A fraud attack detection method based on multi-source information fusion

Abstract

The application discloses a fraud attack detection method based on multi-source information fusion, which comprises the following steps: step one, obtaining the rating behavior data of users in a collaborative filtering recommendation system; step two, extracting multi-source information features from the rating behavior data; step three, multi-view integrated detection based on optimal feature subset division; step four, an automatic detection method based on edge noise reduction encoders; step five, an unsupervised detection method based on a user relationship graph; and step six, fusing multiple detection results to determine a final fraud attack profile. Through multi-source information fusion and multi-level feature extraction, the application significantly improves the detection accuracy and generalization ability of fraud attacks, reduces the dependence on prior knowledge in the detection process, improves the automation level and detection timeliness, and is suitable for various attack models and actual detection scenes, thereby providing efficient and reliable security protection for a recommendation system.

Description

Technical Field

[0001] This invention relates to the field of data security technology for recommendation systems, and in particular to a fraud attack detection method based on multi-source information fusion. Background Technology

[0002] With the rapid development of computer and network technologies, information supply has become diverse, and massive amounts of data have permeated and integrated into all aspects of production and life. Information overload has become a common problem in the information society. Recommendation systems, as an effective means to alleviate information overload, are widely used in e-commerce and other fields, playing a very important role in improving webpage views, product conversion rates, and customer loyalty. In order to protect recommendation systems from attacks, fraud attack detection has become a research hotspot in the field of recommendation systems.

[0003] Currently, people mainly rely on supervised, semi-supervised, and unsupervised algorithms in machine learning to detect various fraud attacks. These algorithms depend on information such as user rating values, rating time, and item popularity in user rating behavior. This technology can find similar nearest neighbors based on the user's historical rating profile and generate recommendation results for the target user based on the profile information of multiple nearest neighbors. The prediction pattern of collaborative filtering recommendation system conforms to the behavior pattern of people in real life. However, its openness also provides an opportunity for malicious users. That is, malicious users can inject a large number of fake user profiles into the rating system to generate recommendation results that are favorable to them.

[0004] Detecting various fraud attacks that threaten collaborative filtering recommendation systems, ensuring recommendation quality, and guaranteeing the credibility of system recommendations are urgent problems that need to be solved for the healthy development of collaborative filtering recommendation systems. Currently, some fraud attack detection methods have been proposed, but these methods still have problems such as single feature extraction information sources, high knowledge costs or prior knowledge requirements, low detection accuracy, and weak generalization ability, making it difficult to effectively deal with complex and ever-changing attack patterns. Therefore, this invention proposes a fraud attack detection method based on multi-source information fusion to solve the problems existing in the prior art. Summary of the Invention

[0005] To address the aforementioned problems, the present invention aims to propose a fraud attack detection method based on multi-source information fusion. This method extracts multi-dimensional features by fusing multi-source information such as item popularity, rating time, and rating value delay in user rating behavior. It constructs a multi-view integrated detection model based on optimal feature subset partitioning and multi-kernel learning, achieves automatic feature extraction using an edge noise reduction encoder, and combines user relationship graphs and community detection algorithms for unsupervised detection, effectively improving the accuracy, generalization ability, and automation level of fraud attack detection.

[0006] To achieve the objectives of this invention, the invention is implemented through the following technical solution: a fraud attack detection method based on multi-source information fusion, comprising the following steps: Step 1: Obtain user rating behavior data from the collaborative filtering recommendation system, including user ID, item ID, rating value, and rating timestamp; Step 2: Extract multi-source information features from the rating behavior data, including the fusion features of item popularity and rating time, the fusion features of rating value and rating time, and the distribution features of rating delay. Step 3: Optimize the feature subsets of the extracted multi-source information features, construct multiple detection perspectives, and use a multi-kernel learning method to automatically fuse the detection results of multiple detection perspectives to form a multi-view integrated detection model and output the first detection result. Step 4: Construct an edge noise reduction encoder, set differentiated noise levels for different projects, extract low-dimensional automatic features, construct an integrated detection model for automatic feature extraction and fraud attacks, and output the second detection result. Step 5: Construct a user relationship graph, extract graph features using a sparse noise reduction autoencoder and reconstruct the user relationship graph, and use a community detection algorithm based on the reconstructed user relationship graph to identify the community where the attack profile is located, and output the third detection result; Step 6: Combine the first, second, and third detection results to determine the final profile of the fraudulent attack.

[0007] A further improvement is that, in step two, the fusion feature of project popularity and rating time is specifically achieved by statistically analyzing the popularity sequence of each project within a fixed time window, aligning the rating time of the target user with the popularity sequence, and calculating the degree of deviation of the user's rating time from the peak or trough of the project's popularity as the fusion feature.

[0008] A further improvement is that, in step two, the fusion feature of rating value and rating time is specifically achieved by jointly encoding the rating value sequence and the rating time sequence for each user to generate a rating-time joint distribution vector, and then using a sliding window to calculate the gradient of this vector on the time axis.

[0009] A further improvement is that the rating delay distribution characteristics in step two include statistical characteristics of the time interval between two consecutive rating actions by the user, including the mean, variance, median, interquartile range, and skewness.

[0010] The further improvement is that the feature subset optimization and partitioning in step three adopts the optimal feature subset selection method based on mutual information or genetic algorithm, which divides the extracted multi-source information features into multiple non-overlapping or partially overlapping feature subsets, and each feature subset corresponds to a detection perspective. The multi-kernel learning method assigns a basic kernel function to each detection viewpoint. The kernel parameters of different basic kernel functions are adaptively determined based on the data distribution of the corresponding feature subsets. The multi-kernel fusion weights are automatically obtained by solving the multi-kernel learning optimization problem.

[0011] The further improvement lies in the fact that the edge noise reduction encoder in step four is constructed based on the user's rating distribution and the rating patterns of various attack models; The differentiated noise level is set to a lower noise level for projects with high popularity and a higher noise level for projects with low popularity, with the noise level being negatively correlated with the popularity of the project.

[0012] The further improvement lies in the fact that the low-dimensional automatic features in step four are extracted using the sparse coefficient weighting method. Specifically, the sparse coefficient weighting method uses L1 regularization to constrain the hidden activation values ​​of the autoencoder and allocates sparse penalty weights according to the size of the activation values, so that the feature dimensions related to the attack mode obtain higher sparse weights.

[0013] The further improvement is that the user relationship graph in step five is constructed based on the comprehensive similarity between users calculated from the user's rating behavior. Specifically, each user is a graph node. If the comprehensive similarity between two users is greater than a preset threshold, an edge is established between the corresponding nodes, and the weight of the edge is the comprehensive similarity value. The overall similarity between users is obtained by weighted fusion of rating similarity and rating behavior temporal similarity. The rating similarity uses the Pearson correlation coefficient, and the rating behavior temporal similarity uses the dynamic time-normalized distance.

[0014] A further improvement is that: in step five, the user relationship graph reconstruction specifically involves taking the adjacency matrix of the user relationship graph as input, learning a low-dimensional representation of the graph structure through a sparse noise reduction autoencoder, and then reconstructing a new adjacency matrix based on the low-dimensional representation, wherein the reconstruction error is used to identify abnormal nodes.

[0015] The beneficial effects of this invention are as follows: By integrating multi-source information such as project popularity, rating time, and rating value delay, this invention constructs a fraud attack detection framework that integrates multi-view integrated detection, automatic feature extraction by edge noise reduction encoder, and user relationship graph community discovery, which significantly improves the detection accuracy and robustness of collaborative filtering recommendation systems against various fraud attacks. Meanwhile, the method of this invention reduces the reliance on prior knowledge and manual feature engineering, enhances the generalization ability across attack models and detection scenarios, and improves the automation level and timeliness of detection, thereby effectively ensuring the security of the recommendation system and the credibility of the recommendation results. Attached Figure Description

[0016] Figure 1This is a flowchart of the overall process of the method of the present invention.

[0017] Figure 2 This is a flowchart of the multi-source information feature extraction process of the present invention.

[0018] Figure 3 This is a flowchart illustrating the user relationship graph construction and community discovery and detection process of this invention. Detailed Implementation

[0019] To enhance understanding of the present invention, the present invention will be further described in detail below with reference to embodiments. These embodiments are only used to explain the present invention and do not constitute a limitation on the scope of protection of the present invention.

[0020] Example according to Figure 1 , Figure 2 and Figure 3 As shown, this embodiment provides a fraud attack detection method based on multi-source information fusion, including the following steps: Step 1: Obtain user rating behavior data from the collaborative filtering recommendation system, including user ID, item ID, rating value, and rating timestamp.

[0021] Step 2: Extract multi-source information features from the rating behavior data, including the fusion features of item popularity and rating time, the fusion features of rating value and rating time, and the distribution features of rating delay. The specific feature of the fusion of project popularity and rating time is to statistically analyze the popularity sequence of each project according to a fixed time window, align the rating time of the target user with the popularity sequence, and calculate the degree of deviation of the user's rating time from the peak or trough of the project's popularity as the fusion feature. The specific feature of the fusion of rating value and rating time is that, for each user, their rating value sequence and rating time sequence are jointly encoded to generate a rating-time joint distribution vector, and the gradient of the change of the vector on the time axis is calculated by using a sliding window. The rating delay distribution characteristics include statistical features such as mean, variance, median, interquartile range, and skewness of the time interval between two consecutive user rating actions.

[0022] Step 3: Optimize the feature subsets of the extracted multi-source information features, construct multiple detection perspectives, and use a multi-kernel learning method to automatically fuse the detection results of multiple detection perspectives to form a multi-view integrated detection model and output the first detection result. The feature subset optimization partitioning adopts the optimal feature subset selection method based on mutual information or genetic algorithm, which divides the extracted multi-source information features into multiple non-overlapping or partially overlapping feature subsets, with each feature subset corresponding to a detection perspective; The multi-kernel learning method assigns a basic kernel function to each detection perspective. The kernel parameters of different basic kernel functions are adaptively determined based on the data distribution of the corresponding feature subsets. The multi-kernel fusion weights are automatically obtained by solving the multi-kernel learning optimization problem.

[0023] Step 4: Construct an edge noise reduction encoder, set differentiated noise levels for different projects, extract low-dimensional automatic features, construct an integrated detection model for automatic feature extraction and fraud attacks, and output the second detection result. The edge noise reduction encoder is built based on the user rating distribution and the rating patterns of various attack models; The differentiated noise level is set to a lower noise level for projects with high popularity and a higher noise level for projects with low popularity, with the noise level being negatively correlated with the popularity of the project. Low-dimensional automatic features are extracted using a sparse coefficient weighting method. Specifically, the sparse coefficient weighting method uses L1 regularization to constrain the hidden activation values ​​of the autoencoder and assigns sparse penalty weights according to the size of the activation values, so that the feature dimensions related to the attack mode obtain higher sparse weights.

[0024] Step 5: Construct a user relationship graph, extract graph features using a sparse noise reduction autoencoder and reconstruct the user relationship graph, and use a community detection algorithm based on the reconstructed user relationship graph to identify the community where the attack profile is located, and output the third detection result; The user relationship graph is constructed based on the comprehensive similarity between users calculated from their rating behavior. Specifically, each user is a node in the graph. If the comprehensive similarity between two users is greater than a preset threshold, an edge is established between the corresponding nodes, and the weight of the edge is the comprehensive similarity value. The overall similarity between users is obtained by weighted fusion of rating similarity and rating behavior temporal similarity. The rating similarity adopts the Pearson correlation coefficient, and the rating behavior temporal similarity adopts the dynamic time-normalized distance. The user relationship graph reconstruction specifically involves taking the adjacency matrix of the user relationship graph as input, learning a low-dimensional representation of the graph structure through a sparse denoising autoencoder, and then reconstructing a new adjacency matrix based on the low-dimensional representation. The reconstruction error is used to identify abnormal nodes.

[0025] The community detection algorithm is either the Louvain algorithm based on modularity optimization or the community partitioning algorithm based on spectral clustering. After partitioning the community on the reconstructed user relationship graph, the ratio of the average comprehensive similarity of nodes within each community to the average comprehensive similarity of nodes between communities is calculated. If the ratio exceeds a preset threshold, the community is identified as an attack profile community.

[0026] Step 6: Combine the first, second, and third detection results to determine the final profile of the fraudulent attack.

[0027] The fusion method adopts a weighted voting method, in which the weight of each detection result is dynamically adjusted according to its detection accuracy on the validation set, or a stacked generalization method is used to train a meta-classifier for the final decision.

[0028] Finally, based on the finalized profile of the fraudulent attack, a blacklist of fraudulent users is generated, and user rating data from the blacklist is removed from the training data of the collaborative filtering recommendation system to update the recommendation model.

[0029] Application examples This application example provides a fraud attack detection method based on multi-source information fusion, applied to a collaborative filtering recommendation system of an e-commerce platform. The platform has 100,000 users and 50,000 product items. The collected user rating behavior data includes: user ID, item ID, rating value (1-5 points), and rating timestamp (accurate to the second). It is known that the platform is subject to "shill attacks," where attackers inject fake user profiles in batches to give the highest or lowest scores to target products in order to manipulate the recommendation results.

[0030] Step 1: Obtain user rating behavior data from the collaborative filtering recommendation system. The user-item rating records for the most recent 90 days were extracted from the recommender system database, yielding approximately 2 million rating records. Each rating record is organized into a 5-tuple format: (u i ,p j ,r ij ,t ij ), where u i Representing users i and p j Representing project j, r ij Let t be the rating score given by user i for item j. ij This is the timestamp of the rating. Newly registered users or users with fewer than 5 rating records are not included in the detection scope to ensure the reliability of feature statistics.

[0031] Step 2: Extract multi-source information features from rating behavior data 1. Integration of Project Popularity and Rating Time Characteristics First, calculate p for each item. j Popularity sequence within a time window; dividing the time axis into continuous windows W, with days as the unit. k For project p j Count the total number of times it is rated in each window, denoted as pop(p). j W k The popularity curve is obtained by smoothing the pop sequence (e.g., by moving average).

[0032] For target user u iFor project p j Scoring time t ij Determine t ij Time window W k Calculate the popularity pop(p) corresponding to this window. j W k Further calculation of t ij Distance from project p j Time offset of the peak popularity window ΔT=|kk peak | and the offset from the valley window; pop(p j W k The number of times a user rates a project in this window is used as a fusion feature vector of project popularity and rating time, with a dimension of 5.

[0033] 2. Features of the fusion of rating value and rating time For each user u i The rating value sequence and the rating time sequence are jointly encoded; specifically, all user ratings are arranged in chronological order to obtain the sequence: (r i1 ,t i1 ),(r i2 ,t i2 ),…,(r iN ,t iN The time axis is discretized into equally spaced buckets (e.g., one bucket every 6 hours). Within each bucket, the average rating, variance of the rating, and number of ratings given by users are statistically analyzed. Then, the statistical features of each bucket are concatenated to form a joint rating-time distribution vector, with the vector length equal to the number of buckets × 3. In this application example, 60 buckets are used (covering 15 days), so the joint distribution vector is 180-dimensional. Then, a sliding window (window size of 10 buckets, step size of 5 buckets) is used to calculate the gradient of the vector on the time axis, including first-order and second-order differences, and finally, dimensionality reduction is obtained to obtain 24-dimensional features.

[0034] 3. Characteristics of scoring delay distribution For each user u i Calculate the time interval Δt between two consecutive rating actions. k =t i(k+1) -t ik From all Δt k The following statistical features were extracted: mean, variance, median, interquartile range (IQR), skewness, kurtosis, as well as the maximum interval, minimum interval, proportion of intervals less than 1 hour, and proportion of intervals greater than 24 hours; a total of 11 dimensions of score delay distribution features were obtained.

[0035] By concatenating the above three types of features, each user ultimately obtains a 5+24+11=40-dimensional multi-source information feature vector.

[0036] Step 3: Multi-view ensemble detection based on optimal feature subset partitioning Using the 40-dimensional features extracted in step two, a multi-view ensemble detection model is constructed, including: 1. Feature subset optimization partitioning A feature selection method based on mutual information is adopted. First, using a small subset of labeled real user and attack user data (1000 real users and 500 known attack users are labeled in this application example), the mutual information value between each feature and the category label is calculated. Then, the features are sorted from high to low according to the mutual information value. The sorted features are divided into four non-overlapping feature subsets: subset F1 contains the top 10 features with the highest mutual information, subset F2 contains the next 10 features, subset F3 contains the next 10 features, and subset F4 contains the last 10 features. Each feature subset corresponds to a detection perspective.

[0037] 2. Multi-core learning fusion For each feature subset F s Construct a basis kernel function K for each of the following (s=1,2,3,4): s This application example uses a Gaussian radial basis function (RBF) kernel: K s (x,y)=exp(-γ s ||xy|| 2 ), where the kernel parameter γ s Based on feature subset F s The average distance between sample pairs is adaptively determined: γ s =1 / (median(||xy|| 2 )).

[0038] Then, a multi-core learning method is used to automatically learn the fusion weight β of each basic kernel. s Such that the combined kernel K=Σ s β s K s Maximize the classification margin on the training set; this application example uses the SimpleMKL algorithm to solve the optimization problem and obtains the weight vector β=[0.45,0.30,0.15,0.10]; a support vector machine (SVM) classifier is trained based on the combined kernel, and the first detection result (fraud probability value, range 0-1) is output for each user.

[0039] Step 4: Automatic Detection Method Based on Edge Noise Reduction Encoder Automatic features are learned directly from the original rating matrix, including: 1. Data Preprocessing Construct a user-item rating matrix R∈R M×N, where M is the number of users (100,000 in this example) and N is the number of items (50,000); due to the high sparsity of the matrix, only the columns of items rated by each user are retained; for missing values, 0 is used to fill in (indicating no rating); the rating vector of each user is normalized so that its mean is 0 and its standard deviation is 1.

[0040] 2. Construction of edge noise reduction encoder Construct a three-layer denoising autoencoder: the input layer has a dimension of N (number of items), the hidden layer has a dimension of 512, and the output layer has a dimension of N; introduce item noise into the input layer, with the noise level negatively correlated with the item popularity; specifically, for item p... j Its popularity j Defined as the total number of times the rating is given, after normalization, we get ||pop j ||∈[0,1];Set the noise level j =0.3×(1-||pop j ||)+0.05, meaning high-popularity items have lower noise (minimum 0.05), and low-popularity items have higher noise (maximum 0.35). During training, for each dimension j in the input vector x, noise is expressed with probability. j Set it to 0 (i.e. discard the rating information for this item).

[0041] 3. Sparsity coefficient weighting L1 sparse regularization is applied to the hidden layer activation values, and different sparse penalty weights are assigned to different hidden layer units; specifically, the weight w of the h-th hidden layer unit... h =1 / (1+exp(-α h )), where α h The average intensity of the activation values ​​of this unit; the final loss function is: L=||x'-x|| 2 +λΣ h w h |a h |, where x' is the reconstructed output, a h λ is the hidden layer activation value, and λ is 0.001.

[0042] 4. Training and Testing The autoencoder is trained using stochastic gradient descent (SGD) for 100 iterations with a batch size of 256. After training, for each user, their original rating vector is input into the encoder to obtain a 512-dimensional hidden feature representation. Then, a binary classifier (logistic regression is used in this application example) is trained based on this feature representation to output a second detection result (fraud probability value).

[0043] Step 5: Unsupervised Detection Method Based on User Relationship Graph Exploiting communities through user relationship graph mining, specifically: 1. Calculate the overall user similarity. For any two users u i and u j Calculate their rating similarity sim rating (u i ,u j = Cosine similarity (based on the rating value vector of shared rating items); simultaneously, calculate the temporal similarity sim of rating behavior. time (u i ,u j = The reciprocal of the Dynamic Time Warped (DTW) distance (based on the time series ratings of two users), and the final comprehensive similarity is a weighted sum: sim(u i ,u j ) = 0.7 × sim rating (u i ,u j )+0.3×sim time (u i ,u j ); If the number of items to be scored together is less than 3, then directly set sim. rating =0.

[0044] 2. Construct a user relationship graph Taking each user as a node, if sim(u i ,u j If the threshold θ is greater than the threshold (0.6 in this example), then an undirected edge is established between nodes i and j, with the edge weight being sim(u). i ,u j Since the full user graph is too dense, in actual construction, only the top K neighbors with the highest similarity for each user are retained (K is 50) to reduce the amount of computation, and finally a sparse user relationship graph G=(V,E,w) is obtained.

[0045] 3. Sparse noise reduction autoencoder reconstruction relationship diagram The adjacency matrix A∈R of the user relationship graph M×M As input (M is the number of users); since M is very large (100,000), this application example uses a sampling method, randomly selecting 5000 users each time to form a subgraph for training; a sparse denoising autoencoder is constructed, with both the input and output layers having a dimension of 5000 and the hidden layer having a dimension of 256. When inputting the adjacency matrix, 5% of the non-zero edges are randomly set to 0 (denoising); after training, the encoder maps the adjacency vector of each user to a 256-dimensional graph feature representation, and then reconstructs a new adjacency matrix A' based on this representation; the reconstruction error err is calculated. i =||Ai -A' i || 2 (A) i (where i is the row vector of user i in the adjacency matrix), users with large reconstruction errors may be abnormal nodes.

[0046] 4. Overview of Community-Detected Attacks On the reconstructed user relationship graph, the Louvain algorithm is used for community partitioning. The Louvain algorithm iteratively merges communities by maximizing modularity. After obtaining the community partitioning, for each community C, the average comprehensive similarity (avg) of the nodes within the community is calculated. intra (C) and the average comprehensive similarity between nodes in the community (avg) inter (C), calculate the ratio R(C) = avg intra (C) / avg inter (C), if R(C)>2.0 and the community size is greater than 10, then the community is identified as an attack profile community, and all users in the community are marked as suspected attack users; for each marked user, the third detection result (fraud probability value, marked as 1, otherwise 0) is output.

[0047] Step Six: Integrate multiple detection results to determine the final profile of the fraud attack. A weighted voting method is used to fuse the three detection results output from steps three, four, and five. The accuracy of each detector is calculated on the validation set (containing 2000 labeled users): accuracy of step three acc1 = 0.92, accuracy of step four acc2 = 0.89, and accuracy of step five acc3 = 0.85. Normalization yields the weights: w1 = 0.92 / (0.92 + 0.89 + 0.85) ≈ 0.346, w2 ≈ 0.334, w3 ≈ 0.320. The final fraud probability for each user is: P final =w1×P1+w2×P2+w3×P3.

[0048] Set the decision threshold τ = 0.65, if P final If the value is greater than or equal to τ, the user is considered a fraudulent attacker; otherwise, the user is considered a legitimate user.

[0049] Finally, based on the finalized profile of the fraud attack, a blacklist of fraudulent users is generated. All rating records of users in the blacklist are removed from the training data of the collaborative filtering recommendation system. Then, the recommendation model is retrained to improve the credibility of the recommendation results.

[0050] To verify the effectiveness, various attack models (random attack, mean attack, and popularity attack) were injected into the public dataset MovieLens 1M with attack scales of 5%, 10%, and 15%. The method of this invention was used for detection, and the results show that at an attack scale of 10%, the detection accuracy reached 94.2%, the recall reached 91.5%, and the F1 score reached 92.8%, significantly outperforming baseline methods that use only a single information source (such as only rating values). Furthermore, it also demonstrates good generalization ability on novel, unseen attack patterns.

[0051] The foregoing has shown and described the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The embodiments and descriptions in the specification are merely illustrative of the principles of the invention. Various changes and modifications can be made to the invention without departing from its spirit and scope, and all such changes and modifications fall within the scope of the present invention as claimed. The scope of protection of the present invention is defined by the appended claims and their equivalents.

Claims

1. A fraud attack detection method based on multi-source information fusion, characterized in that, Includes the following steps: Step 1: Obtain user rating behavior data from the collaborative filtering recommendation system, including user ID, item ID, rating value, and rating timestamp; Step 2: Extract multi-source information features from the rating behavior data, including the fusion features of item popularity and rating time, the fusion features of rating value and rating time, and the distribution features of rating delay. Step 3: Optimize the feature subsets of the extracted multi-source information features, construct multiple detection perspectives, and use a multi-kernel learning method to automatically fuse the detection results of multiple detection perspectives to form a multi-view integrated detection model and output the first detection result. Step 4: Construct an edge noise reduction encoder, set differentiated noise levels for different projects, extract low-dimensional automatic features, construct an integrated detection model for automatic feature extraction and fraud attacks, and output the second detection result. Step 5: Construct a user relationship graph, extract graph features using a sparse noise reduction autoencoder and reconstruct the user relationship graph, and use a community detection algorithm based on the reconstructed user relationship graph to identify the community where the attack profile is located, and output the third detection result; Step 6: Combine the first, second, and third detection results to determine the final profile of the fraud attack.

2. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: The specific feature of fusing project popularity and rating time in step two is as follows: for each project, its popularity sequence is statistically analyzed according to a fixed time window; the rating time of the target user is time-series aligned with the popularity sequence; and the degree of deviation of the user's rating time from the peak or trough of the project's popularity is calculated as the fusion feature.

3. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: The specific feature of the fusion of rating value and rating time in step two is that, for each user, their rating value sequence and rating time sequence are jointly encoded to generate a rating-time joint distribution vector, and the gradient of the vector on the time axis is calculated using a sliding window.

4. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: The rating delay distribution characteristics in step two include statistical features of the time interval between two consecutive rating actions by a user, including the mean, variance, median, interquartile range, and skewness.

5. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: In step three, the feature subset optimization partitioning adopts the optimal feature subset selection method based on mutual information or genetic algorithm, which divides the extracted multi-source information features into multiple non-overlapping or partially overlapping feature subsets, with each feature subset corresponding to a detection perspective. The multi-kernel learning method assigns a basic kernel function to each detection viewpoint. The kernel parameters of different basic kernel functions are adaptively determined based on the data distribution of the corresponding feature subsets. The multi-kernel fusion weights are automatically obtained by solving the multi-kernel learning optimization problem.

6. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: In step four, the edge noise reduction encoder is constructed based on the user's rating distribution and the rating patterns of various attack models; The differentiated noise level is set to a lower noise level for projects with high popularity and a higher noise level for projects with low popularity, with the noise level being negatively correlated with the popularity of the project.

7. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: In step four, the low-dimensional automatic features are extracted using a sparse coefficient weighting method. Specifically, the sparse coefficient weighting method uses L1 regularization to constrain the hidden activation values ​​of the autoencoder and assigns sparse penalty weights according to the size of the activation values, so that the feature dimensions related to the attack mode obtain higher sparse weights.

8. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: In step five, the user relationship graph is constructed based on the comprehensive similarity between users calculated from the user's rating behavior. Specifically, each user is a graph node. If the comprehensive similarity between two users is greater than a preset threshold, an edge is established between the corresponding nodes, and the weight of the edge is the comprehensive similarity value. The overall similarity between users is obtained by weighted fusion of rating similarity and rating behavior temporal similarity. The rating similarity uses the Pearson correlation coefficient, and the rating behavior temporal similarity uses the dynamic time-normalized distance.

9. The fraud attack detection method based on multi-source information fusion according to claim 1, characterized in that: In step five, the user relationship graph reconstruction specifically involves taking the adjacency matrix of the user relationship graph as input, learning a low-dimensional representation of the graph structure through a sparse noise reduction autoencoder, and then reconstructing a new adjacency matrix based on the low-dimensional representation. The reconstruction error is used to identify abnormal nodes.

Images