CN113158192B - Batch construction and management method and system for anti-detection online social network virtual users - Google Patents
Batch construction and management method and system for anti-detection online social network virtual users Download PDFInfo
- Publication number
- CN113158192B CN113158192B CN202110161316.9A CN202110161316A CN113158192B CN 113158192 B CN113158192 B CN 113158192B CN 202110161316 A CN202110161316 A CN 202110161316A CN 113158192 B CN113158192 B CN 113158192B
- Authority
- CN
- China
- Prior art keywords
- virtual user
- user
- virtual
- attribute
- real
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000001514 detection method Methods 0.000 title claims abstract description 37
- 238000010276 construction Methods 0.000 title claims abstract description 32
- 238000007726 management method Methods 0.000 title claims abstract description 28
- 230000006399 behavior Effects 0.000 claims abstract description 133
- 230000035515 penetration Effects 0.000 claims abstract description 27
- 230000000694 effects Effects 0.000 claims abstract description 20
- 238000005065 mining Methods 0.000 claims abstract description 18
- 238000000034 method Methods 0.000 claims description 31
- 238000004364 calculation method Methods 0.000 claims description 13
- 238000009826 distribution Methods 0.000 claims description 12
- 230000008569 process Effects 0.000 claims description 10
- 239000013598 vector Substances 0.000 claims description 8
- 238000004422 calculation algorithm Methods 0.000 claims description 6
- 238000004590 computer program Methods 0.000 claims description 5
- 230000008595 infiltration Effects 0.000 claims description 5
- 238000001764 infiltration Methods 0.000 claims description 5
- 230000009471 action Effects 0.000 claims description 3
- 238000012098 association analyses Methods 0.000 claims description 3
- 238000012545 processing Methods 0.000 claims description 3
- 238000010845 search algorithm Methods 0.000 claims description 3
- 230000008520 organization Effects 0.000 claims description 2
- 238000003860 storage Methods 0.000 claims description 2
- 230000007547 defect Effects 0.000 description 5
- 244000097202 Rathbunia alamosensis Species 0.000 description 3
- 235000009776 Rathbunia alamosensis Nutrition 0.000 description 3
- 238000010009 beating Methods 0.000 description 3
- 238000011160 research Methods 0.000 description 3
- 230000002159 abnormal effect Effects 0.000 description 2
- 238000003491 array Methods 0.000 description 2
- 230000010485 coping Effects 0.000 description 2
- 230000007480 spreading Effects 0.000 description 2
- 238000003892 spreading Methods 0.000 description 2
- XLYOFNOQVPJJNP-UHFFFAOYSA-N water Substances O XLYOFNOQVPJJNP-UHFFFAOYSA-N 0.000 description 2
- 238000004458 analytical method Methods 0.000 description 1
- 238000005520 cutting process Methods 0.000 description 1
- 230000008260 defense mechanism Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 238000010586 diagram Methods 0.000 description 1
- 238000012423 maintenance Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 238000012986 modification Methods 0.000 description 1
- 230000004048 modification Effects 0.000 description 1
- 230000003287 optical effect Effects 0.000 description 1
- 230000008092 positive effect Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/57—Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
- G06F21/577—Assessing vulnerabilities and evaluating computer system security
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06Q—INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- G06Q50/00—Information and communication technology [ICT] specially adapted for implementation of business processes of specific business sectors, e.g. utilities or tourism
- G06Q50/01—Social networking
Landscapes
- Engineering & Computer Science (AREA)
- General Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Hardware Design (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- Computing Systems (AREA)
- Business, Economics & Management (AREA)
- Software Systems (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Tourism & Hospitality (AREA)
- General Business, Economics & Management (AREA)
- Strategic Management (AREA)
- Primary Health Care (AREA)
- Marketing (AREA)
- Human Resources & Organizations (AREA)
- Economics (AREA)
- Health & Medical Sciences (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
The invention belongs to the technical field of computer networks, and discloses a batch construction and management method and a system for virtual users of an anti-detection online social network, which are used for mining real user identity attribute rules and automatically constructing virtual user identities according to the rules; the virtual user behavior model generation module is combined with the normal activity mode of the real user and the interest attributes of the virtual user to construct a user behavior model based on the interest attributes. The virtual user execution module guides the virtual user to execute daily behaviors on the social network according to the user behavior model; and the community penetration module guides the virtual user to actively send friend requests to real users with high identity similarity and common friends in the target community according to the homogeneity principle. The invention considers the behavior characteristics of the virtual users and the credibility of the friend relationship characteristics at the same time, and can automatically construct and maintain vivid online social network virtual users with high credibility.
Description
Technical Field
The invention belongs to the technical field of computer networks, and particularly relates to a batch construction and management method and system for virtual users of an anti-detection online social network.
Background
With the rapid development of online social networks, online social networks have become an integral part of people's daily lives. People can communicate, share personal information, obtain latest information and the like through the online social network platform. However, online social networks have been targeted by malicious attackers due to their characteristics of data sharing, dissemination, openness, and the like. An attacker can develop various malicious activities by creating a malicious virtual user, including social engineering attack, rumor and error information spreading, spam and malware spreading, user privacy information collection and the like. In order to prevent attackers from utilizing malicious virtual users to implement malicious behaviors on social networks, each large online social network platform is provided with a corresponding virtual user detection mechanism, the detection method can be roughly divided into two types, the first type is a characteristic-based detection method, and the method relies on user-level activities and account detailed information (such as user logs and configuration files) thereof to detect false accounts; the second type is a graph-based detection method, which models an online social network into a graph, nodes represent user accounts, edges between the nodes represent social relationships, and specific abnormal structures or abnormal nodes in the graph are found by using a graph mining correlation algorithm on the assumption that a false account can only establish sparse friend relationships with real users. Most of the current research on the virtual users only focuses on how to detect the virtual users, and little focuses on research on the aspect of constructing an anti-detection credible virtual user, but the anti-detection construction of the virtual users can be used for constructing an activity mode of a social honeypot capture attacker, excavating the defects of an online social network service platform detection system, and exploring the coping behaviors of the victim in the face of malicious attacks, so that the method has great research significance and practical significance.
At present, for the problem of how to construct a trusted virtual user, solutions have been proposed: a method for detecting and finding a network water army comprises the steps of creating and maintaining virtual users as social honeypots by manually designing account configuration information and behavior patterns, attracting counterattention in a random active attention mode, and finally further mining the whole network water army by taking malicious users collected by social honeypot accounts as clues. It has the defects that: when a virtual user is established, the setting of vivid account configuration information is manually operated, and the flexibility is not strong. Meanwhile, when the virtual user obtains the friend relationship, the virtual user simply sends a friend request at random, the friend relationship of the account is scattered and is not integrated into a real user community, the credibility of the account is low, and the account is easy to detect and identify by an online social network service provider or a malicious attacker.
Through the above analysis, the problems and defects of the prior art are as follows:
(1) In the prior art, when a virtual user is established, the setting of vivid account configuration information is manually operated, and the flexibility is not strong.
(2) In the prior art, when a virtual user acquires a friend relationship, a friend request is simply sent randomly, the friend relationship of an account is scattered and is not integrated into a real user community, the credibility of the account is low, and the account is easy to detect and identify by an online social network service provider or a malicious attacker.
The difficulty in solving the above problems and defects is: the online social network has a large user base number and a large number of user types, and the behavior patterns of different users have large differences, so that the behavior rules of the users are difficult to summarize, and the real user behaviors are simulated. Meanwhile, influence factors for establishing the friend relationship of the social network users are complex, and the virtual users lack real physical world social relationship, so that the virtual users are difficult to establish the friend relationship with the real social network users and further to be merged into the real user community.
The significance for solving the problems and the defects is as follows: the credible virtual user construction method capable of resisting detection can be applied to constructing a realistic social honeypot account to induce and capture the latest attack strategy and behavior characteristics of a malicious user, and meanwhile, can assist an online social network service provider to formulate a more efficient defense mechanism and explore coping behaviors of a victim in the face of malicious attack.
Disclosure of Invention
Aiming at the problems in the prior art, the invention provides a batch construction and management method and system for virtual users of an anti-detection online social network.
The invention is realized in such a way that a batch construction and management method for virtual users of an anti-detection online social network comprises the following steps:
mining real user identity attribute rules, and automatically constructing a virtual user identity according to the rules;
the virtual user behavior model generation module is combined with the normal activity mode of the real user and the interest attribute of the virtual user to construct a user behavior model based on the interest attribute; the virtual user execution module guides the virtual user to execute daily behaviors on the social network according to the user behavior model;
and the community penetration module guides the virtual user to actively send friend requests to real users with high identity similarity and common friends in the target community according to the homogeneity principle.
Further, a target community where the virtual user to be constructed is located is selected, real user identity attribute rules of the target community are mined, and the batch vivid virtual user identities are automatically constructed based on the rules.
Further comprising:
(1) And selecting a target community where the virtual user to be constructed is located, wherein the target community can be an enterprise internal organization network, a campus internal social network, a friend network based on common interests and the like. Acquiring attribute values of real user identities in a target community, such as gender, age, occupation, residence, education background and interests, establishing a data structure for the user identities, and sorting and combining to obtain a set of real user identities in the target community;
(2) Mining various types of rules of real identity attribute values in the real user identity set collected in the step (1), wherein the rules comprise attribute value setting rules, attribute value statistical distribution rules and attribute association rules; the attribute value setting rule refers to the possible value range of each attribute; the attribute value statistical distribution rule refers to the value statistical distribution characteristic of each attribute; the attribute value association rule refers to the dependency relationship between values corresponding to different attributes; when mining the attribute association rule, an association analysis algorithm (such as FP-growth and Apriori) can be adopted to mine the association knowledge between the identity attribute values;
(3) Setting a virtual user identity template, namely selecting an identity attribute set to represent a virtual user identity; taking the identity attribute rule obtained in the step (2) as a constraint set, and taking the real user attribute value set as a value range of the identity attribute; in the virtual user creating stage, the attribute of the friend list is uniformly set to Null; assigning values to each attribute in sequence by using a backtracking search algorithm, backtracking when no legal value can be assigned to a certain attribute, and successfully generating the virtual user identity when all the attributes of the virtual user identity are assigned under the condition of meeting the constraint condition; this step is repeated to produce a batch of virtual user identities similar and realistic to the target community real user identities, wherein the number of virtual user identities to be constructed is predefined by the administrator.
Further, the virtual user behavior model generation module generates a virtual user behavior model based on the behavior pattern of the real user and the identity attribute of the virtual user. The virtual user behavior execution module reads in the virtual user behavior model and guides the virtual user to execute daily behaviors which accord with the identity and the normal activity mode of the virtual user. The method specifically comprises the following steps:
(1) Analyzing the real user behavior data, extracting the daily activity mode of the real user, referring to the real user behavior activity mode, and manually setting the virtual user behavior mode; the controller is used for controlling the time mode of the daily behavior of the virtual user, so that the daily behavior of the virtual user accords with the behavior characteristic of a normal user;
(2) Setting a virtual user browsing behavior strategy and a publishing behavior strategy based on the interest based on the user identity interest attribute so as to ensure that the behavior of the virtual user is associated with the interest attribute; the virtual user browsing behavior strategy is that the similarity between the browsed text content and the virtual user interest belonging keyword is calculated by a text similarity calculation method in the browsing process, and the similarity is compared with a preset threshold value t like 、t repost 、t comment The size of the data determines whether to perform operations of approval, forwarding and comment; the virtual user issuing behavior strategy mainly relates to the construction of text contents related to interest attributes of the virtual user; the method comprises the specific processes of randomly collecting real-time text contents published by real users in a target community, calculating the similarity between the interest of virtual users and published texts by a text similarity calculation method, and selecting the similarity larger than a preset threshold value t write Is a candidateThe text is cut, spliced, added/removed with special symbols and processed in a similar meaning word replacement mode to obtain the final text content to be issued by the virtual user; the text similarity calculation method can adopt a vector space model VSM, an LDA topic model and a word2vec similarity calculation method;
(3) Combining the virtual user daily behavior controller obtained in the step (1) and the virtual user behavior strategy based on the interest obtained in the step (2) to construct a virtual user behavior model;
(4) The virtual user execution module reads in a virtual user behavior model and guides the virtual user execution unit to execute daily behavior actions of each virtual user; the virtual user execution units can be real computers or mobile phones or virtual machines, and each virtual user execution unit is uniquely bound with one virtual user.
Further, the community penetration module guides the virtual users to efficiently establish friend relationships with the real users according to a community penetration strategy based on the homogeneity principle so as to be integrated into a real user network community; the homogeneity principle related by the invention means that friend relationships are easier to establish among users with similar personal attributes, and the users with friend relationships often have similar attributes, wherein the personal attributes comprise but are not limited to sex, age, native place, hobby, occupation, educational background and network structure; the homogeneity of the network structure is also called ternary closure, which means that if two people have common friends, the probability that the two people will become friends in the future is improved.
Further comprising:
(1) The community penetration module sends a command to each virtual user, and the command instructs the virtual users to globally establish friend relationships based on the principle of homogeneity, namely virtual users with similar identities are preferentially connected; the number of friends to be connected of each virtual user can be referred to the average number of friends of normal users in the target community;
(2) The community penetration module sends a command to each virtual user, and the command instructs each virtual user to select k identity similarities larger than a threshold value t in the target community link And actively sends friend requests(ii) a K and t thereof link The method is preset by an administrator, and different values can be selected according to different infiltration strategies; the similarity of the identity attributes of two users can be calculated based on the number of common friends, a vector space model, an LDA theme model, word2vec, node2vec and the like.
(3) Each virtual user traverses each user in the friend list of the real user with established friend relationship, identity similarity between the virtual user and the users is calculated, and when the similarity is larger than a threshold value t link When the friend receives the friend request, actively sending the friend request; and repeating the step until the virtual user successfully establishes the friend relationship with the n real users, wherein the value of the specific n is preset by an administrator.
It is a further object of the invention to provide a computer device comprising a memory and a processor, the memory storing a computer program which, when executed by the processor, causes the processor to perform the steps of:
mining real user identity attribute rules, and automatically constructing virtual user identities according to the rules;
the virtual user behavior model generation module is combined with the normal activity mode of the real user and the interest attribute of the virtual user to construct a user behavior model based on the interest attribute; the virtual user execution module guides the virtual user to execute daily behaviors on the social network according to the user behavior model;
and the community penetration module guides the virtual user to actively send friend requests to real users with high identity similarity and common friends in the target community according to the homogeneity principle.
It is another object of the present invention to provide a computer-readable storage medium storing a computer program which, when executed by a processor, causes the processor to perform the steps of:
mining real user identity attribute rules, and automatically constructing virtual user identities according to the rules;
the virtual user behavior model generation module is combined with the normal activity mode of the real user and the interest attribute of the virtual user to construct a user behavior model based on the interest attribute; the virtual user execution module guides the virtual user to execute daily behaviors on the social network according to the user behavior model;
and the community penetration module guides the virtual user to actively send friend requests to real users with high identity similarity and common friends in the target community according to the homogeneity principle.
The invention also aims to provide an information data processing terminal, which is used for realizing the batch construction and management method of the virtual users of the anti-detection online social network.
Another object of the present invention is to provide a batch construction and management system for anti-detection online social network virtual users, which implements the batch construction and management method for anti-detection online social network virtual users, and the batch construction and management system for anti-detection online social network virtual users includes:
the virtual identity building module is used for mining real user identity attribute rules from the real user identity attribute set of the target community and automatically generating batch vivid virtual user identities according to the rules;
the virtual user behavior model generation module is used for generating a user behavior model based on the user identity, which is required by the virtual user to execute daily behaviors, according to the virtual user identity provided by the virtual identity construction module and a manually set daily behavior mode of the virtual user so as to ensure the relevance of the virtual user behavior and the identity attribute of the virtual user;
the community penetration module is used for sending the penetration strategy to the virtual user execution module and guiding the virtual user to actively establish a friend relationship with the real user according to the community penetration strategy based on the homogeneity principle so as to be merged into a community, so that the virtual user has credible social relationship characteristics;
the virtual user management module is used for sending a command to each virtual user execution unit, controlling the behavior operation of each virtual user in real time, and simultaneously displaying the running state of each virtual user to fulfill the aim of real-time control on the virtual users;
the virtual user execution module is a unique module directly interacting with virtual users, and comprises a large number of virtual user execution units, each virtual user execution unit uniquely corresponds to one virtual user, and is used for executing daily behavior operations of the virtual users according to the virtual user behavior model transmitted by the virtual user behavior model generation module and executing behavior operations corresponding to commands transmitted by other modules.
By combining all the technical schemes, the invention has the advantages and positive effects that: the invention can realize automatic batch construction and maintenance of vivid and credible virtual users. The invention provides a method for constructing, maintaining and managing batch online social network virtual users. The method can automatically construct batch high-fidelity virtual user identity configuration information based on real user identity attribute rules; meanwhile, the virtual user behavior is considered to be related to the identity attribute of the virtual user, and meanwhile, the virtual user behavior is actively integrated into a target community according to an infiltration strategy based on the homogeneity principle, so that the credibility of the behavior characteristic and the social relation characteristic of the virtual user is effectively improved.
Drawings
In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings needed to be used in the embodiments of the present application will be briefly described below, and it is obvious that the drawings described below are only some embodiments of the present application, and it is obvious for those skilled in the art that other drawings can be obtained from the drawings without creative efforts.
Fig. 1 is a flowchart of a method for batch construction and management of virtual users of an anti-detection online social network according to an embodiment of the present invention.
Fig. 2 is a schematic structural diagram of a batch building and management system for virtual users of an anti-detection online social network according to an embodiment of the present invention.
Fig. 3 is a flowchart of an implementation of a method for batch construction and management of virtual users of an anti-detection online social network according to an embodiment of the present invention.
Detailed Description
In order to make the objects, technical solutions and advantages of the present invention more apparent, the present invention is further described in detail with reference to the following embodiments. It should be understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.
Aiming at the problems in the prior art, the invention provides a batch construction and management method and a system for virtual users of an anti-detection online social network, and the invention is described in detail below with reference to the accompanying drawings.
As shown in fig. 1, the method for constructing and managing virtual users in batches of anti-detection online social networks provided by the present invention includes the following steps:
s101: mining real user identity attribute rules, and automatically constructing virtual user identities according to the rules;
s102: the virtual user behavior model generation module is combined with the normal activity mode of the real user and the interest attribute of the virtual user to construct a user behavior model based on the interest attribute; the virtual user execution module guides the virtual user to execute daily behaviors on the social network according to the user behavior model;
s103: and the community penetration module guides the virtual user to actively send a friend request to the real user with high identity similarity and common friends in the target community according to the homogeneity principle.
Those skilled in the art can also implement the method for batch construction and management of anti-detection online social network virtual users provided by the present invention by using other steps, and the method for batch construction and management of anti-detection online social network virtual users provided by the present invention in fig. 1 is only a specific embodiment.
As shown in fig. 2, the system for batch construction and management of virtual users of anti-detection online social networks provided by the present invention includes:
and the virtual identity construction module is used for mining the real user identity attribute rule from the real user identity attribute set of the target community and automatically generating the batch vivid virtual user identities according to the rule.
And the virtual user behavior model generating module is used for generating a user behavior model based on the user identity, which is required by the virtual user to execute the daily behavior, according to the virtual user identity provided by the virtual identity constructing module and the manually set daily behavior mode of the virtual user, so as to ensure the relevance of the virtual user behavior and the identity attribute of the virtual user.
And the community penetration module is used for sending the penetration strategy to the virtual user execution module and guiding the virtual user to actively establish a friend relationship with the real user according to the community penetration strategy based on the homogeneity principle so as to be merged into the community, so that the virtual user has credible social relationship characteristics.
And the virtual user management module is used for sending a command to each virtual user execution unit, controlling the behavior operation of each virtual user in real time, and simultaneously displaying the running state of each virtual user to achieve the purpose of real-time control over the virtual users.
The virtual user execution module is a unique module directly interacting with virtual users, and comprises a large number of virtual user execution units, each virtual user execution unit uniquely corresponds to one virtual user, and is used for executing daily behavior operations of the virtual users according to the virtual user behavior model transmitted by the virtual user behavior model generation module and executing behavior operations corresponding to commands transmitted by other modules.
The technical scheme of the invention is further described in the following with reference to the attached drawings.
As shown in fig. 1, the method for batch construction and management of virtual users of anti-detection online social networks provided by the present invention comprises the following steps:
the method comprises the steps of firstly, selecting a target community where a virtual user to be constructed is located, mining real user identity attribute rules of the target community, and automatically constructing the identities of the virtual users in batches based on the rules. The specific process is as follows:
(1) In this embodiment, the Sina microblog platform is selected as the specific online social network platform of this embodiment, and a certain college community in the Sina microblog is used as the target community. All information publicly visible on a large number of real users in the target community is collected, including information such as personal home pages, buddy lists, user-generated content, and the like. And mining identity attribute values of real users, wherein gender, age, occupation, residence and education background can be directly obtained, and analyzing text contents generated by the users by adopting an LDA topic model to extract interest attribute values of the users. And finally, establishing a data structure for the user identities, and sorting and combining to obtain a target community real user identity set.
(2) And (2) mining various types of rules of the real identity attribute values in the real user identity set collected in the step (1), wherein the rules comprise attribute value setting rules, attribute value statistical distribution rules and attribute association rules. The attribute value setting rule refers to a possible value range of each attribute, such as the value range of an age attribute; the attribute value statistical distribution rule refers to the value statistical distribution characteristics of each attribute, such as the average value of the age attribute; the attribute value association rule refers to a dependency relationship between values corresponding to different attributes, for example, a professional attribute is a residence attribute of a student and is usually a school address. When mining the attribute association rule, the embodiment selects the association analysis algorithm Apriori to mine the association knowledge between the identity attribute values.
(3) The virtual user identity template is set, i.e. the set of identity attributes is selected to represent the virtual user identity. In this embodiment, (gender, age, occupation, educational background, residence, interest, buddy list) is selected as the set of virtual user identity attributes; and (3) taking the identity attribute rule obtained in the step (2) as a constraint set, and taking the real user attribute value set as a value range of the identity attribute. In the virtual user creating stage, the friend list attribute is uniformly set to Null. And assigning values to each attribute in sequence by utilizing a backtracking search algorithm, backtracking when no legal value can be assigned to a certain attribute, and successfully generating the virtual user identity when all the attributes of the virtual user identity are assigned under the condition of meeting the constraint condition. This step is repeated to produce a batch of virtual user identities that are similar and realistic to the target community real user identities. Wherein the number of virtual user identities to be constructed is predefined by an administrator.
And secondly, generating a virtual user behavior model by the virtual user behavior model generating module based on the behavior mode of the real user and the identity attribute of the virtual user. The virtual user behavior execution module reads in the virtual user behavior model and guides the virtual user to execute the daily behavior according with the identity and the normal activity mode of the virtual user. The specific process is as follows:
(1) Analyzing the real user behavior data, and extracting the visible behavior activity mode of the real user, including the characteristics of the hair beating frequency, the hair beating time distribution, the hair beating interval and the like. And manually setting the virtual user behavior activity mode by referring to the real user behavior activity mode, wherein the virtual user behavior activity mode comprises login time distribution, publishing time distribution, browsing duration and approval frequency. And finally, obtaining a virtual user daily behavior mode controller which is used for controlling the daily behavior time mode of the virtual user so that the daily behavior of the virtual user accords with the behavior characteristics of the real user.
(2) Setting a virtual user browsing behavior strategy and a publishing behavior strategy based on the interest based on the user identity interest attribute so as to ensure that the behavior of the virtual user is associated with the interest attribute; the virtual user browsing behavior strategy is that the similarity between the browsed text content and the virtual user interest belonging keyword is calculated by a text similarity calculation method in the browsing process, and the similarity is compared with a preset threshold value t like 、t repost 、t comment Whether to perform operations of approval, forwarding and comment is determined by the size of the data; the virtual user issuing behavior strategy mainly relates to the construction of text contents related to interest attributes of the virtual user; the specific process comprises the steps of firstly randomly collecting real-time text contents published by real users in a target community, calculating the similarity between the interest of virtual users and published texts by a text similarity calculation method, and selecting a threshold t with the similarity larger than a preset threshold value write The text to be published is a candidate text, and then the candidate text is processed in modes of cutting, splicing, adding/removing special symbols, replacing similar meaning words and the like to obtain the final text content to be published of the virtual user; in the embodiment, word2vec is adopted to convert the microblog text content and the user interest keywords into vector representation, and then a cosine similarity calculation method is utilized to obtain the final text similarity.
(3) And (3) combining the obtained daily behavior controller of the virtual user and the obtained interest-based behavior strategy of the virtual user in the step (1) to construct a behavior model of the virtual user.
(4) The virtual user execution module reads in the virtual user behavior model and guides the virtual user execution unit to execute the daily behavior action of each virtual user. The virtual user execution unit can be a real computer or a mobile phone or a virtual machine, and each virtual user execution unit is uniquely bound with a virtual user.
And thirdly, the community penetration module guides the virtual user to efficiently establish a friend relationship with the real user according to the community penetration strategy based on the homogeneity principle so as to be merged into the real user network community. The homogeneity principle related by the invention means that friend relationships are easier to establish among users with similar personal attributes, and the users with friend relationships often have similar attributes, wherein the personal attributes comprise but are not limited to sex, age, native place, hobby, occupation, educational background and network structure; the homogeneity of the network structure is also called ternary closure, which means that if two people have a common friend, the probability that the two people will become friends in the future is improved. The specific process is as follows:
(1) The community penetration module sends a command to each virtual user to command the virtual users to establish friend relationships globally based on the principle of homogeneity, namely the virtual users with similar identities are preferentially connected, so that each virtual user has a normal-looking friend number and also has higher friend relationship reliability. The specific number of friends to be connected by each virtual user can be referred to the average number of friends of normal users in the target community. This embodiment selects a random number between 50 and 150.
(2) The community penetration module sends a command to each virtual user, and the command instructs each virtual user to select k identity similarities larger than a threshold value t in the target community link And actively sending friend requests. In this embodiment, the friend relationship in the Sina microblog refers to a mutual concern relationship, and sending the friend request refers to obtaining a counterconcern in an active concern or private information concern seeking manner. K and t thereof link Preset by the administrator, different values may be selected according to different infiltration strategies. The specific process of calculating identity similarity between users in this embodiment is as follows:
1) Will be deficientTuple for pseudo-user identity (v) 1 ,…,v n-1 ,v n Is) is represented by, wherein v i Representing the value of the ith identity attribute. In the present embodiment the virtual user identity is represented by a tuple (gender, age, occupation, educational background, place of residence, interest, buddy list).
2) Common identity attribute similarity calculation algorithm is selected to calculate similarity sim (u, v) of all identity attributes between users attr . In this embodiment, for some simple types of identity attributes (e.g. gender, occupation, residence), the similarity calculation only needs to compare if they are equal, i.e. if they are equal sim (u, v) i =1, otherwise sim (u, v) i =0; for some text type identity attributes (such as interest attributes), word2vec is selected to convert the identity attributes into vectors, and a cosine similarity algorithm is selected to calculate the similarity between the vectors, namely the similarity of a user u and a user v with respect to the identity attribute j is
For some set-type identity attributes (such as friend lists and education backgrounds), the similarity calculation result is the number of elements intersected by the two sets, namely sim (u, v) k ＝Count(att uk ∩att uk )。
3) Setting a user identity attribute weight vector, available (w) 1 ,…,w n-1 ,w n B) represents the weight value w i The larger the identity attribute is, the more important the corresponding ith identity attribute is, the similarity between all the identity attributes of the two users is integrated to obtain the similarity between the identities of the two users, namely sim (u, v) = w 1 *sim(u，v) 1 +…+w n-1 *sim(u，v) n-1 +w n *sim(u，v) n . Wherein the weight value w i The selection of interest attribute is selected according to different infiltration strategies, for example, if the user community with the same interest is infiltrated, the weight corresponding to the interest attribute can be correspondingly improved.
(3) Each virtual user traverses each user in the friend list of the real user with established friend relationship, and calculates the identity similarity between the virtual user and the users, when the similarity is more thanThreshold value t link And actively sending a friend request. And repeating the step until the virtual user successfully establishes the friend relationship with the n real users. The value of n is preset by the administrator.
It should be noted that the embodiments of the present invention can be realized by hardware, software, or a combination of software and hardware. The hardware portion may be implemented using dedicated logic; the software portions may be stored in a memory and executed by a suitable instruction execution system, such as a microprocessor or specially designed hardware. It will be appreciated by those skilled in the art that the apparatus and methods described above may be implemented using computer executable instructions and/or embodied in processor control code, for example such code provided on a carrier medium such as a diskette, CD-or DVD-ROM, a programmable memory such as read-only memory (firmware) or a data carrier such as an optical or electronic signal carrier. The apparatus and its modules of the present invention may be implemented by hardware circuits such as very large scale integrated circuits or gate arrays, semiconductors such as logic chips, transistors, or programmable hardware devices such as field programmable gate arrays, programmable logic devices, etc., or by software executed by various types of processors, or by a combination of hardware circuits and software, e.g., firmware.
The above description is only for the purpose of illustrating the present invention and the appended claims are not to be construed as limiting the scope of the invention, which is intended to cover all modifications, equivalents and improvements that are within the spirit and scope of the invention as defined by the appended claims.
Claims (8)
1. A batch construction and management method for virtual users of an anti-detection online social network is characterized by comprising the following steps:
mining real user identity attribute rules, and automatically constructing virtual user identities according to the rules;
the virtual user behavior model generation module is combined with the normal activity mode of the real user and the interest attribute of the virtual user to construct a user behavior model based on the interest attribute; the virtual user execution module guides the virtual user to execute daily behaviors on the social network according to the user behavior model;
the community penetration module guides the virtual user to actively send friend requests to real users with high identity similarity and common friends in the target community according to the homogeneity principle;
the community penetration module guides the virtual user to efficiently establish a friend relationship with the real user according to the community penetration strategy based on the homogeneity principle so as to be merged into the real user network community; the homogeneity principle related by the invention means that friend relationships are easier to establish among users with similar personal attributes, and the users with friend relationships often have similar attributes, wherein the personal attributes comprise but are not limited to sex, age, native place, hobby, occupation, educational background and network structure; the homogeneity of the network structure is also called as a ternary closure, which means that if two people have common friends, the probability of the two people becoming friends in the future is improved;
further comprising:
(1) The community penetration module sends a command to each virtual user, and the command instructs the virtual users to globally establish friend relationships based on the principle of homogeneity, namely virtual users with similar identities are preferentially connected; specifically, the number of friends to be connected by each virtual user can be referred to the average number of friends of normal users in the target community;
(2) The community penetration module sends a command to each virtual user, and the command instructs each virtual user to select k identity similarities larger than a threshold value t in the target community link And actively sending friend requests; k and t thereof link The method is preset by an administrator, and different values can be selected according to different infiltration strategies; the similarity of two user identity attributes can be calculated based on the number of common friends, a vector space model VSM, an LDA theme model, word2vec and node2 vec;
(3) Each virtual user traverses each user in the friend list of the real user with established friend relationship and calculates the virtual userIdentity similarity between the user and the users, when the similarity is larger than a threshold value t link When the friend receives the request, actively sending the friend request; and repeating the step until the virtual user successfully establishes the friend relationship with the n real users, wherein the value of the specific n is preset by an administrator.
2. The method for batch construction and management of virtual users of anti-detection online social networks as claimed in claim 1, wherein a target community where the virtual users to be constructed are located is selected, real user identity attribute rules of the target community are mined, and batch realistic virtual user identities are automatically constructed based on the rules.
3. The batch building and management method for anti-detection online social network virtual users according to claim 1, further comprising:
(1) Selecting a target community where a virtual user to be constructed is located, wherein the target community can be an enterprise internal organization network, a campus internal social network and a friend network based on common interests; acquiring attribute values of real user identities in a target community, including gender, age, occupation, residence, education background and interests, establishing a data structure for the user identities, and sorting and combining to obtain a set of real user identities in the target community;
(2) Mining various types of rules of real identity attribute values in the real user identity set collected in the step (1), wherein the rules comprise attribute value setting rules, attribute value statistical distribution rules and attribute association rules; the attribute value setting rule refers to the possible value range of each attribute; the attribute value statistical distribution rule refers to the value statistical distribution characteristic of each attribute; the attribute value association rule refers to the dependency relationship between values corresponding to different attributes; when the attribute association rule is mined, association knowledge between identity attribute values can be mined by adopting an association analysis algorithm;
(3) Setting a virtual user identity template, namely selecting an identity attribute set to represent a virtual user identity; taking the identity attribute rule obtained in the step (2) as a constraint set, and taking the real user attribute value set as a value range of the identity attribute; in the virtual user creating stage, the attribute of the friend list is uniformly set to Null; assigning values to each attribute in sequence by using a backtracking search algorithm, backtracking when no legal value can be assigned to a certain attribute, and successfully generating the virtual user identity when all the attributes of the virtual user identity are assigned under the condition of meeting the constraint condition; this step is repeated to produce a batch of virtual user identities similar and realistic to the target community real user identities, wherein the number of virtual user identities to be constructed is predefined by the administrator.
4. The batch building and managing method for virtual users in anti-detection online social networks as claimed in claim 1, wherein the virtual user behavior model generating module generates a virtual user behavior model based on the behavior pattern of the real user and the identity attribute of the virtual user, and the virtual user behavior executing module reads in the virtual user behavior model to guide the virtual user to execute the daily behavior conforming to the identity and normal activity pattern of the virtual user, specifically comprising:
(1) Analyzing the real user behavior data, extracting the daily activity mode of the real user, referring to the real user behavior activity mode, and manually setting the virtual user behavior mode; the controller is used for controlling the time mode of the daily behavior of the virtual user to enable the daily behavior of the virtual user to accord with the behavior characteristic of a normal user;
(2) Setting an interest-based virtual user browsing behavior strategy and an interest-based release behavior strategy based on the user identity interest attribute so as to ensure that the behavior of the virtual user is associated with the interest attribute of the virtual user; the virtual user browsing behavior strategy is that the similarity between the browsed text content and the virtual user interest belonging keyword is calculated by a text similarity calculation method in the browsing process, and the similarity is compared with a preset threshold value t like 、t repost 、t comment The size of the data determines whether to perform operations of approval, forwarding and comment; the virtual user issuing behavior strategy mainly relates to the construction of text contents related to interest attributes of the virtual user; the specific process is that firstly, the real users in the target community are randomly collected to be publishedThe similarity between the interest of the virtual user and the published text is calculated by a text similarity calculation method, and the similarity is selected to be larger than a preset threshold value t write The text to be published is a candidate text, and then the candidate text is cut, spliced, added/removed with special symbols and processed in a similar meaning word replacement mode to obtain the final text content to be published of the virtual user; the text similarity calculation method can adopt a vector space model VSM, an LDA topic model and a word2vec similarity calculation method;
(3) Combining the virtual user daily behavior controller obtained in the step (1) and the virtual user behavior strategy based on the interest obtained in the step (2) to construct a virtual user behavior model;
(4) The virtual user execution module reads in a virtual user behavior model and guides the virtual user execution unit to execute daily behavior actions of each virtual user; the virtual user execution units can be real computers or mobile phones or virtual machines, and each virtual user execution unit is uniquely bound with one virtual user.
5. A computer device comprising a memory and a processor, wherein the memory stores a computer program, and the computer program when executed by the processor causes the processor to execute the method for batch building and managing virtual users of anti-detection online social networks according to any one of claims 1 to 4.
6. A computer-readable storage medium storing a computer program which, when executed by a processor, causes the processor to execute the method for batch building and managing virtual users of anti-detection online social networks according to any one of claims 1 to 4.
7. An information data processing terminal, characterized in that the information data processing terminal is used for implementing the batch construction and management method for virtual users of anti-detection online social networks according to any one of claims 1 to 4.
8. An anti-detection online social network virtual user batch construction and management system implementing the anti-detection online social network virtual user batch construction and management method of any one of claims 1 to 4, wherein the anti-detection online social network virtual user batch construction and management system comprises:
the virtual identity building module is used for mining real user identity attribute rules from the real user identity attribute set of the target community and automatically generating batch vivid virtual user identities according to the rules;
the virtual user behavior model generation module is used for generating a user behavior model based on the user identity, which is required by the virtual user to execute daily behaviors, according to the virtual user identity provided by the virtual identity construction module and a manually set daily behavior mode of the virtual user so as to ensure the relevance of the virtual user behavior and the identity attribute of the virtual user;
the community penetration module is used for sending the penetration strategy to the virtual user execution module and guiding the virtual user to actively establish a friend relationship with the real user according to the community penetration strategy based on the homogeneity principle so as to be merged into the community, so that the virtual user has credible social relationship characteristics;
the virtual user management module is used for sending a command to each virtual user execution unit, controlling the behavior operation of each virtual user in real time, and simultaneously displaying the running state of each virtual user to achieve the purpose of real-time control over the virtual users;
the virtual user execution module is a unique module directly interacting with virtual users, and comprises a large number of virtual user execution units, each virtual user execution unit uniquely corresponds to one virtual user, and is used for executing daily behavior operations of the virtual users according to the virtual user behavior model transmitted by the virtual user behavior model generation module and executing behavior operations corresponding to commands transmitted by other modules.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110161316.9A CN113158192B (en) | 2021-02-05 | 2021-02-05 | Batch construction and management method and system for anti-detection online social network virtual users |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110161316.9A CN113158192B (en) | 2021-02-05 | 2021-02-05 | Batch construction and management method and system for anti-detection online social network virtual users |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113158192A CN113158192A (en) | 2021-07-23 |
| CN113158192B true CN113158192B (en) | 2022-10-18 |
Family
ID=76882823
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110161316.9A Active CN113158192B (en) | 2021-02-05 | 2021-02-05 | Batch construction and management method and system for anti-detection online social network virtual users |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113158192B (en) |
Families Citing this family (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113515719B (en) * | 2021-07-29 | 2024-01-12 | 北京百度网讯科技有限公司 | Method and device for cold starting community products |
| CN114357308B (en) * | 2021-09-17 | 2022-09-02 | 北京能科瑞元数字技术有限公司 | Manufacturing enterprise supply and demand docking method and device based on recommendation |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP5799454B1 (en) * | 2015-03-17 | 2015-10-28 | 株式会社ｇｌｏｏｐｓ | Game server, game control method, game program, game program recording medium, and terminal device |
| CN109102061A (en) * | 2018-08-10 | 2018-12-28 | 哈尔滨工业大学（威海） | A kind of group of subscribers behavior generation system meeting human dynamics rule, equipment and storage medium |
| CN112000925A (en) * | 2020-08-14 | 2020-11-27 | 广州市百果园信息技术有限公司 | User account identification method, device, equipment and medium |
Family Cites Families (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| US20110099237A1 (en) * | 2009-10-23 | 2011-04-28 | Kfir Luzzatto | System for operating a social network and method therefor |
| CN104660594B (en) * | 2015-02-09 | 2018-01-09 | 中国科学院信息工程研究所 | A kind of virtual malicious node and its Network Recognition method towards social networks |
| CN111415167B (en) * | 2020-02-19 | 2023-05-16 | 同济大学 | Network fraud transaction detection method and device, computer storage medium and terminal |
-
2021
- 2021-02-05 CN CN202110161316.9A patent/CN113158192B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP5799454B1 (en) * | 2015-03-17 | 2015-10-28 | 株式会社ｇｌｏｏｐｓ | Game server, game control method, game program, game program recording medium, and terminal device |
| CN109102061A (en) * | 2018-08-10 | 2018-12-28 | 哈尔滨工业大学（威海） | A kind of group of subscribers behavior generation system meeting human dynamics rule, equipment and storage medium |
| CN112000925A (en) * | 2020-08-14 | 2020-11-27 | 广州市百果园信息技术有限公司 | User account identification method, device, equipment and medium |
Non-Patent Citations (1)
| Title |
|---|
| 大数据环境下的微信息蜜罐监测;孙彬 等;《湖南科技大学学报（自然科学版）》;20171231;第32卷(第4期);第69-78页 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113158192A (en) | 2021-07-23 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| RU2708508C1 (en) | Method and a computing device for detecting suspicious users in messaging systems | |
| Jain et al. | A survey of phishing attack techniques, defence mechanisms and open research challenges | |
| US11921864B2 (en) | Threat mitigation system and method | |
| US20190222589A1 (en) | Method computing device for detecting malicious domain names in network traffic | |
| US9860270B2 (en) | System and method for determining web pages modified with malicious code | |
| US9223961B1 (en) | Systems and methods for performing security analyses of applications configured for cloud-based platforms | |
| Ji et al. | Combating the evasion mechanisms of social bots | |
| Pham et al. | Phishing-aware: A neuro-fuzzy approach for anti-phishing on fog networks | |
| CN113158192B (en) | Batch construction and management method and system for anti-detection online social network virtual users | |
| JP2005135381A (en) | System and method for client-based web crawling | |
| US11785044B2 (en) | System and method for detection of malicious interactions in a computer network | |
| Chen et al. | Ai@ ntiphish—machine learning mechanisms for cyber-phishing attack | |
| RU2701040C1 (en) | Method and a computer for informing on malicious web resources | |
| US8955127B1 (en) | Systems and methods for detecting illegitimate messages on social networking platforms | |
| US11023590B2 (en) | Security testing tool using crowd-sourced data | |
| Chen et al. | FPM: Four-factors Propagation Model for passive P2P worms | |
| Haque et al. | A meta data mining framework for botnet analysis | |
| US20220277076A1 (en) | Threat mitigation system and method | |
| RU2534935C2 (en) | System and method of adaptive control and monitoring of user actions based on user behaviour | |
| Zhang et al. | The dynamical modeling analysis of the spreading of passive worms in P2P networks | |
| Hayati et al. | Rule-based on-the-fly web spambot detection using action strings | |
| Sahoo et al. | Identification of malicious accounts in Facebook | |
| US11709946B2 (en) | Threat mitigation system and method | |
| Wang et al. | A mobile botnet model based on android system | |
| Akinyemi | V3 Onion Service Vulnerability on Website Fingerprinting |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |