Cross-platform account association identification method and system based on multi-dimensional feature fusion

Abstract

The present application relates to a cross-platform account association recognition method and system based on multi-dimensional feature fusion, specifically relates to the field of network security and big data risk control technology, the scheme extracts the multi-modal features of the image-text content, publishing behavior and IP device environment in parallel, uses the meta-learner in the adaptive weighted fusion model to dynamically allocate the fusion weight according to the information entropy, generates the global feature fingerprint resistant to camouflage; the density clustering algorithm is combined with the cosine similarity and the high threshold and the interval threshold value, the cross-platform fake account cluster without explicit association is automatically mined through the density reachability; the artificial review result is fed back to the adaptive weighted fusion model as a supervision label for incremental training, the fusion weight is dynamically allocated, and the precision tracing ability of the deep camouflage ghost account cluster is significantly improved.

Description

Technical Field

[0001] This invention relates to the fields of network security and big data risk control technology, and more specifically, to a cross-platform account association identification method and system based on multi-dimensional feature fusion. Background Technology

[0002] In today's multi-platform internet ecosystem, a single user can register numerous anonymous or alias accounts on multiple online platforms. By switching accounts, they can evade platform supervision, engage in malicious marketing, manipulate public opinion, and illegally divert traffic. In particular, organized black market groups, online trolls, and foreign forces no longer use simple text replacement or single-account operations. Instead, they employ highly organized and professional clusters of "ghost accounts." These accounts deliberately mimic normal users in text content, while randomly scheduling their posts, mimicking human interaction rhythms, and using virtual devices, frequently changing IP proxies, and sharing device pools while logging in at off-peak times to achieve comprehensive and deep disguise. Furthermore, such account clusters have hundreds or thousands of accounts scattered across different platforms, working together to complete tasks such as ranking manipulation, comment control, and traffic diversion. Once their disguise strategy is exposed, they quickly update their characteristics to form new variants. Due to the different data formats, field definitions, and API interfaces of different platforms, coupled with privacy protection restrictions that prevent the sharing of core log data between platforms, existing risk control systems are often powerless against such highly disguised cross-platform account clusters.

[0003] Existing cross-platform account association identification technologies have significant technical shortcomings. Single text matching schemes rely solely on keywords or semantic similarity such as nicknames and comment texts for association, allowing users to easily evade detection by simply modifying text or changing wording, resulting in extremely high false positive and false negative rates. While single behavior profiling schemes can statistically analyze features such as posting time and frequency, behavioral patterns can be precisely simulated by programs, and new accounts lack historical data, making it difficult to establish a reliable baseline. Device fingerprinting schemes are constrained by stricter privacy regulations and the development of anti-fingerprinting technologies, leading to a continuous decline in the stability and uniqueness of device identifiers. More importantly, existing technologies typically treat text, behavior, and device features in isolation, setting thresholds for each separately, lacking an effective multi-dimensional feature fusion mechanism. This results in static weights being unable to adapt to dynamically changing masquerade strategies, and cross-platform association relies solely on explicit binding relationships between accounts, lacking effective means to mine ghost account clusters with similar behavioral patterns but no explicit associations. Therefore, there is an urgent need for a cross-platform account association identification scheme that can integrate multi-dimensional weak signals, adaptively adjust feature weights, and mine implicit associations to improve the accurate tracing capability of ghost account clusters in deeply disguised environments. Summary of the Invention

[0004] This invention addresses the technical problems existing in the prior art by providing a cross-platform account association identification method and system based on multi-dimensional feature fusion, thereby solving the problems mentioned in the background art.

[0005] The technical solution of this invention to solve the above-mentioned technical problems is as follows: a cross-platform account association identification method based on multi-dimensional feature fusion, specifically including the following steps:

[0006] Step S1: Collect full-dimensional data of the target account on multiple network platforms and perform cleaning and preprocessing. Normalize the heterogeneous data formats in the full-dimensional data of different platforms into a unified standard. Then extract the modal features of text and image content, modal features of publishing behavior, and modal features of IP device environment in parallel, and generate corresponding text and image feature vectors, behavioral feature vectors, and device feature vectors respectively.

[0007] Step S2: Input the image and text feature vector, behavior feature vector and device feature vector into the pre-built adaptive weighted fusion model. The meta-learner in the adaptive weighted fusion model dynamically allocates fusion weights according to the information entropy of each modality feature vector in the current batch of input data, and generates a unique global feature fingerprint for each account.

[0008] Step S3: Map the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space, use density clustering algorithm to calculate the cosine similarity between any two fingerprints, and determine strongly related homologous accounts and suspected related alias accounts based on the set high threshold and interval threshold. Then, automatically mine cross-platform alias account clusters composed of multiple accounts through density reachability to obtain clustering results.

[0009] Step S4: Output the clustering results in the form of a cross-platform account association graph, and feed the manually reviewed association results as supervision labels into the adaptive weighted fusion model for incremental training to continuously optimize the dynamic allocation of fusion weights.

[0010] In a preferred embodiment, the specific operation of extracting the modal features of the text and image content in step S1 is as follows:

[0011] The collected text content is encoded into a text embedding matrix using a pre-trained language model, and the image content is encoded into an image embedding matrix using a pre-trained visual model. Global average pooling is performed on the text embedding matrix to obtain a text global pooling vector, and global average pooling is performed on the image embedding matrix to obtain an image global pooling vector.

[0012] Then, the text global pooling vector and the image global pooling vector are input into the low-rank bilinear pooling and tensor ring decomposition fusion module. The low-rank bilinear pooling and tensor ring decomposition fusion module performs nonlinear transformations on the text global pooling vector and the image global pooling vector respectively through multiple learnable parameter matrices, and then performs element-wise multiplication. The results of multiple multiplications are then summed by tensor ring contraction along the rank direction, and finally outputs a text-image feature vector. The text-image feature vector contains deep interactive information of text semantics and image vision.

[0013] In a preferred embodiment, the specific operation of extracting the publishing behavior modal features in step S1 is as follows:

[0014] All behavioral events of the target account are arranged in chronological order of occurrence into a multivariate time series. The observation vector at each time point represents whether event types such as posting, liking, and commenting have occurred at that moment.

[0015] Multivariate time series data are input into a pre-trained neural network frequent differential equation model. The neural network frequent differential equation model starts with a hidden state that is initially zero. The rate of change of the hidden state over time is calculated through a parameterized neural network. A numerical integrator is used to integrate the rate of change of the hidden state over time from the start time to the end time to obtain the hidden state at the end time. The hidden state at the end time is used as the behavior feature vector.

[0016] The specific steps for extracting the environmental modal features of IP devices are as follows: the device and network information is abstracted into a heterogeneous graph, in which nodes include account nodes, device nodes, IP nodes, and network operator nodes, and edges in the heterogeneous graph represent publishing relationships; a graph isomorphic network is used to pass messages to each account node, and the graph isomorphic network aggregates the neighborhood information of the account node through a multilayer perceptron and learnable scalar parameters, and outputs the embedded representation of the account node after multilayer message passing, and uses the embedded representation as the device feature vector.

[0017] In a preferred embodiment, the specific operation of the meta-learner in the adaptive weighted fusion model in step S2, which dynamically allocates fusion weights based on the information entropy of each modality feature vector in the current batch of input data, is as follows:

[0018] First, the image and text feature vector, behavior feature vector and device feature vector output in step S1 are respectively subjected to L2 normalization so that the magnitude of each feature vector becomes one, and the normalized image and text feature vector, normalized behavior feature vector and normalized device feature vector are obtained.

[0019] Then, for each modality among the text and image content modality, publishing behavior modality, and IP device environment modality, the L1 norm of all normalized feature vectors of each modality in the current batch is calculated, and the L1 norm is transformed into a probability distribution through the softmax function. The information entropy of the probability distribution is then calculated as the modality discrimination index.

[0020] Simultaneously, the absolute value of the average cosine similarity between each mode and the other two modes is calculated as an index of mode orthogonality.

[0021] The modality discrimination index and modality orthogonality index are input into a learnable parameterized function. The function generates unnormalized weights through exponential operations and linear combinations, and then obtains the final fusion weights through softmax normalization.

[0022] In a preferred embodiment, the specific operation of generating a unique global feature fingerprint for each account in step S2 is as follows:

[0023] The normalized image and text feature vector, the normalized behavior feature vector, and the normalized device feature vector are multiplied by their respective fusion weights and then weighted and summed to obtain the global feature fingerprint of each account.

[0024] Meanwhile, the learnable parameters of the meta-learner are trained end-to-end using a contrastive learning loss function. This loss function increases the cosine similarity between global feature fingerprints within the same account cluster and decreases the cosine similarity between global feature fingerprints between different account clusters, thereby optimizing the allocation strategy of the fusion weights.

[0025] In a preferred embodiment, the specific operation of mapping the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space in step S3 is as follows:

[0026] First, L2 normalize each global feature fingerprint output in step S2 so that the magnitude of each fingerprint becomes one, thus obtaining the normalized global feature fingerprint.

[0027] Then, for each normalized global feature fingerprint, calculate its Euclidean distance to the preset number of nearest neighbors, where the preset number is a preset parameter. Then multiply the Euclidean distance by a scaling factor to obtain the adaptive neighborhood radius of the fingerprint.

[0028] Next, the cosine similarity between any two normalized global feature fingerprints is calculated, and it is determined whether one fingerprint falls within the adaptive neighborhood of the other fingerprint. The determination condition is that the cosine similarity is greater than the angle threshold converted from the adaptive neighborhood radius and is also greater than the preset minimum similarity threshold.

[0029] In a preferred embodiment, the specific operation of automatically mining cross-platform clone account clusters through density reachability in step S3 is as follows:

[0030] Set a high threshold and a lower limit for the interval threshold. For any two normalized global feature fingerprints, if the cosine similarity is greater than or equal to the high threshold, they are directly marked as strongly related homologous accounts. If the cosine similarity is between the lower limit of the interval threshold and the high threshold, they are marked as suspected related pseudonyms and added to the candidate neighborhood.

[0031] Then, a density clustering algorithm is used to define the fingerprints that contain at least the minimum number of other fingerprints in the adaptive neighborhood as core points. Starting from each core point, a breadth-first search is used to find all density-reachable fingerprints and classify them into the same cluster. Fingerprints that are not density-reachable by any core point are marked as noise.

[0032] Finally, the mean cosine similarity within each cluster is calculated, and clusters with mean cosine similarity below the preset clustering threshold are removed. The remaining clusters are the cross-platform clone account clusters.

[0033] In a preferred embodiment, the specific operation of outputting the clustering results in the form of a cross-platform account association graph in step S4 is as follows:

[0034] Map each cluster obtained in step S3 and its contained account IDs to a graph structure. Each graph node is an account. Graph edges are divided into strongly related edges and suspected related edges according to cosine similarity. Strongly related edges are established between account pairs with cosine similarity greater than or equal to the high threshold, and suspected related edges are established between account pairs with cosine similarity between the lower limit and the high threshold of the interval. Each edge is accompanied by a correlation confidence and main feature basis.

[0035] Then, the review results of human auditors on each cluster in the graph are received, and the review results are converted into supervision labels. Account pairs that are manually confirmed to belong to the same pseudonym cluster are marked with positive labels, and account pairs that are manually confirmed not to belong to the same pseudonym cluster are marked with negative labels. All labels constitute the human review dataset.

[0036] In a preferred embodiment, the specific operation of feeding back the manually reviewed association results as supervisory labels to the adaptive weighted fusion model for incremental training in step S4 is as follows:

[0037] After the initial training phase of the adaptive weighted fusion model is completed, the importance weight of each meta-learner parameter is calculated. The importance weight is based on the average of the squared gradients of the contrastive learning loss of the parameter at each iteration step during the initial training process.

[0038] During the incremental training phase, an incremental loss function is constructed, which includes a contrastive learning loss term computed on the human-reviewed dataset and an elastic weight consolidation regularization term. The elastic weight consolidation regularization term is a weighted sum of the importance weights of each meta-learner parameter multiplied by the squares of the differences between the current and initial values ​​of the parameter, and then multiplied by a regularization coefficient. The Adam optimizer is used to minimize the incremental loss function to update the learnable parameters of the meta-learner.

[0039] This application also provides a cross-platform account association recognition system based on multi-dimensional feature fusion, specifically including:

[0040] Data acquisition and feature extraction module: Collects full-dimensional data of the target account on multiple network platforms, cleans and normalizes it, and then extracts modal features of text and image content, modal features of publishing behavior and modal features of IP device environment in parallel, generating corresponding text and image feature vectors, behavioral feature vectors and device feature vectors;

[0041] Adaptive fusion module: Inputs image and text feature vectors, behavioral feature vectors and device feature vectors into the adaptive weighted fusion model, dynamically allocates fusion weights through a meta-learner, and generates a unique global feature fingerprint for each account;

[0042] Density clustering module: Maps the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space to calculate cosine similarity, and determines strongly related homologous accounts and suspected related dummy accounts based on high thresholds and interval thresholds, mines cross-platform dummy account clusters, and obtains clustering results;

[0043] Feedback optimization module: Outputs clustering results in the form of cross-platform account association graph, and feeds back the association results verified by humans as supervision labels to the adaptive weighted fusion model for incremental training, so as to optimize the dynamic allocation of fusion weights.

[0044] The beneficial effects of this invention are as follows: By extracting multimodal features of text and image content, publishing behavior, and IP device environment in parallel, the meta-learner in the adaptive weighted fusion model dynamically allocates fusion weights based on information entropy to generate a global feature fingerprint that is resistant to spoofing; by using a density clustering algorithm combined with cosine similarity and high threshold and interval threshold judgment, cross-platform dummy account clusters without explicit association are automatically mined through density reachability; the results of manual review are fed back as supervision labels to the adaptive weighted fusion model for incremental training, continuously optimizing the dynamic allocation of fusion weights, thereby significantly improving the ability to accurately trace the source of deeply spoofed ghost account clusters. Attached Figure Description

[0045] Figure 1 This is a flowchart of the method of the present invention;

[0046] Figure 2 This is a block diagram of the system structure of the present invention. Detailed Implementation

[0047] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0048] In the description of this application, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this application, "multiple" means two or more, unless otherwise explicitly specified.

[0049] In the description of this application, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this application is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed in this application.

[0050] Example 1: This example provides the following... Figure 1 The cross-platform account association identification method shown here, based on multi-dimensional feature fusion, specifically includes the following steps:

[0051] Step S1: Collect full-dimensional data of the target account on multiple network platforms and perform cleaning and preprocessing. Normalize the heterogeneous data formats in the full-dimensional data of different platforms into a unified standard. Then extract the modal features of text and image content, modal features of publishing behavior, and modal features of IP device environment in parallel, and generate corresponding text and image feature vectors, behavioral feature vectors, and device feature vectors respectively.

[0052] Step S2: Input the image and text feature vector, behavior feature vector and device feature vector into the pre-built adaptive weighted fusion model. The meta-learner in the adaptive weighted fusion model dynamically allocates fusion weights according to the information entropy of each modality feature vector in the current batch of input data, and generates a unique global feature fingerprint for each account.

[0053] Step S3: Map the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space, use density clustering algorithm to calculate the cosine similarity between any two fingerprints, and determine strongly related homologous accounts and suspected related alias accounts based on the set high threshold and interval threshold. Then, automatically mine cross-platform alias account clusters composed of multiple accounts through density reachability to obtain clustering results.

[0054] Step S4: Output the clustering results in the form of a cross-platform account association graph, and feed the manually reviewed association results as supervision labels into the adaptive weighted fusion model for incremental training to continuously optimize the dynamic allocation of fusion weights.

[0055] In this embodiment, the specific operation of extracting the modal features of the image and text content in step S1 is as follows:

[0056] The collected text content is encoded into a text embedding matrix using a pre-trained language model, and the image content is encoded into an image embedding matrix using a pre-trained visual model. Global average pooling is performed on the text embedding matrix to obtain the text global pooling vector, and global average pooling is performed on the image embedding matrix to obtain the image global pooling vector. The pre-trained language model adopts the BERT model based on the Transformer architecture. This model has been pre-trained on a large-scale Chinese corpus for masked language modeling tasks and next sentence prediction tasks. It includes 12 Transformer encoder layers, 768-dimensional hidden layers, and 12 attention heads. After pre-training, the model parameters are frozen. The input text content is segmented into words and mapped to an initial vector sequence through word embedding layers and position encoding layers. Then, it is transformed layer by layer by 12 encoder layers. The average value of all token vectors in the last layer is taken as the row vector of the text embedding matrix. Finally, a text embedding matrix with the shape of the number of text segments multiplied by 768 is obtained.

[0057] The pre-trained visual model adopts the ResNet-50 architecture, which is pre-trained on the ImageNet dataset for an image classification task. It contains 49 convolutional layers and 1 fully connected layer. After pre-training, the last fully connected layer is removed, and the input image content is normalized to 224 by 224 pixels. Then, features are extracted sequentially through 5 residual block groups. The output feature map of the last residual block group is taken and global average pooling is performed to obtain a 2048-dimensional image embedding vector. Multiple image embedding vectors are stacked to form an image embedding matrix with a shape of the number of images multiplied by 2048.

[0058] Then, the text global pooling vector and the image global pooling vector are input into the low-rank bilinear pooling and tensor ring decomposition fusion module. This module performs nonlinear transformations on both the text and image global pooling vectors using multiple learnable parameter matrices, followed by element-wise multiplication. The multiple multiplication results are then summed along the rank direction using tensor ring contraction, ultimately outputting a single image-text feature vector. This feature vector simultaneously contains deep interactive information about both text semantics and image vision. The specific calculation process of the low-rank bilinear pooling and tensor ring decomposition fusion module is as follows: First, the rank of the tensor ring is set to 32, the intermediate hidden layer dimension is 128, and the final dimension of the image-text feature vector is 256. For each rank component, the 768-dimensional text global pooling vector is multiplied by the first learnable parameter matrix, which has a shape of 768 rows and 128 columns. The product result is then activated by hyperbolic tangent. After a nonlinear transformation of the function, it is multiplied by the second learnable parameter matrix, which has a shape of 128 rows and 256 columns, to obtain the text-side intermediate vector. Simultaneously, the 2048-dimensional image global pooling vector is multiplied by the third learnable parameter matrix, which also has a shape of 2048 rows and 128 columns. The product is then nonlinearly transformed by the hyperbolic tangent activation function and multiplied by the fourth learnable parameter matrix, which also has a shape of 128 rows and 256 columns, to obtain the image-side intermediate vector. The text-side intermediate vector and the image-side intermediate vector are then multiplied element-wise to obtain a 256-dimensional vector. This process is repeated 32 times, each time using a different set of four learnable parameter matrices, to obtain 32 256-dimensional vectors. These 32 vectors are then summed along the rank direction by tensor ring contraction, i.e., the 32 vectors are first arranged into a three-dimensional tensor, and then compressed and summed along the rank dimension, finally yielding a 256-dimensional image-text feature vector.

[0059] In step S1, the specific operation for extracting the modal features of publishing behavior is as follows:

[0060] All behavioral events of the target account are arranged in chronological order to form a multivariate time series. The observation vector at each time point represents whether an event type such as posting, liking, commenting, or forwarding has occurred at that moment. The method for obtaining behavioral events is as follows: through the compliant application programming interface provided by the platform, the dynamic information of the target account is polled at fixed time intervals. Each request returns all public behavioral event records of the account in the most recent 24 hours, including event type, event timestamp, and event-related content identifier. The returned event records are sorted in ascending order by timestamp. After removing duplicate and abnormal records, the continuous time axis is divided into equally spaced time windows in seconds. If a certain type of event occurs in each time window, the corresponding position is marked as 1, otherwise it is marked as 0. Finally, a multivariate time series matrix with the shape of the number of time windows multiplied by the number of event types is obtained, where the number of event types is 4, corresponding to posting, liking, commenting, and forwarding respectively.

[0061] Multivariate time series data are input into a pre-trained neural network frequent differential equation model (NDE). The NDE starts with a hidden state initialized to zero. A parameterized neural network calculates the rate of change of the hidden state over time, and a numerical integrator integrates this rate of change from the start time to the end time to obtain the hidden state at the end time. The hidden state at the end time is used as the behavioral feature vector. The pre-training process of the NDE involves collecting historical behavioral data from 10,000 normal accounts and 10,000 known alias accounts to construct a training dataset. The model parameters include a parameterized neural network and a numerical integrator. The parameterized neural network uses a three-layer fully connected network structure. The input layer dimension equals the hidden state dimension (64), the observation dimension (4), and the time dimension (1), for a total of 69 dimensions. The hidden layer dimension is 128, using the ReLU activation function. The output dimension is 64, consistent with the hidden state dimension. The numerical integrator adopts the Dormand-Prince 5th-order 4-step Runge-Kutta method, with an absolute tolerance of 10 to the power of -6, a relative tolerance of 10 to the power of -5, and a maximum integration step size of 3600 seconds. During training, the multivariate time series of each account from the start time to the end time is input into the model. The numerical integrator progressively calculates the evolution trajectory of the hidden state, and the hidden state at the end time is used as the output. It is compared with the true label, and the parameters are updated using the cross-entropy loss function and the Adam optimizer. The learning rate is set to 0.001, the number of training epochs is 100, and the batch size is 64. After training, the model parameters are frozen. For each new account, its multivariate time series is input into the model, and the numerical integrator calculates the integration from the start time to the end time to obtain the 64-dimensional hidden state at the end time, which is the behavioral feature vector of that account.

[0062] The specific steps for extracting IP device environment modal features are as follows: Device and network information is abstracted into a heterogeneous graph. Nodes in the heterogeneous graph include account nodes, device nodes, IP nodes, and network operator nodes. Edges in the heterogeneous graph represent login or posting relationships. The method for obtaining device and network information is as follows: Using the device fingerprint interface and network information interface provided by the platform, each time a target account logs in or posts content, the following information is collected: device model string, device unique identifier, operating system type string, IP address, IP network segment prefix, network operator name, statistics on the number of logged-in devices, statistics on the frequency of logins from different locations, and a list of commonly used login environments. The collected raw information is then encoded and converted: the device model string is mapped to a pre-built standard device library... Device ID and unique device identifier are hashed into fixed-length binary strings. Operating system type strings are mapped to enumeration values. IP addresses are converted to integers. The first 24 bits of the IP network segment prefix are extracted as subnet identifiers. Network operator names are mapped to enumeration values. When constructing the heterogeneous graph, each account, each device ID, each IP subnet identifier, and each network operator enumeration value is treated as a node. If an account has logged in on a device, an edge is added between the account node and the device node. If an account has used an IP subnet, an edge is added between the account node and the IP subnet node. If an account belongs to a network operator, an edge is added between the account node and the network operator node. The weight of each edge is uniformly set to 1.

[0063] A graph isomorphic network is used for message passing between each account node. The graph isomorphic network aggregates neighborhood information of account nodes through a multilayer perceptron and learnable scalar parameters. After multiple layers of message passing, it outputs the embedded representation of the account node, which is then used as the device feature vector. The specific computation process of the graph isomorphic network is as follows: The number of graph convolutional layers is set to 3, with each layer outputting a dimension of 128. The feature vector of each node is initialized: the initial feature of the account node is a 64-dimensional random vector; the initial feature of the device node is a 128-dimensional embedding vector of the device ID; the initial feature of the IP subnet node is a 128-dimensional embedding vector of the IP subnet identifier; and the initial feature of the network operator node is a 128-dimensional embedding vector of the operator enumeration value. For the first layer of graph convolution, for each node, first calculate its own feature vector multiplied by 1 and summed with the learnable scalar parameters, then add it to the sum of the feature vectors of all neighboring nodes. The sum is input into a multilayer perceptron, which contains a 128-dimensional hidden layer and a 128-dimensional output layer. The hidden layer uses the ReLU activation function, while the output layer does not use an activation function, resulting in the updated node feature vector of the first layer. The above process is repeated for the second and third layers of graph convolution, with the learnable scalar parameters and multilayer perceptron parameters of each layer trained independently. After three layers of message passing, the final feature vector of each account node is taken as the device feature vector of that account, with a dimension of 128.

[0064] The training process of the graph isomorphic network is as follows: using the same dataset as the behavioral feature extraction, the real association label of each account is used as the supervision signal, the contrastive loss function and Adam optimizer are used for parameter update, the learning rate is set to 0.0005, the number of training rounds is 50, and the batch size is 32; after training, the model parameters are frozen, and for each new account, the final feature vector of the corresponding account node in its heterogeneous graph is used as the device feature vector.

[0065] In this embodiment, it is specifically necessary to explain the operation of the meta-learner in the adaptive weighted fusion model in step S2, which dynamically allocates fusion weights based on the information entropy of each modality feature vector in the current input batch data:

[0066] First, the image / text feature vector, behavior feature vector, and device feature vector output in step S1 are subjected to L2 normalization, so that the magnitude of each feature vector becomes one, resulting in the normalized image / text feature vector, normalized behavior feature vector, and normalized device feature vector. The specific calculation process of L2 normalization is as follows: for each feature vector, first calculate the sum of squares of its components, then take the square root to obtain the Euclidean norm of the vector, and then divide each component of the vector by its Euclidean norm so that the Euclidean norm of the normalized vector is equal to one; if the Euclidean norm of the feature vector is zero, then set all its components to zero vectors.

[0067] Then, for each modality among the text / image content modality, publishing behavior modality, and IP device environment modality, the L1 norm of all normalized feature vectors in the current batch for each modality is calculated. The L1 norm is then transformed into a probability distribution using the softmax function, and the information entropy of the probability distribution is calculated as the modality discrimination index. The specific process for calculating the L1 norm is as follows: for each normalized feature vector, the absolute values ​​of all its components are summed to obtain the L1 norm of the vector. For all accounts in the current batch, each account has an L1 norm value in this modality, with a total of batch-size values. The softmax function is calculated as follows: first, the natural exponent of each L1 norm value is taken to obtain a batch of exponent values, and then each exponent value is divided by the sum of these exponent values ​​to obtain the probability value of each account. The information entropy is calculated as follows: the natural logarithm of each probability value is taken, multiplied by the probability value itself, the product of all accounts is summed, the negative number is taken, and finally divided by the batch size to obtain the information entropy value of this modality. The smaller the information entropy value, the higher the discrimination of this modality in the current batch.

[0068] Simultaneously, the absolute value of the mean cosine similarity between each modality and the other two modalities is calculated as a modality orthogonality index. The specific process for calculating the absolute value of the mean cosine similarity is as follows: For each account in the current batch, the dot product of the normalized feature vector of this modality and the normalized feature vector of another modality is calculated to obtain the cosine similarity of the two vectors, and the absolute value is taken; the absolute values ​​of all accounts are added together and divided by the batch size to obtain the absolute value of the mean cosine similarity between this modality and another modality; the above calculation is performed on this modality and the other two modalities respectively, and the two average values ​​are added together and divided by two to obtain the modality orthogonality index of this modality; the smaller the index, the better the orthogonality of this modality with other modalities, and the more unique information it carries;

[0069] The modality discrimination index and modality orthogonality index are input into a learnable parameterized function. The function generates unnormalized weights through exponential operations and linear combinations, and then normalizes them using softmax to obtain the final fused weights. The construction process of the learnable parameterized function is as follows: the function contains three learnable parameters, denoted as the first learnable parameter, the second learnable parameter, and the third learnable parameter; the first and second learnable parameters are positive values, and the third learnable parameter is any real number; the initial values ​​of the three learnable parameters are respectively... Let the values ​​be 1, 1, and 0. For each mode, multiply the mode discrimination index by the negative of the first learnable parameter, add the reciprocal of the mode orthogonality index multiplied by the second learnable parameter, and add the third learnable parameter to obtain a linear combination value. Take the natural exponent of this linear combination value to obtain the unnormalized weight of the mode. Perform softmax normalization on the unnormalized weights of the three modes: first calculate the sum of the three unnormalized weights, then divide each unnormalized weight by the sum to obtain the final fusion weight. The sum of the three fusion weights equals one.

[0070] The pre-construction process of the adaptive weighted fusion model is as follows: Collect a dataset of account samples containing known relationships. Each sample contains three feature vectors output from step S1 and their associated labels. Initialize the three learnable parameters of the meta-learner to preset values, set the optimizer to the Adam optimizer, the learning rate to 0.0001, the batch size to 64, and the number of training epochs to 200. In each training epoch, randomly select a batch from the dataset and sequentially perform L2 normalization, information entropy calculation, orthogonality calculation, parameterization function to generate weights, weighted summation to generate global feature fingerprints, and contrastive learning loss calculation. Update the three learnable parameters through backpropagation. After training, fix the values ​​of the three learnable parameters to obtain the pre-constructed adaptive weighted fusion model.

[0071] The specific steps in step S2 to generate a unique global feature fingerprint for each account are as follows:

[0072] The normalized image / text feature vector, normalized behavior feature vector, and normalized device feature vector are multiplied by their respective fusion weights and then summed in a weighted manner to obtain the global feature fingerprint for each account. The specific calculation process for the weighted summation is as follows: each component of the normalized image / text feature vector is multiplied by the fusion weight of the image / text content modality to obtain the weighted image / text feature vector; each component of the normalized behavior feature vector is multiplied by the fusion weight of the publishing behavior modality to obtain the weighted behavior feature vector; each component of the normalized device feature vector is multiplied by the fusion weight of the IP device environment modality to obtain the weighted device feature vector; the corresponding components of the three weighted feature vectors are summed to obtain the global feature fingerprint vector for each account, whose dimension is consistent with the dimension of the normalized feature vector.

[0073] Meanwhile, the learnable parameters of the meta-learner are trained end-to-end using a contrastive learning loss function. This loss function increases the cosine similarity between global feature fingerprints within the same account cluster and decreases the cosine similarity between global feature fingerprints from different account clusters, thereby optimizing the allocation strategy for fusion weights. The specific form of the contrastive learning loss function is as follows: For each account in the current batch, its global feature fingerprint is used as an anchor point. A global feature fingerprint from other accounts belonging to the same alias account cluster as the account is randomly selected as a positive sample. Global feature fingerprints from several other accounts not belonging to the same alias account cluster as the account are selected as negative samples. The cosine similarity between the anchor point and the positive samples is calculated, and then the cosine similarity between the anchor point and each negative sample is calculated. The cosine similarity between the anchor point and the positive samples is then calculated. The cosine similarity is expressed as a natural exponent to obtain the positive sample index value. The cosine similarity between the anchor point and each negative sample is expressed as a natural exponent to obtain the negative sample index value. The positive sample index value is divided by the sum of the positive sample index value and all negative sample index values ​​to obtain the contrastive loss contribution value of the account. The contrastive loss contribution values ​​of all accounts in the current batch are averaged and then the negative number is taken to obtain the final contrastive learning loss value. By minimizing this loss value, the fingerprint similarity of accounts in the same cluster increases and the fingerprint similarity of accounts in different clusters decreases. During training, the Adam optimizer is used with a learning rate of 0.0001, a batch size of 64, and 200 training epochs. All training data is traversed once in each epoch. During training, the three learnable parameters of the meta-learner are updated step by step through backpropagation until the loss value converges.

[0074] In this embodiment, it is specifically necessary to explain the operation of mapping the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space in step S3 as follows:

[0075] First, L2 normalization is performed on each global feature fingerprint output in step S2 to make the magnitude of each fingerprint one, thus obtaining the normalized global feature fingerprint. The specific calculation process of L2 normalization is as follows: For each global feature fingerprint, first calculate the sum of squares of all its components, then take the square root to obtain the Euclidean norm of the fingerprint, and then divide each component of the fingerprint by its Euclidean norm so that the Euclidean norm of the normalized fingerprint is equal to one. If the Euclidean norm of the global feature fingerprint is zero, then all its components are set as zero vectors.

[0076] Then, for each normalized global feature fingerprint, calculate its Euclidean distance to the preset number of nearest neighbors, where the preset number is a preset parameter. Multiply the Euclidean distance by a scaling factor to obtain the fingerprint's adaptive neighborhood radius. The specific process for calculating the preset number of nearest neighbors is as follows: the preset number is set to the square root of the total number of accounts to be analyzed, rounded down. For example, if the total number of accounts is 10000, the preset number is 100. For each normalized global feature fingerprint, calculate its Euclidean distance with all other normalized global feature fingerprints. The Euclidean distance is calculated as the square root of the sum of the squares of the differences between corresponding components of the two fingerprints. Sort all calculated distances in ascending order, and take the preset number of distance values ​​as the preset number of nearest neighbor Euclidean distances for that fingerprint. Set the scaling factor to 1.5, and multiply the preset number of nearest neighbor Euclidean distances by 1.5 to obtain the fingerprint's adaptive neighborhood radius. The larger the adaptive neighborhood radius, the lower the density of the fingerprint's region and the wider its neighborhood range.

[0077] Next, the cosine similarity between any two normalized global feature fingerprints is calculated, and it is determined whether one fingerprint falls within the adaptive neighborhood of the other fingerprint. The determination condition is that the cosine similarity is greater than the angle threshold converted from the adaptive neighborhood radius and is also greater than the preset minimum similarity threshold. The calculation process of cosine similarity is as follows: multiply the corresponding components of the two normalized global feature fingerprints, and then add all the products. The result is the cosine similarity, which ranges from -1 to +1. The closer the value is to +1, the more similar the two fingerprints are. The specific process of converting the angle threshold from the adaptive neighborhood radius is as follows: first divide the square of the adaptive neighborhood radius by two, and then subtract the value from one to get the cosine value. If the cosine value is less than -1, take -1; if it is greater than one, take 1. Finally, take the inverse cosine of the cosine value to get the angle threshold. The preset minimum similarity threshold is set to 0.3, which means that only when the cosine similarity is greater than 0.3 can it be considered a neighborhood member.

[0078] The comprehensive judgment condition is: the cosine similarity must be greater than the cosine value corresponding to the angle threshold and 0.3 at the same time for a fingerprint to be considered to fall within the adaptive neighborhood of another fingerprint. This dual judgment condition takes into account both local density adaptation and ensures the minimum global similarity baseline, avoiding the wrong association of completely unrelated accounts.

[0079] The specific steps in step S3 to automatically mine cross-platform clone account clusters using density reachability are as follows:

[0080] A high threshold and a lower threshold for the interval are set. For any two normalized global feature fingerprints, if the cosine similarity is greater than or equal to the high threshold, they are directly marked as strongly related homologous accounts. If the cosine similarity is between the lower threshold and the high threshold, they are marked as suspected related pseudonyms and added to the candidate neighborhood. The high threshold is set to 0.85, and the lower threshold for the interval is set to 0.6. When the cosine similarity of two normalized global feature fingerprints is greater than or equal to 0.85, the two accounts are considered to be highly likely to be operated by the same natural person and are directly marked as strongly related homologous accounts, with the highest confidence level for this association. When the cosine similarity is greater than or equal to 0.6 and less than 0.85, the two accounts are considered to have a certain degree of similarity but not enough to be directly identified as the same person. They are marked as suspected related pseudonyms and added to the candidate neighborhood list for further aggregation by the subsequent density clustering algorithm. Two accounts with a cosine similarity lower than 0.6 are considered to have no direct association and are not marked.

[0081] Then, a density clustering algorithm is used to define fingerprints that contain at least a minimum number of other fingerprints within their adaptive neighborhood as core points. Starting from each core point, a breadth-first search is used to find all density-reachable fingerprints and group them into the same cluster. Fingerprints that are not density-reachable by any core point are marked as noise. The specific execution process of the density clustering algorithm is as follows: the minimum number of samples is set to 3; first, all normalized global feature fingerprints are traversed. For each fingerprint, the number of other fingerprints (excluding itself) contained in its adaptive neighborhood is counted. If the number is greater than or equal to 3, the fingerprint is marked as a core point; then, starting from each unvisited core point, a cluster is created... A new cluster is created, and the core point is added to the cluster. A breadth-first search algorithm is used to recursively search for all fingerprints that are density-reachable from the core point: for each fingerprint in the current cluster, all other fingerprints in its adaptive neighborhood are checked. If these fingerprints have not yet been assigned to any cluster, they are added to the current cluster, and the neighborhood of the newly added fingerprint is checked. The breadth-first search uses a queue data structure to enqueue and dequeue the fingerprints to be checked in turn until the queue is empty. After all core points and their density-reachable fingerprints have been processed, fingerprints that have not been assigned to any cluster are marked as noise. These noise fingerprints represent normal user accounts and do not belong to any clone account clusters.

[0082] Finally, the mean cosine similarity within each cluster is calculated, and clusters with mean cosine similarity below a preset clustering threshold are removed. The remaining clusters are the cross-platform clone account clusters. The specific process for calculating the mean cosine similarity within a cluster is as follows: For a cluster containing M fingerprints, the cosine similarity between all different fingerprint pairs within the cluster is calculated. There are M multiplied by (M minus 1) divided by 2 pairs. These cosine similarities are added together and then divided by the logarithm to obtain the mean cosine similarity within the cluster. The preset clustering threshold is set to 0.5. If the mean cosine similarity within a cluster is below 0.5, the internal consistency of the cluster is considered to be poor, and it may be composed of normal users who are randomly gathered, so it is removed. The remaining clusters are the final discovered cross-platform clone account clusters. Each cluster represents an associated group of multiple accounts controlled by black and gray market groups. The set of these clusters is the clustering result of step S3.

[0083] In this embodiment, the specific operation of outputting the clustering results in the form of a cross-platform account association graph in step S4 is as follows:

[0084] Each cluster obtained in step S3 and its contained account IDs are mapped to a graph structure. Graph nodes represent each account, and graph edges are divided into strongly related edges and suspected related edges based on cosine similarity. Strongly related edges are established between account pairs with cosine similarity greater than or equal to a high threshold, while suspected related edges are established between account pairs with cosine similarity between the lower and upper thresholds of the interval. Each edge is accompanied by a correlation confidence score and key feature basis. The specific construction process of the graph structure is as follows: For each cluster, the unique identifiers of all accounts within the cluster are extracted as a set of nodes; for any two accounts, if their cosine similarity in step S3 is greater than or equal to 0.85, a strongly related edge is established between the corresponding nodes, and the edge type is marked as strongly related; if the cosine similarity is greater than or equal to 0... If the correlation coefficient is 6 and less than 0.85, a suspected association edge is established, and the edge type is marked as suspected association. The association confidence of each edge is directly taken as the cosine similarity value of the two accounts. The method for determining the main feature basis is as follows: backtrack the three modal feature vectors before fusion in step S2, compare the contribution of the text and image content modality, the publishing behavior modality, and the IP device environment modality to the global feature fingerprint, and take the modality name with the highest contribution as the feature basis of the edge, such as "similar text and image content", "similar behavior pattern", or "similar device environment". The graph uses a force-directed layout algorithm for visualization rendering, so that strongly associated nodes are close to each other and weakly associated or irrelevant nodes are far away, and finally an interactive HTML page is generated, which supports mouse hover to view node details and edge attributes.

[0085] Then, the review results of human auditors on each cluster in the graph are received. These results are converted into supervisory labels. Account pairs confirmed by human auditors to belong to the same pseudonym cluster are marked with positive labels, while account pairs confirmed not to belong to the same pseudonym cluster are marked with negative labels. All labels constitute the human review dataset. The specific conversion process of the human review results is as follows: Human auditors view each cluster through the graph interface and determine whether the cluster is a genuine pseudonym account cluster based on the relationships between accounts and account behavior characteristics. Auditors make one of three judgments for each cluster: confirm the cluster as a genuine pseudonym cluster, reject the cluster (considering it a mis-aggregated normal user cluster), or correct the cluster (considering internal account splitting within the cluster). (If an account is misjudged, it needs to be split or merged). For confirmed clusters, all account pairs within the cluster are marked with positive labels and the label value is set to 1. For rejected clusters, all account pairs within the cluster are marked with negative labels and the label value is set to 0. For corrected clusters, the reviewer needs to specify the correct grouping relationship and regenerate account pair labels according to the specified grouping: account pairs belonging to the same group are marked with positive labels, and account pairs belonging to different groups are marked with negative labels. All generated labels, along with the corresponding account pair identifiers, are stored in the database to form the manual review dataset. The size of this dataset depends on the workload of the review, and each incremental training requires at least 1000 account pair labels to ensure statistical stability.

[0086] The specific operation in step S4, where the association results of manual review are fed back as supervisory labels to the adaptive weighted fusion model for incremental training, is as follows:

[0087] After the initial training phase of the adaptive weighted fusion model, the importance weight of each meta-learner parameter is calculated. The importance weight is based on the average of the squared gradients of the contrastive learning loss at each iteration step during the initial training. The specific calculation process is as follows: During the initial training phase, the adaptive weighted fusion model is trained for 200 epochs, with each epoch containing multiple batches, for a total of 200 iterations multiplied by the number of batches per epoch. In each iteration, the contrastive learning loss gradient values ​​of the three learnable parameters of the meta-learner (first learnable parameter, second learnable parameter, and third learnable parameter) are recorded. For each parameter, its gradient value across all iterations is squared, and the sum of all squared values ​​is divided by the total number of iterations to obtain the importance weight of that parameter. This weight reflects the average sensitivity of the parameter to the loss function throughout the initial training process; parameters with higher sensitivity are more important and should receive more protection in subsequent incremental training. All three importance weights are non-negative real numbers, typically ranging from 0.001 to 100.

[0088] In the incremental training phase, an incremental loss function is constructed, which includes a contrastive learning loss term calculated on the manual review dataset and an elastic weight consolidation regularization term. The elastic weight consolidation regularization term is a weighted sum of the importance weights of each meta-learner parameter multiplied by the squares of the differences between the current and initial values ​​of the parameter, and then multiplied by a regularization coefficient. The Adam optimizer is used to minimize the incremental loss function to update the learnable parameters of the meta-learner. The specific construction and optimization process of the incremental loss function is as follows: First, the contrastive learning loss term is calculated on the manual review dataset. The calculation method is exactly the same as the contrastive learning loss in step S2: For each batch, an account is selected as the anchor point. A positive sample is randomly selected from the accounts belonging to the same alt account cluster. Several negative samples are selected from the accounts not belonging to the same alt account cluster. The cosine similarity between the anchor point and the positive sample and the cosine similarity with each negative sample are calculated. The contrastive loss contribution value is obtained through natural exponentiation and division. The contrastive learning loss term is obtained by averaging all accounts and taking the negative number.

[0089] Then, an elastic weight consolidation regularization term is constructed: for each meta-learner parameter, its importance weight is taken, multiplied by the square of the difference between the current value and the initial value of the parameter, the product of the three parameters is summed, and then multiplied by the regularization coefficient; the regularization coefficient is set to 100 to balance the strength of new data adaptation and old knowledge retention; the contrastive learning loss term is added to the elastic weight consolidation regularization term to obtain the incremental loss function; the Adam optimizer is used to minimize the incremental loss function, the learning rate is set to 0.00001, the batch size is set to 16, and the number of training rounds is set to 10; all manually reviewed data are traversed once in each round; during training, the three learnable parameters of the meta-learner are gradually updated through backpropagation, and the updated parameter values ​​replace the original parameter values ​​for adaptive weighted fusion in the subsequent step S2; this incremental training can be executed repeatedly, triggered whenever enough manually reviewed data is accumulated, so that the model can continuously adapt to new camouflage strategies.

[0090] Example 2: This example provides the following... Figure 2 The cross-platform account association recognition system shown is based on multi-dimensional feature fusion and specifically includes:

[0091] Data acquisition and feature extraction module: Collects full-dimensional data of the target account on multiple network platforms, cleans and normalizes it, and then extracts modal features of text and image content, modal features of publishing behavior and modal features of IP device environment in parallel, generating corresponding text and image feature vectors, behavioral feature vectors and device feature vectors;

[0092] Adaptive fusion module: Inputs image and text feature vectors, behavioral feature vectors and device feature vectors into the adaptive weighted fusion model, dynamically allocates fusion weights through a meta-learner, and generates a unique global feature fingerprint for each account;

[0093] Density clustering module: Maps the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space to calculate cosine similarity, and determines strongly related homologous accounts and suspected related dummy accounts based on high thresholds and interval thresholds, mines cross-platform dummy account clusters, and obtains clustering results;

[0094] Feedback optimization module: Outputs clustering results in the form of cross-platform account association graph, and feeds back the association results verified by humans as supervision labels to the adaptive weighted fusion model for incremental training, so as to optimize the dynamic allocation of fusion weights.

[0095] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0096] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0097] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0098] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0099] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0100] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0101] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A cross-platform account association identification method based on multi-dimensional feature fusion, characterized in that, Specifically, the following steps are included: Step S1: Collect full-dimensional data of the target account on multiple network platforms and perform cleaning and preprocessing. Normalize the heterogeneous data formats in the full-dimensional data of different platforms into a unified standard. Then extract the modal features of text and image content, modal features of publishing behavior, and modal features of IP device environment in parallel, and generate corresponding text and image feature vectors, behavioral feature vectors, and device feature vectors respectively. Step S2: Input the image and text feature vector, behavior feature vector and device feature vector into the pre-built adaptive weighted fusion model. The meta-learner in the adaptive weighted fusion model dynamically allocates fusion weights according to the information entropy of each modality feature vector in the current batch of input data, and generates a unique global feature fingerprint for each account. Step S3: Map the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space, use density clustering algorithm to calculate the cosine similarity between any two fingerprints, and determine strongly related homologous accounts and suspected related alias accounts based on the set high threshold and interval threshold. Then, automatically mine cross-platform alias account clusters composed of multiple accounts through density reachability to obtain clustering results. Step S4: Output the clustering results in the form of a cross-platform account association graph, and feed the manually reviewed association results as supervision labels into the adaptive weighted fusion model for incremental training to continuously optimize the dynamic allocation of fusion weights.

2. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 1, characterized in that: In step S1, the specific operation for extracting the modal features of the image and text content is as follows: The collected text content is encoded into a text embedding matrix using a pre-trained language model, and the image content is encoded into an image embedding matrix using a pre-trained visual model. Global average pooling is performed on the text embedding matrix to obtain a text global pooling vector, and global average pooling is performed on the image embedding matrix to obtain an image global pooling vector. Then, the text global pooling vector and the image global pooling vector are input into the low-rank bilinear pooling and tensor ring decomposition fusion module. The low-rank bilinear pooling and tensor ring decomposition fusion module performs nonlinear transformations on the text global pooling vector and the image global pooling vector respectively through multiple learnable parameter matrices, and then performs element-wise multiplication. The results of multiple multiplications are then summed by tensor ring contraction along the rank direction, and finally outputs a text-image feature vector. The text-image feature vector contains deep interactive information of text semantics and image vision.

3. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 2, characterized in that: In step S1, the specific operation for extracting the modal features of publishing behavior is as follows: All behavioral events of the target account are arranged in chronological order of occurrence into a multivariate time series. The observation vector at each time point represents whether event types such as posting, liking, and commenting have occurred at that moment. Multivariate time series data are input into a pre-trained neural network frequent differential equation model. The neural network frequent differential equation model starts with a hidden state that is initially zero. The rate of change of the hidden state over time is calculated through a parameterized neural network. A numerical integrator is used to integrate the rate of change of the hidden state over time from the start time to the end time to obtain the hidden state at the end time. The hidden state at the end time is used as the behavior feature vector. The specific steps for extracting the environmental modal features of IP devices are as follows: the device and network information is abstracted into a heterogeneous graph, in which nodes include account nodes, device nodes, IP nodes, and network operator nodes, and edges in the heterogeneous graph represent publishing relationships; a graph isomorphic network is used to pass messages to each account node, and the graph isomorphic network aggregates the neighborhood information of the account node through a multilayer perceptron and learnable scalar parameters, and outputs the embedded representation of the account node after multilayer message passing, and uses the embedded representation as the device feature vector.

4. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 3, characterized in that: In step S2, the meta-learner in the adaptive weighted fusion model dynamically allocates fusion weights based on the information entropy of each modality feature vector in the current batch of input data. The specific operation is as follows: First, the image and text feature vector, behavior feature vector and device feature vector output in step S1 are respectively subjected to L2 normalization so that the magnitude of each feature vector becomes one, and the normalized image and text feature vector, normalized behavior feature vector and normalized device feature vector are obtained. Then, for each modality among the text and image content modality, publishing behavior modality, and IP device environment modality, the L1 norm of all normalized feature vectors of each modality in the current batch is calculated, and the L1 norm is transformed into a probability distribution through the softmax function. The information entropy of the probability distribution is then calculated as the modality discrimination index. Simultaneously, the absolute value of the average cosine similarity between each mode and the other two modes is calculated as an index of mode orthogonality. The modality discrimination index and modality orthogonality index are input into a learnable parameterized function. The function generates unnormalized weights through exponential operations and linear combinations, and then obtains the final fusion weights through softmax normalization.

5. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 4, characterized in that: The specific steps in step S2 to generate a unique global feature fingerprint for each account are as follows: The normalized image and text feature vector, the normalized behavior feature vector, and the normalized device feature vector are multiplied by their respective fusion weights and then weighted and summed to obtain the global feature fingerprint of each account. Meanwhile, the learnable parameters of the meta-learner are trained end-to-end using a contrastive learning loss function. This loss function increases the cosine similarity between global feature fingerprints within the same account cluster and decreases the cosine similarity between global feature fingerprints between different account clusters, thereby optimizing the allocation strategy of the fusion weights.

6. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 5, characterized in that: The specific operation of mapping the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space in step S3 is as follows: First, L2 normalize each global feature fingerprint output in step S2 so that the magnitude of each fingerprint becomes one, thus obtaining the normalized global feature fingerprint. Then, for each normalized global feature fingerprint, calculate its Euclidean distance to the preset number of nearest neighbors, where the preset number is a preset parameter. Then multiply the Euclidean distance by a scaling factor to obtain the adaptive neighborhood radius of the fingerprint. Next, the cosine similarity between any two normalized global feature fingerprints is calculated, and it is determined whether one fingerprint falls within the adaptive neighborhood of the other fingerprint. The determination condition is that the cosine similarity is greater than the angle threshold converted from the adaptive neighborhood radius and is also greater than the preset minimum similarity threshold.

7. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 6, characterized in that: The specific steps in step S3 to automatically mine cross-platform clone account clusters using density reachability are as follows: Set a high threshold and a lower limit for the interval threshold. For any two normalized global feature fingerprints, if the cosine similarity is greater than or equal to the high threshold, they are directly marked as strongly related homologous accounts. If the cosine similarity is between the lower limit of the interval threshold and the high threshold, they are marked as suspected related pseudonyms and added to the candidate neighborhood. Then, a density clustering algorithm is used to define the fingerprints that contain at least the minimum number of other fingerprints in the adaptive neighborhood as core points. Starting from each core point, a breadth-first search is used to find all density-reachable fingerprints and classify them into the same cluster. Fingerprints that are not density-reachable by any core point are marked as noise. Finally, the mean cosine similarity within each cluster is calculated, and clusters with mean cosine similarity below the preset clustering threshold are removed. The remaining clusters are the cross-platform clone account clusters.

8. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 7, characterized in that: The specific steps in step S4 to output the clustering results as a cross-platform account association graph are as follows: Map each cluster obtained in step S3 and its contained account IDs to a graph structure. Each graph node is an account. Graph edges are divided into strongly related edges and suspected related edges according to cosine similarity. Strongly related edges are established between account pairs with cosine similarity greater than or equal to the high threshold, and suspected related edges are established between account pairs with cosine similarity between the lower limit and the high threshold of the interval. Each edge is accompanied by a correlation confidence and main feature basis. Then, the review results of human auditors on each cluster in the graph are received, and the review results are converted into supervision labels. Account pairs that are manually confirmed to belong to the same pseudonym cluster are marked with positive labels, and account pairs that are manually confirmed not to belong to the same pseudonym cluster are marked with negative labels. All labels constitute the human review dataset.

9. The cross-platform account association identification method based on multi-dimensional feature fusion according to claim 8, characterized in that: The specific operation in step S4, where the association results of manual review are fed back as supervisory labels to the adaptive weighted fusion model for incremental training, is as follows: After the initial training phase of the adaptive weighted fusion model is completed, the importance weight of each meta-learner parameter is calculated. The importance weight is based on the average of the squared gradients of the contrastive learning loss of the parameter at each iteration step during the initial training process. During the incremental training phase, an incremental loss function is constructed, which includes a contrastive learning loss term computed on the human-reviewed dataset and an elastic weight consolidation regularization term. The elastic weight consolidation regularization term is a weighted sum of the importance weights of each meta-learner parameter multiplied by the squares of the differences between the current and initial values ​​of the parameter, and then multiplied by a regularization coefficient. The Adam optimizer is used to minimize the incremental loss function to update the learnable parameters of the meta-learner.

10. A cross-platform account association identification system based on multi-dimensional feature fusion, applied to the cross-platform account association identification method based on multi-dimensional feature fusion as described in any one of claims 1-9, characterized in that: Specifically, it includes: Data acquisition and feature extraction module: Collects full-dimensional data of the target account on multiple network platforms, cleans and normalizes it, and then extracts modal features of text and image content, modal features of publishing behavior and modal features of IP device environment in parallel, generating corresponding text and image feature vectors, behavioral feature vectors and device feature vectors; Adaptive fusion module: Inputs image and text feature vectors, behavioral feature vectors and device feature vectors into the adaptive weighted fusion model, dynamically allocates fusion weights through a meta-learner, and generates a unique global feature fingerprint for each account; Density clustering module: Maps the global feature fingerprints of all accounts to be analyzed to a high-dimensional vector space to calculate cosine similarity, and determines strongly related homologous accounts and suspected related dummy accounts based on high thresholds and interval thresholds, mines cross-platform dummy account clusters, and obtains clustering results; Feedback optimization module: Outputs clustering results in the form of cross-platform account association graph, and feeds back the association results verified by humans as supervision labels to the adaptive weighted fusion model for incremental training, so as to optimize the dynamic allocation of fusion weights.

Images