal user sample database A sample set is created from the standardized feature vectors of the target users. Set up the sample set The depth and height, combined with the sample set The depth and height are recursively used to construct a weighted isolated tree; S4.4: Set multiple recursion termination conditions to determine whether the recursive construction of the weighted isolated tree satisfies any of the recursion termination conditions; S4.5: If the recursive construction of the weighted isolated tree satisfies any recursion termination condition, then stop the recursion, create a leaf node, and record the number of samples contained in the leaf node. S4.6: If the recursive construction of the weighted isolated tree does not satisfy any recursive termination condition, then the subtree is recursively constructed.

[0010] Preferably, step S4.6 includes the following steps: S4.61: Set sampling probability and with sampling probability Feature dimensions are randomly selected from the standardized feature vectors of the target users; S4.62: Obtain the sample set According to the sample set The node samples are arranged in ascending order of their values ​​on the selected feature dimension; S4.63: Real-time calculation of adaptive lower quartiles based on sample size and adaptive upper quartiles ; S4.64: In the adaptive interval [ , Uniformly and randomly select segmentation values ​​v within the range; S4.65: Combine the selected feature dimension and the segmentation value v to divide the current node sample into left and right child nodes, call the tree construction function, use the left and right child nodes as the new current node sample set, construct the left subtree and right subtree, until the entire weighted isolated tree is constructed.

[0011] Preferably, step S4 further includes the following steps: S4.7: Define the subsampling size of the m-th forest group Based on subsampling size Construct multiple weighted isolation trees to obtain m groups of isolated forests; S4.8: Randomly select multiple target users from the normal user sample library as the validation set, simulate the injection of known domestic violence abnormal patterns, and construct a labeled validation sample set; S4.9: Define the performance factors for the m-th isolated forest. Then, normalization is performed to obtain the ensemble weights of m isolated forests. ,in, It is the subsampling size of the m-th forest group. It is the feature contribution weight of the d-th eigenvector; through the performance factor This comprehensively reflects the ability to distinguish features and the adaptability of subsampling. , and .

[0012] Preferably, step S5 includes the following steps: S5.1: Obtain multi-source heterogeneous behavior data of the user to be tested, and input the multi-source heterogeneous behavior data of the user to be tested into the trained isolated forest model to calculate the standardized feature vector of the user to be tested. S5.2: Create a set of test samples based on the standardized feature vector of the user to be tested, calculate the path length of the user to be tested in each weighted isolated tree in each group of isolated forests based on the set of test samples, and take the arithmetic mean of the path lengths of the user to be tested in all weighted isolated trees in each group of isolated forests as the average path length of the user to be tested in that group of isolated forests. S5.3: Define the normalization factor for the m-th isolated forest group. Normalization factor As a benchmark, it corrects for deviations in the average path length of the tested users caused by different sampling scales; S5.4: Calculate the group anomaly score of the user under test in the m-th isolated forest, and then sum the anomaly scores of the m isolated forests based on the corresponding feature contribution weights to obtain the final anomaly score of the user under test. S5.5: Set a risk threshold, calculate the historical cumulative risk coefficient of the user under test based on the risk threshold, determine the risk trend of the user under test by combining the historical cumulative risk coefficient, and judge the risk level of the user under test by combining the final abnormal score of the user under test and the risk trend of the user under test.

[0013] Preferably, step S5.5 includes the following steps: S5.51: Calculate the final anomaly score of all target users in the normal user sample database, and set the medium-risk threshold according to the cumulative distribution function of the final anomaly scores of all target users. and high risk threshold ; S5.52: Obtain the K most recent abnormal score sequences of the user under test, and combine the K most recent abnormal score sequences of the user under test with the risk threshold to calculate the historical risk cumulative coefficient of the user under test; S5.53: Combine the K most recent abnormal score sequences of the user under test with the Spearman rank correlation coefficient to determine the risk trend of the user under test; S5.54: Define a correction factor for the historical detection count of the user under test, and combine the correction factor for the historical detection count with the medium-risk threshold of the user under test. and high risk threshold Dynamic updates are performed to obtain the dynamic medium-risk threshold for the user under test. and dynamic high-risk threshold ; S5.55: Determine the final anomaly score and dynamic risk threshold of the user under test. Dynamic high-risk threshold The size of the risk level is determined, and the risk level of the user to be tested is determined based on the judgment result.

[0014] On the other hand, this application also provides a multi-source behavioral domestic violence feature anomaly detection system for social text, applied to any of the aforementioned multi-source behavioral domestic violence feature anomaly detection methods for social text, including... Acquisition component; the acquisition component collects multi-source heterogeneous behavioral data of the target user; The detection component is communicatively connected to the acquisition component. All data information acquired by the acquisition component is input to the detection component. The detection component determines the risk level of the target user based on the target user's multi-source heterogeneous behavioral data and issues an early warning based on the target user's risk level.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. By constructing a multi-dimensional feature system targeting concealed domestic violence behaviors and employing its own behavioral mutation detection logic, it accurately captures core abnormalities of domestic violence such as early morning activity, long-term muteness, decreased interaction, and social isolation, effectively distinguishing between abnormal states and normal silent states, thereby achieving rapid and accurate assessment of domestic violence risks and meeting the actual needs of safety prevention and control for vulnerable groups. 2. By implementing three key improvements to the traditional isolated forest model—weighting of domestic violence behavior characteristics, adaptive quartile segmentation, and multi-scale forest fusion—the efficiency of anomaly detection and the robustness of the isolated forest model are improved. A dynamic threshold determination mechanism is adopted, which is adaptively adjusted in combination with users' historical risk, trends, and detection information to strictly control the basic false alarm rate and improve the early warning sensitivity of long-term high-risk objects. Attached Figure Description

[0016] Figure 1 A flowchart illustrating a method for detecting anomalies in multi-source behavioral domestic violence features in social text. Figure 2 A flowchart illustrating the process of extracting standardized feature vectors for a multi-source behavioral anomaly detection method for domestic violence features in social text. Figure 3 A schematic diagram of the framework for a multi-source behavioral anomaly detection system for social text-based domestic violence features. The reference numerals are: 100, acquisition component; 200, detection component. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] Example 1 like Figure 1 and Figure 2 As shown, one of the objectives of this invention is to provide a method for detecting anomalies in multi-source behavioral domestic violence features in social text, including: S1: Set the collection parameters, and collect multi-source heterogeneous behavioral data of the target user through incremental sampling based on the collection parameters. Introduce a behavioral fingerprint adaptive modulation strategy to adjust the collection parameters. By extracting data from the multi-source heterogeneous behavioral data, multiple standardized behavioral data are obtained. S2: Extract the corresponding multi-dimensional behavioral features based on the standardized behavioral data of each target user, and standardize the multi-dimensional behavioral features to create a standardized feature vector for each multi-dimensional behavioral feature; S3: Create an isolated forest model; S4: Input the standardized feature vector of the target user into the isolated forest model, calculate the feature contribution of the feature vector through the isolated forest model, construct weighted isolated trees recursively, create m groups of isolated forests based on multiple weighted isolated trees, define the performance factor of each group of isolated forests, and calculate the ensemble weight of the m groups of isolated forests by combining the performance factors of the m groups of isolated forests, and obtain the trained isolated forest model. S5: Collect multi-source heterogeneous behavioral data of the users to be tested, input the multi-source heterogeneous behavioral data of the users to be tested into the trained Isolation Forest model, calculate the path length and average path length of the users to be tested, and correct them by normalization factor to obtain the group anomaly score of the m-th group of the users to be tested, and perform multi-scale fusion by combining the m-th group anomaly scores to obtain the final anomaly score of the users to be tested, and perform risk prediction on the users to be tested based on the final anomaly score.

[0019] It should be noted that this application collects multi-source heterogeneous behavioral data of target users through incremental sampling, extracts multi-dimensional behavioral features corresponding to the target users, and standardizes the multi-dimensional behavioral features to create a standardized feature vector for each multi-dimensional behavioral feature. Then, an isolated forest model is created, and the standardized feature vector of the target user is input into the isolated forest model to calculate the feature contribution of the feature vector. Weighted isolated trees are constructed recursively, and m groups of isolated forests are created based on multiple weighted isolated trees. The ensemble weight of the m groups of isolated forests is calculated by combining the performance factors of the m groups of isolated forests. Finally, the path length and average path length of the user under test are calculated and corrected by a normalization factor to obtain the group anomaly score of the m-th group of the user under test. Multi-scale fusion is performed by combining the m groups of anomaly scores to obtain the final anomaly score of the user under test. Risk prediction is performed on the user under test based on the final anomaly score. This application constructs a multi-dimensional feature system for hidden domestic violence behavior, adopts its own behavioral mutation detection logic, accurately captures the core anomalies of domestic violence, effectively distinguishes between abnormal and normal silent states, and adopts a dynamic threshold judgment mechanism that adaptively adjusts based on the user's historical risk and trend to improve the early warning sensitivity of long-term high-risk objects.

[0020] In one embodiment of this application, step S1 includes the following steps: S1.1: Define the sampling number N. Based on the sampling number N, incremental sampling is performed on the public behavior data of the target user through an information entropy-driven adaptive scrolling strategy to obtain the multi-source heterogeneous behavior data of the target user. Specifically, the number of samples ; in, It is a multidimensional feature vector extracted based on the first k data units. It is the joint information entropy of feature vectors, which measures the information richness of the current sample set. It is the information gain threshold, taken as... This indicates that data collection will stop when the marginal information gain from newly added data units falls below 5%. It is the minimum number of samples, determined by both the feature dimension and statistical stability; By defining a sampling number N based on the principle of diminishing marginal returns in information theory, the sampling number N is stopped when the marginal information gain is no longer significant, ensuring that the sampling stops immediately when new posts no longer significantly improve feature richness. This approach obtains the maximum effective information with the minimum collection cost, avoiding over-collection and resource waste.

[0021] S1.2: Dynamically adjust the current collection status parameters, time distribution information entropy, and entropy upper bound based on the target user's behavioral characteristics; Specifically, the set of collected data units is defined as follows: Therefore, the information entropy of its release time distribution is: ,in, It is a collection of collected data units. It is the number of days covered by the set of collected data units. It represents the number of data units released on day d. Set the stop condition for scrolling data acquisition. The stop condition for scrolling data acquisition is set as follows: or ,in, It is the temporal distribution information entropy. It is the upper bound of the typical user posting entropy in the platform's historical statistics. It is the information coverage threshold, and , This is the maximum sampling limit; When the temporal distribution information entropy of the collected data reaches the level of a typical user More than twice, or the cumulative number of samples reaches the maximum limit. When this happens, the scrolling data collection process is immediately terminated to avoid invalid loading and resource waste; Set sampling saturation coefficient Where k is the number of data units currently collected and N is the number of samples, by introducing a behavior fingerprint randomization model, the scrolling step size, scrolling interval and request interval are deeply coupled with the information saturation level of the current collection stage, dynamically adjusting the access behavior characteristics, and improving the simulation realism and anti-identification ability.

[0022] S1.3: Construct a behavioral event model, which expresses the multi-source heterogeneous behavioral data of the target user as a five-dimensional feature vector structure: ;in, For behavioral events, For user identifier vectors, For event type vectors, The vector of the target object, For time feature vectors, Metadata dictionary vector; Specifically, a general behavioral event model is further constructed to achieve unified representation and structured processing of behavioral data from multiple scenarios. To improve the model's abstract expression capability and scalability, behavioral events are expressed as a five-dimensional feature vector structure, and each dimension can be further decomposed into sub-vectors or attribute sets to achieve multi-dimensional and fine-grained behavioral representation. User Identifier Vector Includes a combination of platform-unique account ID, device fingerprint, and account profile tags; event type vector. Event types include posting, interaction, group chat activity, relationship changes, transaction records, and other behavioral types, and support dynamic expansion based on business scenarios; target object vectors. Used to characterize the content ID or interaction target corresponding to the event; time feature vector Includes absolute timestamps and relative time offsets; metadata dictionary vector It includes extended attributes such as location and network environment. This vector structure possesses dimensional flexibility and combinatorial scalability, providing a foundation for the unified representation of heterogeneous data.

[0023] S1.4: For each piece of multi-source heterogeneous behavioral data, the core fields are located and extracted using cascading style sheets to obtain structured behavioral data: ,in, For structured behavioral data oriented towards users, This is the main behavioral data set, where "fans" represents the number of followers a user has. For behavioral events, N is the number of samples; Specifically, ,in, This represents the feature vector of the i-th post. To standardize release times, For the number of likes, This refers to the number of comments and interactions. Cascading stylesheets (CSS) positioning is a matching method based on the path rules of front-end page elements. It can reliably locate and extract public data such as posting time, number of likes, and number of comments. At the same time, it extracts the number of followers from the header area of ​​the user's homepage. The posting time is uniformly converted into a standard timestamp format for storage, and the number of likes and comments are converted into integer values ​​for storage. After normalization, it forms a structured behavioral data with a unified format.

[0024] It should be noted that this application strictly follows the platform's terms of service and personal information protection regulations when collecting multi-source heterogeneous behavioral data of target users, and only collects social behavior data that is publicly visible to users.

[0025] By incrementally sampling publicly available behavioral data of target users, stopping when the marginal information gain is below 5%, and combining feature dimensions and statistical stability to determine the minimum number of samples, the maximum information gain is achieved with the minimum collection cost. An information entropy-driven adaptive scrolling strategy is adopted, which adaptively terminates scrolling based on the information entropy of the published time distribution of the collected data and a preset threshold to avoid invalid loading. Finally, a behavioral fingerprint adaptive modulation strategy coupled with the collection state is introduced to dynamically adjust the scrolling step size, scrolling interval, and request interval to simulate the access behavior of natural persons and reduce the risk of anti-scraping identification by the platform.

[0026] In one embodiment of this application, the multi-dimensional behavioral features include time-behavioral dynamics features, social interaction topology features, and comprehensive correlation features. The time-behavioral dynamics features include posting time discrete entropy, diurnal rhythm deviation, posting interval mutation index, recent silence duration, and posting rhythm stability. The social interaction topology features include interaction fluctuation coefficient, interaction decay trend, proportion of zero-interaction posts, interaction / follower ratio deviation, and social diversity index. The comprehensive correlation features include time-interaction correlation and social network cohesion index.

[0027] It should be noted that the temporal behavioral dynamics feature is used to characterize the distribution pattern and fluctuation characteristics of user behavior in the time dimension, reflecting the rhythm and abnormal changes of user behavior; the social interaction topology feature is used to characterize the intensity of user interaction, relationship structure and influence changes in social networks; and the comprehensive correlation feature is used to integrate multi-dimensional behavioral information to characterize the degree of deviation of the user's overall behavioral pattern.

[0028] All features are designed based on the "mutation detection" logic. By detecting changes in the user's behavior patterns within the currently visible time period, anomalies are identified, avoiding misjudging normal situations such as naturally silent users and account absconders as abnormal.

[0029] In one embodiment of this application, step S2 includes the following steps: S2.1: Based on structured behavioral data The behavioral dynamics features, social interaction topology features, and comprehensive correlation features of the target users are extracted respectively. S2.2: Combine the target user's behavioral dynamics features, social interaction topology features, and comprehensive correlation features to obtain the target user's original feature vector F; S2.3: Standardize the original feature vector of the target user, transforming it into a standardized feature vector. .

[0030] It should be noted that the aforementioned time-related dynamic features include Discrete entropy of posting time , circadian rhythm deviation , Posting Interval Sudden Change Index , Recent silence duration as well as Posting rhythm stability .

[0031] in, It is used to quantify the concentration of user posts on a macro date scale. Under normal circumstances, user posting behavior is roughly evenly distributed on the timeline, while domestic violence victims may experience extreme situations such as "concentrated bursts of posting" or "complete silence". The discrete entropy of posting time is based on Shannon's information entropy theory, and the calculation formula is as follows: ; in, For the collection of natural days covered by the post, Let N be the number of posts on day d, and N be the number of samples. The percentage of posts on day d is the proportion of the sampled number. The lower the entropy value of the discrete entropy of posting time, the more concentrated the posts are in a few days. When the entropy value of the discrete entropy of posting time is abnormally low, there may be explosive posting behavior, reflecting an abnormal state of users losing control of their emotions or seeking help in a concentrated manner. This method is used to detect abnormal user activity during the early morning hours. Victims of domestic violence often secretly use their phones after the abuser has fallen asleep. Posts made during this time are an important signal for identifying the risk of domestic violence. First, the posting time is corrected to the user's local time, and the percentage of posts made between 0:00 and 6:00 AM is analyzed. Then calculate its deviation from the mean of the normal group: ; in, The percentage of posts made in the early morning. This is an indicator function that takes the value 1 when the condition is true. N represents the hourly component of the post's local time, and N is the number of samples. and This represents the mean and standard deviation of the percentage of posts made in the early morning, obtained from a large sample of normal users. A deviation greater than 2 indicates medium risk, and greater than 3 indicates high risk, reflecting the degree of abnormality in user activity in the early morning. This feature is used to detect drastic fluctuations in a user's posting frequency. Victims of domestic violence may be unable to post for extended periods due to their phones being confiscated, or they may seize opportunities to post in concentrated bursts, resulting in highly uneven posting intervals. This feature is based on the coefficient of variation theory, and the calculation formula is as follows: ; in, This is a sequence of time intervals between adjacent posts (unit: hours). Let be the timestamp of the i-th post. The mean of the interval sequence. Let N be the standard deviation of the interval sequence. The coefficient of variation is the ratio of the standard deviation to the mean, eliminating the influence of dimensions. N is the number of samples. If the posting intervals are extremely uneven, it is considered abnormal. The current state of a user's silence can be directly quantified. "Silence" is one of the most typical behavioral characteristics of victims of domestic violence. When the abuser controls the victim's communication tools, the victim may completely lose the ability to speak out. The calculation formula is as follows: ; in, It is the Unix timestamp (in seconds) of the current detection time. The numerator is the timestamp (in seconds) of the latest post, the denominator is the time difference (in seconds), and the denominator, 86400, is the number of seconds in a 24-hour period. The result is in days. A period of silence exceeding 7 days is considered medium risk, and exceeding 14 days is considered high risk. This feature is used to measure the regularity of users' daily posting time distribution. Users with different identities have different posting rhythms, and a break in this rhythm may indicate anomalies. This feature uses the Kullback-Leibler divergence to quantify the difference between the user's current posting time distribution and a reference distribution. ; in, Distribution of users' posts during the current posting time period. The numerator represents the probability of posting in time period h, the numerator represents the number of posts in time period h, and N represents the number of samples. For reference distribution, data was obtained from users' own historical data or statistics from user groups with similar profiles. For the posting probability corresponding to time period h in the reference distribution, it satisfies .when A value greater than 0.5 is considered abnormal, indicating that the user's posting rhythm deviates significantly from the normal pattern; The social interaction topology features include Interactive volatility coefficient , Interaction decay trend , Percentage of posts with zero interaction , Interaction / Fan Ratio Deviation as well as Social Diversity Index ; in, This method is used to detect fluctuations in post engagement. Engagement volume for domestic violence victims may exhibit two abnormalities: "drastic fluctuations" (alternating statuses) or "excessive stability" (inflated engagement or manipulation). The calculation formula is as follows: ; in, This is the sequence of total interactions. and These represent the number of likes and comments for the nth post, respectively. This represents the average number of interactions. To determine the standard deviation of interaction volume, a two-tailed criterion is used: when When it is judged as an overstability anomaly, when The time was determined to be an abnormal fluctuation; This method is used to detect the changing trend of interaction volume over time. As the victim's contact with the outside world is gradually cut off, the interaction volume of their posts shows a decreasing trend. In this application, the first 30% of posts are taken as the first part and the last 30% of posts are taken as the second part, and the decay coefficient is calculated: ; in, This is a collection of previous posts. This is a collection of posts from the later part of the article. This is the floor function; This represents the average number of interactions in the preceding period. This represents the average interaction volume in the latter part of the process. To smooth out terms and prevent division by zero. When If the interaction is deemed abnormal, it means that the interaction volume in the later stage is less than half of that in the earlier stage. This reflects the degree to which users are isolated or their content is throttled, and includes the percentage of posts with zero likes and zero comments. ; in, This is a collection of posts with zero interaction. Indicates the number of elements in the set. When If the post is deemed abnormal, it means that more than half of the posts have received no attention. Used to detect anomalies in the match between interaction volume and fan base, and to calculate the degree of deviation between the actual interaction / fan ratio and the industry benchmark: ; in, The ratio of actual interactions to followers is N, where N is the number of samples, the numerator is the average number of interactions per post, and the denominator is... The number of followers of the user; The baseline value is obtained from a large number of normal user samples. When the deviation is greater than 3.0, it is judged as abnormal. Quantifying the breadth of user interactions based on behavioral events Calculate the Shannon entropy of the distribution of interactive objects:

[0032] in, A collection of interactive objects The number of interactions between the user and object o. Total number of interactions The proportion of interaction with object o. When It was determined at the time that the social circle was too closed off. It was determined at the time that the social circle was unusually open; The comprehensive correlation features include Time-interaction relevance and Social Network Cohesion Index ; pass To quantify the monotonic trend of interaction over time, Spearman's rank correlation coefficient is used, which is insensitive to outliers. ; in, The difference between the time rank and the rank of the number of likes. For time sequence number, For the number of likes, Returns the rank (descending) of the element in the sequence, where N is the number of samples; It is the sum of squares of the rank differences. A negative value indicates that the interaction volume decreases over time. The time frame indicates a significant negative correlation, reflecting a decaying trend in the interaction.

[0033] pass Quantify the tightness of the user interaction network and construct a user interaction network graph. Calculate the average local clustering coefficient: ; in, For a set of nodes, Let it be the set of edges; Let v be the set of neighbors of node v. Let be the degree of node v; the numerator represents the number of edges that actually exist between the neighbors of node v, and the denominator represents the degree of node v. The local clustering coefficient is obtained by multiplying the ratio by 2 to find the maximum possible number of edges. If the network structure is deemed abnormal, it indicates that the network structure is loose and social connections are fragile.

[0034] After obtaining the above 12 features, the set of these 12 features constitutes the original feature vector F of the target user. ; Then, the original feature vector F is standardized using the Z-score standardization method to obtain the standardized feature vector of the target user. Standardized features It follows a distribution with a mean of 0 and a standard deviation of 1. When the eigenvalue is equal to the mean, the standardized value is 0; when the eigenvalue deviates from the mean, the standardized value quantifies the degree of deviation in units of standard deviation. This makes features with different dimensions and different value ranges comparable and avoids features with large numerical ranges from dominating the calculation of outlier scores in the subsequent isolated forest model.

[0035] In one embodiment of this application, step S4 includes the following steps: S4.1: Input the standardized feature vectors of multiple target users as a normal user sample library into the isolated forest model; Specifically, to ensure the reliability of the isolated forest model, the normal user sample database in this application... The target user base is no less than 10,000, therefore Furthermore, target users must meet the following filtering criteria: (1) Account registration duration constraint: The account registration duration is not less than the duration threshold calculated based on behavioral stability, which is used to exclude new accounts whose behavior is not stable during the cold start phase; (2) Posting activity constraint: The average monthly posting volume is within the reasonable range [Nmin, Nmax] determined by the joint optimization of the feature information saturation model and the behavioral distribution uniformity objective function, which is used to exclude abnormal accounts that are extremely active or have been silent for a long time; (3) Account compliance constraint: There is no record of violation bans, which ensures that the sample behavior is normal; (4) There is no known domestic violence risk record.

[0036] S4.2: For each target user, calculate the feature contribution weight of that target user based on its standardized feature vector using Formula 1; Formula 1; in, It is the feature contribution weight of the d-th eigenvector. It is the variance of the d-th eigenvector; Specifically, feature contribution weights Defined as the proportion of the variance of this dimension to the sum of the variances of all dimensions, and ; variance ,in For the first The larger the mean and variance of a feature, the more dispersed it is in normal samples, and the stronger its ability to distinguish between normal and abnormal samples. Therefore, it should be assigned a higher segmentation probability. S4.3: Randomly select from the normal user sample database A sample set is created from the standardized feature vectors of the target users. Set up the sample set The depth and height, combined with the sample set The depth and height are recursively used to construct a weighted isolated tree; Specifically, the height of the weighted isolation tree To avoid overfitting due to excessively deep trees; S4.4: Set multiple recursion termination conditions to determine whether the recursive construction of the weighted isolated tree satisfies any of the recursion termination conditions; Specifically, the recursion termination condition includes: (1) Depth exceeded: Current depth The tree has grown to its maximum permissible height; (2) Insufficient samples: The number of samples in the current node There are not enough samples to continue splitting; (3) No difference in features: All samples in the current node have the same 12-dimensional feature values, and samples cannot be distinguished by feature splitting.

[0037] S4.5: If the recursive construction of the weighted isolated tree satisfies any recursion termination condition, then stop the recursion, create a leaf node, and record the number of samples contained in the leaf node. S4.6: If the recursive construction of the weighted isolated tree does not satisfy any recursive termination condition, then the subtree is recursively constructed.

[0038] It should be noted that by inputting the user's standardized feature vector into the Isolation Forest model, the model calculates the path length from the root node to the leaf node by letting the standardized feature vector "walk" through multiple isolated trees. Since abnormal samples are sparsely distributed in the feature space, they are easier to be randomly segmented and quickly isolated, so their average path length is shorter. In contrast, normal samples are densely distributed and require more segmentation to be isolated, so their average path length is longer. The Isolation Forest model calculates anomaly scores based on the average path length, and the higher the score, the more abnormal the sample.

[0039] Traditional isolated forests randomly and uniformly select feature dimensions without considering the differences in importance among different features. This invention introduces feature contribution weights. This allows features with high variance and strong discriminative ability to participate in segmentation earlier, improving anomaly detection efficiency.

[0040] A single subsampling scale is insufficient to simultaneously account for both local and global anomalies. This invention constructs forests with three different subsampling scales. Through weighted fusion To achieve multi-scale detection, for a normal user sample database Subsampling size The number of samples randomly drawn from the complete normal sample library when constructing a single tree is used to avoid problems such as excessive tree depth and difficulty in isolating anomalies caused by training with all samples, thereby improving the generalization ability of the isolated forest model. When constructing an isolated forest, 100 weighted isolated trees need to be constructed independently.

[0041] In one embodiment of this application, step S4.6 includes the following steps: S4.61: Set sampling probability and with sampling probability Feature dimensions are randomly selected from the standardized feature vectors of the target users; S4.62: Obtain the sample set According to the sample set The node samples are arranged in ascending order of their values ​​on the selected feature dimension; S4.63: Real-time calculation of adaptive lower quartiles based on sample size and adaptive upper quartiles ; Specifically, ; ; in, This represents the number of samples in the current node. This is for rounding up; , The current node sample uniquely determines the weighted isolated trees, different nodes, and different features corresponding to each other. , All changes are dynamically and adaptively, without relying on human experience values.

[0042] S4.64: In the adaptive interval [ , Uniformly and randomly select segmentation values ​​v within the range; Specifically, This strategy eliminates the subjective defects of fixed quantiles, ensuring that the splitting value v always falls within the dense sample region, avoiding invalid splits caused by extreme values, and allowing the splitting rules to dynamically adapt to the data distribution, significantly improving the splitting effectiveness and model robustness. S4.65: Combine the selected feature dimension and the segmentation value v to divide the current node sample into left child node and right child node, call the tree construction function, use the left child node and right child node as the new current node sample set, construct the left subtree and right subtree, until the entire weighted isolated tree is constructed; Specifically, the left child node and the right child node: ; The tree construction function is called recursively, starting with the left child node. and right child node As the new current node sample set, depth As the new current depth, construct the left and right subtrees until the entire weighted isolated tree is constructed.

[0043] It should be noted that by setting the sampling probability To address the differences in the discriminative power of different features in domestic violence detection scenarios, a random sampling method is used to assign higher selection probabilities to features with high discriminative power, ensuring that key features participate in tree splitting earlier, while guaranteeing that all features have the opportunity to participate in splitting, thereby improving the isolation efficiency of abnormal samples.

[0044] For the selected feature dimension Based on the current node sample set The real-time distribution of data and dynamic calculation of adaptive quartiles achieve deep coupling between the segmentation value and the sample data. Traditional isolated forests randomly select segmentation values ​​across the entire feature value range, which easily leads to ineffective splits due to falling into sparse sample regions. This invention employs a node-level adaptive quartile segmentation strategy, which calculates the segmentation value in real time based on the current sample. and The model selects a segmentation value v to make each split data-driven and adaptive, improving the efficiency and accuracy of anomaly detection. The segmentation value v is dynamically calculated and fixed to the tree structure only during the model training phase. During the model testing phase, the trained isolated tree structure and the determined segmentation value v are used directly without recalculating the segmentation value, ensuring detection efficiency and result consistency.

[0045] In one embodiment of this application, step S4 further includes the following steps: S4.7: Define the subsampling size of the m-th forest group Based on subsampling size Construct multiple weighted isolation trees to obtain m groups of isolated forests; S4.8: Randomly select multiple target users from the normal user sample library as the validation set, simulate the injection of known domestic violence abnormal patterns, and construct a labeled validation sample set; Optionally, in order to select the weight combination with the highest accuracy as the preferred coefficient of the present invention, different weight combinations can be traversed and the anomaly detection accuracy under each combination can be calculated. S4.9: Define the performance factors for the m-th isolated forest. Then, normalization is performed to obtain the ensemble weights of m isolated forests. ,in, It is the subsampling size of the m-th forest group. It is the feature contribution weight of the d-th eigenvector; through the performance factor This comprehensively reflects the ability to distinguish features and the adaptability of subsampling. , and .

[0046] It should be noted that, in order to take into account both local and global anomaly detection, this application uses m=3 as an example, that is, constructing three isolated forests with different subsampling sizes, and defining the subsampling size of the m-th group (m=1,2,3) as: ; Each group constructs t=100 weighted isolated trees, resulting in three isolated forests. After training, the model parameters, namely the structure, segmentation dimension, and segmentation value of each weighted isolation tree, are saved to a file for subsequent detection.

[0047] The weighting calculation model assigns higher weights to isolated forests with stronger feature discrimination capabilities and better subsampling scale adaptability, achieving a precise match between detection performance and model characteristics, while taking into account both detection sensitivity and stability.

[0048] In one embodiment of this application, step S5 includes the following steps: S5.1: Obtain multi-source heterogeneous behavior data of the user to be tested, and input the multi-source heterogeneous behavior data of the user to be tested into the trained isolated forest model to calculate the standardized feature vector of the user to be tested. S5.2: Create a set of test samples based on the standardized feature vector of the user to be tested, calculate the path length of the user to be tested in each weighted isolated tree in each group of isolated forests based on the set of test samples, and take the arithmetic mean of the path lengths of the user to be tested in all weighted isolated trees in each group of isolated forests as the average path length of the user to be tested in that group of isolated forests. S5.3: Define the normalization factor for the m-th isolated forest group. Normalization factor As a benchmark, it corrects for deviations in the average path length of the tested users caused by different sampling scales; S5.4: Calculate the group anomaly score of the user under test in the m-th isolated forest, and then sum the anomaly scores of the m isolated forests based on the corresponding feature contribution weights to obtain the final anomaly score of the user under test. S5.5: Set a risk threshold, calculate the historical cumulative risk coefficient of the user under test based on the risk threshold, determine the risk trend of the user under test by combining the historical cumulative risk coefficient, and judge the risk level of the user under test by combining the final abnormal score of the user under test and the risk trend of the user under test.

[0049] It should be noted that for the k-th weighted isolated tree in the m-th isolated forest, the standardized feature vector of the user to be detected is traversed downwards from the root node according to the split dimension and split value of each node. The feature value of the standardized feature vector of the user to be detected in the corresponding split dimension is compared with the split value, and the user is selected to enter the left subtree or the right subtree, until the leaf node is reached. The number of edges traversed from the root node to the leaf node is recorded, which is the path length. .

[0050] For the m-th isolated forest group, calculate the standardized feature vector of the user to be detected, and the path length on all 100 weighted isolated trees in this isolated forest group. The arithmetic mean of the values ​​is used as the average path length from the m-th forest group to user u. ,Right now .

[0051] To eliminate the interference of subsampling size on path length calculation and to achieve comparability of results for isolated forests of different sizes, a normalization factor is defined for the m-th group of isolated forests. This factor represents The theoretical average path length of a binary search tree constructed from random samples is calculated using the following formula: ; in For the harmonic number, through Euler's constant Approximate calculation, i.e. Normalization factor As a benchmark, it is used to correct path length deviations under different sampling scales, ensuring that the detection results among isolated forests at multiple scales have uniform comparability.

[0052] For the standardized feature vector of the user to be tested, calculate the group anomaly score of the m-th isolated forest for that user, using the following formula: ; Let u be the abnormal score of the m-th group of the user being tested. It is the standardized feature vector of the user under test, when the average path length of the user under test... When I was very young, A value close to 1 indicates that the user under test is considered an anomaly in the m-th isolated forest; when the average path length is close to the normalization factor... hour, A value close to 0.5 indicates that the user being tested is normal; when the average path length is very large, A value close to 0 indicates that the user being tested is highly normal.

[0053] Standardized feature vectors for the same user to be detected The group outlier scores of the three isolated forests were analyzed. The final anomaly score for the user under test is obtained by weighting and summing the results according to the corresponding fusion weights. ; in, It is the final anomaly score of the user being tested. The three sets of isolated forest fusion weights determined in the preceding steps are used to calculate the final anomaly score. The final abnormality score comprehensively reflects the abnormal risk of domestic violence for the user under test. The higher the score, the greater the probability of the user being tested being abnormal.

[0054] In one embodiment of this application, step S5.5 includes the following steps: S5.51: Calculate the final anomaly score of all target users in the normal user sample database, and set the medium-risk threshold according to the cumulative distribution function of the final anomaly scores of all target users. and high risk threshold ; Specifically, calculate the final anomaly score for all users in the normal user sample database, and let its cumulative distribution function be... ,but: ; Specifically, the baseline medium-risk threshold is set at the 95th percentile of the abnormal scores of normal users, and the baseline high-risk threshold is set at the 99th percentile. This setting statistically ensures that only 5% of normal users will be judged as medium-risk or above, and only 1% will be judged as high-risk, effectively controlling the false alarm rate at its source and ensuring the reliability of detection.

[0055] S5.52: Obtain the K most recent abnormal score sequences of the user under test, and combine the K most recent abnormal score sequences of the user under test with the risk threshold to calculate the historical risk cumulative coefficient of the user under test; Specifically, the historical risk accumulation coefficient is used to quantify the degree of risk accumulation in a user's historical detection results, and it is defined as follows: ; in, It is the historical risk cumulative coefficient, and K is the total number of outlier score sequences, and , It is a medium-risk threshold. It is a high-risk threshold. This refers to the abnormal score of the j-th group of the user being tested. The average of the percentage of abnormal scores exceeding the baseline medium-risk threshold in each detection is used as the historical risk accumulation coefficient. When all historical detections for a user are below the medium-risk threshold... =0; when all historical detections of the user have reached a high-risk level (s=1), This coefficient reflects the cumulative level of a user's historical risk level.

[0056] S5.53: Combine the K most recent abnormal score sequences of the user under test with the Spearman rank correlation coefficient to determine the risk trend of the user under test; Specifically, risk trends are used to quantify the changing trends of a user's anomaly scores. For example, if the anomaly score sequence of a user's last three detections is... Arranged in chronological order ( The earliest, (Latest) Calculate the Spearman rank correlation coefficient between the anomaly score sequence and the time sequence {1,2,3}. The Spearman rank correlation coefficient is a statistic that measures the degree of monotonic correlation between two variables, and its value ranges from [ ]. [1,1] is used to characterize the trend of abnormal scores over time, and the risk trend coefficient is defined as: ; when hour, This indicates that abnormal scores are on the rise, and the risk is worsening; when hour, This indicates that the risk has not shown a worsening trend.

[0057] S5.54: Define a correction factor for the historical detection count of the user under test, and combine the correction factor for the historical detection count with the medium-risk threshold of the user under test. and high risk threshold Dynamic updates are performed to obtain the dynamic medium-risk threshold for the user under test. and dynamic high-risk threshold ; Specifically, if the user to be tested is a new user or has no historical testing records, the number of available historical testing attempts K is relatively small. In this case, the baseline threshold is used directly. and Making judgments may result in thresholds that are too high or too low, leading to false positives. To address this issue, a correction coefficient for the historical detection count of the user under test is defined. This is used to quantify the sufficiency of historical detection information and, based on this, reduce the magnitude of threshold adjustment. This represents the minimum number of valid historical checks. When a user's historical check count is less than 3, the historical check count correction factor is applied. This indicates that historical risk information is insufficient, and the threshold adjustment range should be reduced.

[0058] Based on the above adjustment factors, the formula for calculating the dynamic threshold is: ; in, It is a dynamic high-risk threshold. It is a dynamic risk threshold. The steepness coefficient of the S-shaped function is used to control the degree of influence of risk trends on the threshold; it is an adjustment factor. The value range is [0.5, 1). When the value is 0.5, When the value approaches 1, this design allows for the accumulation of historical risks by the user. The larger the value, the greater the threshold reduction; when the user's risk trend... The larger the value, the larger the adjustment factor, and the greater the threshold reduction. This applies when the user's historical detection count is insufficient. Smaller values ​​reduce the adjustment range and prevent excessive threshold shift due to insufficient information.

[0059] S5.55: Determine the final anomaly score and dynamic risk threshold of the user under test. Dynamic high-risk threshold The size of the test result is used to determine the risk level of the user to be tested. Optionally, to enhance the interpretability of the detection results, this invention outputs the key features that cause the anomaly and their degree of deviation, for each of the 12-dimensional features obtained in the aforementioned steps. Calculate its original value Degree of deviation from the mean of the normal range: ; in, It is the mean of the i-th feature. It is the standard deviation of the i-th feature, representing the degree of deviation of the 12 features. Sort the features from largest to smallest and select the three features with the largest deviation as outlier factors.

[0060] Based on the selected feature type and deviation direction, a readable explanatory text is generated by matching from a preset explanatory library.

[0061] This application pre-sets explanatory texts for each of the 12-dimensional features in different anomaly directions. It can also generate and issue timely warnings based on the explanatory texts and the risk level of the user under test. The warning information includes the user identifier, risk level, anomaly score, anomaly factor explanation, and detection timestamp. The specific explanatory texts are as follows: like The posting time discrete entropy was selected and The value is too low, indicating that "the posting time is highly concentrated, which may indicate an explosive surge in requests for help." like Circadian rhythm deviation was selected and >3, generate "Abnormally active in the early morning hours, may be seeking help when unattended late at night"; like The posting interval mutation index was selected and >2.0 generates "Posting frequency fluctuates drastically, and behavior patterns are extremely unstable"; like The recent silence duration was selected and >14, generates "If you haven't updated your status for more than two weeks, you may be restricted from using communication tools"; like Posting rhythm stability was selected and >0.5 generates "The posting time pattern has been disrupted, and there may be significant changes in daily life"; like Interactive volatility coefficient was selected and If the value is less than 0.3, the message "Interaction volume is abnormally stable, which may indicate that the account is being manipulated by others" will be generated. like Interactive volatility coefficient was selected and >2.0 generates "interaction volume fluctuates wildly, social connection is extremely unstable"; like The interaction decay trend was selected and >2.0 generates "Interaction volume continues to decline, and social circles may be gradually cut off"; like The percentage of posts with zero interaction was selected and If the value is >0.5, the message "Many posts have no interaction and the person may have been socially isolated" will be generated. like If the interaction / follower ratio deviation is selected and the deviation is >3.0, the message "Interaction volume and follower count are seriously mismatched, data may be abnormal" will be generated. like The social diversity index was selected and If the value is less than 0.5, the message "The interaction objects are extremely limited, and the social circle may be restricted" will be generated. like Time-interaction relevance was selected and This generates the message that "interaction volume continues to decline over time, and social attention is constantly being lost." like Social Network Cohesion Index was selected and <0.1 generates "the social network structure is loose and the connections are fragile".

[0062] It should be noted that traditional anomaly detection methods use fixed thresholds for risk assessment, without considering the differences in users' historical detection results. In domestic violence detection scenarios, if a user has repeatedly been on the edge of medium to high risk in historical detections, it indicates that the user may be in a long-term risk state, and the threshold should be appropriately lowered to improve the sensitivity of the warning. Conversely, if a user has consistently been in a low-risk state in historical detections, a higher threshold should be maintained to avoid false alarms due to normal fluctuations. Therefore, this invention introduces a dynamic threshold adjustment mechanism based on users' historical detection records.

[0063] After applying the dynamic threshold adjustment mechanism, the risk level determination rules for this application can be obtained as follows: ; That is, when the final anomaly score of the user under test... Greater than or equal to the dynamic high-risk threshold When the user is identified as a high-risk user, the final abnormal score of the user is determined to be... Greater than or equal to the dynamic risk threshold And the final abnormal score Less than the dynamic high-risk threshold When the user to be tested is determined to be a medium-risk user; when the final abnormal score of the user to be tested... Less than the dynamic risk threshold At that time, the user to be tested was determined to be a low-risk user.

[0064] like Figure 3 As shown, in one embodiment of this application, a multi-source behavioral anomaly detection system for domestic violence features in social text is also provided, applied to the multi-source behavioral anomaly detection method for domestic violence features in social text as described in any one of the preceding claims. The system includes a data acquisition component 100 and a detection component 200. The data acquisition component 100 acquires multi-source heterogeneous behavioral data of the target user. The detection component 200 is communicatively connected to the data acquisition component 100. All data acquired by the data acquisition component 100 is input to the detection component 200. The detection component 200 determines the risk level of the target user based on the multi-source heterogeneous behavioral data and issues a warning based on the risk level.

[0065] It should be noted that this application uses the detection component 200 combined with the multi-source heterogeneous behavioral data of the target user collected by the acquisition component 100 to determine the risk level of the target user, and issues a timely warning when a target user with high or medium risk is detected, so as to avoid the occurrence of domestic violence. In the judgment process, this application adopts a dynamic threshold judgment mechanism, which is adaptively adjusted in combination with the target user's historical risk, trend and detection information, to improve the warning sensitivity of long-term high-risk objects and make the risk judgment more scientific and more in line with reality.

[0066] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely preferred examples and are not intended to limit the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A method for detecting anomalies in multi-source behavioral domestic violence features in social text, characterized in that, include: S1: Set the collection parameters, and collect multi-source heterogeneous behavioral data of the target user through incremental sampling based on the collection parameters. Introduce a behavioral fingerprint adaptive modulation strategy to adjust the collection parameters. By extracting data from the multi-source heterogeneous behavioral data, multiple standardized behavioral data are obtained. S2: Extract the corresponding multi-dimensional behavioral features based on the standardized behavioral data of each target user, and standardize the multi-dimensional behavioral features to create a standardized feature vector for each multi-dimensional behavioral feature; S3: Create an isolated forest model; S4: Input the standardized feature vector of the target user into the isolated forest model, calculate the feature contribution of the feature vector through the isolated forest model, construct weighted isolated trees recursively, create m groups of isolated forests based on multiple weighted isolated trees, define the performance factor of each group of isolated forests, and calculate the ensemble weight of the m groups of isolated forests by combining the performance factors of the m groups of isolated forests, and obtain the trained isolated forest model. S5: Collect multi-source heterogeneous behavioral data of the users to be tested, input the multi-source heterogeneous behavioral data of the users to be tested into the trained Isolation Forest model, calculate the path length and average path length of the users to be tested, and correct them by normalization factor to obtain the group anomaly score of the m-th group of the users to be tested, and perform multi-scale fusion by combining the m-th group anomaly scores to obtain the final anomaly score of the users to be tested, and perform risk prediction on the users to be tested based on the final anomaly score.

2. The method for detecting anomalies in multi-source behavioral domestic violence features in social text as described in claim 1, characterized in that: Step S1 includes the following steps: S1.1: Define the sampling number N. Based on the sampling number N, incremental sampling is performed on the public behavior data of the target user through an information entropy-driven adaptive scrolling strategy to obtain the multi-source heterogeneous behavior data of the target user. S1.2: Dynamically adjust the current collection status parameters, time distribution information entropy, and entropy upper bound based on the target user's behavioral characteristics; S1.3: Construct a behavioral event model, which expresses the multi-source heterogeneous behavioral data of the target user as a five-dimensional feature vector structure: ;in, For behavioral events, For user identifier vectors, For event type vectors, The vector of the target object, For time feature vectors, Metadata dictionary vector; S1.4: For each piece of multi-source heterogeneous behavioral data, the core fields are located and extracted using cascading style sheets to obtain structured behavioral data: ,in, For structured behavioral data oriented towards users, This is the main behavioral data set, where "fans" represents the number of followers a user has. For behavioral events, N is the number of samples; Specifically, ,in, This represents the feature vector of the i-th post. To standardize release times, For the number of likes, This refers to the number of comments and interactions.

3. The method for detecting anomalies in multi-source behavioral domestic violence features in social text as described in claim 2, characterized in that: The multi-dimensional behavioral features include time-based behavioral dynamics features, social interaction topology features, and comprehensive correlation features. The time-based behavioral dynamics features include posting time discrete entropy, diurnal rhythm deviation, posting interval mutation index, recent silence duration, and posting rhythm stability. The social interaction topology features include interaction fluctuation coefficient, interaction decay trend, proportion of posts with zero interaction, interaction / follower ratio deviation, and social diversity index. The comprehensive correlation features include time-interaction correlation and social network cohesion index.

4. The method for detecting anomalies in multi-source behavioral domestic violence features in social text as described in claim 3, characterized in that: Step S2 includes the following steps: S2.1: Based on structured behavioral data The behavioral dynamics features, social interaction topology features, and comprehensive correlation features of the target users are extracted respectively. S2.2: Combine the target user's behavioral dynamics features, social interaction topology features, and comprehensive correlation features to obtain the target user's original feature vector F; S2.3: Standardize the original feature vector of the target user, transforming it into a standardized feature vector. .

5. The method for detecting anomalies in multi-source behavioral domestic violence features in social text as described in claim 4, characterized in that: Step S4 includes the following steps: S4.1: Input the standardized feature vectors of multiple target users as a normal user sample library into the isolated forest model; S4.2: For each target user, calculate the feature contribution weight of that target user based on its standardized feature vector using Formula 1; Official 1; in, It is the feature contribution weight of the d-th eigenvector. It is the variance of the d-th eigenvector; S4.3: Randomly select from the normal user sample database A sample set is created from the standardized feature vectors of the target users. Set up the sample set The depth and height, combined with the sample set The depth and height are recursively used to construct a weighted isolated tree; S4.4: Set multiple recursion termination conditions to determine whether the recursive construction of the weighted isolated tree satisfies any of the recursion termination conditions; S4.5: If the recursive construction of the weighted isolated tree satisfies any recursion termination condition, then stop the recursion, create a leaf node, and record the number of samples contained in the leaf node. S4.6: If the recursive construction of the weighted isolated tree does not satisfy any recursive termination condition, then the subtree is recursively constructed.

6. The method for detecting anomalies in multi-source behavioral domestic violence features in social text according to claim 5, characterized in that: Step S4.6 includes the following steps: S4.61: Set sampling probability and with sampling probability Feature dimensions are randomly selected from the standardized feature vectors of the target users; S4.62: Obtain the sample set According to the sample set The node samples are arranged in ascending order of their values ​​on the selected feature dimension; S4.63: Real-time calculation of adaptive lower quartiles based on sample size and adaptive upper quartiles ; S4.64: In the adaptive interval [ , Uniformly and randomly select segmentation values ​​v within the range; S4.65: Combine the selected feature dimension and the segmentation value v to divide the current node sample into left and right child nodes, call the tree construction function, use the left and right child nodes as the new current node sample set, construct the left subtree and right subtree, until the entire weighted isolated tree is constructed.

7. The method for detecting anomalies in multi-source behavioral domestic violence features in social text as described in claim 6, characterized in that: Step S4 further includes the following steps: S4.7: Define the subsampling size of the m-th forest group Based on subsampling size Construct multiple weighted isolation trees to obtain m groups of isolated forests; S4.8: Randomly select multiple target users from the normal user sample library as the validation set, simulate the injection of known domestic violence abnormal patterns, and construct a labeled validation sample set; S4.9: Define the performance factors for the m-th isolated forest. Then, normalization is performed to obtain the ensemble weights of m isolated forests. ,in, It is the subsampling size of the m-th forest group. It is the feature contribution weight of the d-th eigenvector; through the performance factor This comprehensively reflects the ability to distinguish features and the adaptability of subsampling. , and .

8. The method for detecting anomalies in multi-source behavioral domestic violence features in social text according to claim 7, characterized in that: Step S5 includes the following steps: S5.1: Obtain multi-source heterogeneous behavior data of the user to be tested, and input the multi-source heterogeneous behavior data of the user to be tested into the trained isolated forest model to calculate the standardized feature vector of the user to be tested. S5.2: Create a set of test samples based on the standardized feature vector of the user to be tested, calculate the path length of the user to be tested in each weighted isolated tree in each group of isolated forests based on the set of test samples, and take the arithmetic mean of the path lengths of the user to be tested in all weighted isolated trees in each group of isolated forests as the average path length of the user to be tested in that group of isolated forests. S5.3: Define the normalization factor for the m-th isolated forest group. Normalization factor As a benchmark, it corrects for deviations in the average path length of the tested users caused by different sampling scales; S5.4: Calculate the group anomaly score of the user under test in the m-th isolated forest, and then sum the anomaly scores of the m isolated forests based on the corresponding feature contribution weights to obtain the final anomaly score of the user under test. S5.5: Set a risk threshold, calculate the historical cumulative risk coefficient of the user under test based on the risk threshold, determine the risk trend of the user under test by combining the historical cumulative risk coefficient, and judge the risk level of the user under test by combining the final abnormal score of the user under test and the risk trend of the user under test.

9. The method for detecting anomalies in multi-source behavioral domestic violence features in social text as described in claim 8, characterized in that: Step S5.5 includes the following steps: S5.51: Calculate the final anomaly score of all target users in the normal user sample database, and set the medium-risk threshold according to the cumulative distribution function of the final anomaly scores of all target users. and high risk threshold ; S5.52: Obtain the K most recent abnormal score sequences of the user under test, and combine the K most recent abnormal score sequences of the user under test with the risk threshold to calculate the historical risk cumulative coefficient of the user under test; S5.53: Combine the K most recent abnormal score sequences of the user under test with the Spearman rank correlation coefficient to determine the risk trend of the user under test; S5.54: Define a correction factor for the historical detection count of the user under test, and combine the correction factor for the historical detection count with the medium-risk threshold of the user under test. and high risk threshold Dynamic updates are performed to obtain the dynamic medium-risk threshold for the user under test. and dynamic high-risk threshold ; S5.55: Determine the final anomaly score and dynamic risk threshold of the user under test. Dynamic high-risk threshold The size of the risk level is determined, and the risk level of the user to be tested is determined based on the judgment result.

10. A multi-source behavioral domestic violence anomaly detection system for social text, applied to the multi-source behavioral domestic violence anomaly detection method for social text as described in any one of claims 1 to 9, characterized in that, include: Data acquisition components; The acquisition component collects multi-source heterogeneous behavioral data of the target user. Detection components; The detection component is communicatively connected to the acquisition component. All data information acquired by the acquisition component is input to the detection component. The detection component determines the risk level of the target user based on the target user's multi-source heterogeneous behavioral data and issues an early warning based on the target user's risk level.

Images