CN113807977A - Method, system, device and medium for detecting Touchi attack based on dynamic knowledge graph - Google Patents

Abstract

The invention provides a dynamic knowledge graph-based trusting attack detection method, which comprises the following steps: collecting user information; calculating personal preference and social style of the user; establishing a user relationship dynamic knowledge graph in combination with the change of the user relationship along with the dynamic change factors; according to the fact that the user relationship of the real user changes along with the dynamic change factors, the user relationship of the trustee attack user does not change along with the dynamic change factors after the propagation capacity is elapsed, and the user clustering method is utilized to carry out user clustering on the user relationship dynamic knowledge graph so as to detect the trustee attack user. According to the method for detecting the attack support based on the dynamic knowledge graph, the user is simulated as the social sensor, the user relation dynamic knowledge graph is established by combining the change of the user relation along with the dynamic change factors, the dynamic change of the user relation in social activities is accurately described, the user relation changing along with the dynamic change factors at a plurality of moments is collected to analyze and detect the attack support user, and the attack support user can be detected more accurately.

Description

Method, system, device and medium for spoofing attack detection based on dynamic knowledge graph

technical field

The present invention relates to the technical field of spoofing attack detection, in particular to a spoofing attack detection method, system, device and computer-readable storage medium based on a dynamic knowledge graph.

Background technique

With the continuous development of Internet technology, especially the explosive growth of news, commodities and entertainment resources, people also face serious information overload problems when they turn to the Internet to search for the items they need. In order to provide people with information quickly and accurately, recommender systems are widely used in various fields. Due to the openness and other characteristics of the recommender system itself, it gives users the opportunity to inject false ratings and false social relations into the system. Among them, the attacked user changes the real user social relationship by establishing a large number of false relationships with other users, thereby affecting the real user's choice, and the attacked user will also spread the influence of the false relationship through the social network.

Existing methods for detection of spoofing attacks can be divided into supervised, unsupervised and semi-supervised detection methods. The supervised detection method mainly detects the spoofing attack by training the classifier, such as extracting features from the user registration information, user published content and other information to construct the classifier. The supervised detection method requires a large number of samples, and the cost of manually labeling the samples is relatively high; Unsupervised detection methods mainly use the topological relationship of social networks to identify outliers in the network, such as detection methods that use text and URL similarity to cluster posts, etc. Unsupervised detection methods have high false positive rates and poor robustness. However, semi-supervised detection methods that combine the two mostly start from the perspectives of similarity between users, user rating values, etc., and rarely consider the dynamic relationship between users.

Whether supervised, unsupervised, or semi-supervised detection methods rarely take into account the use of dynamic social relations between users to detect users who attack users, because the social relations between real users will occur with dynamic factors. Changes, dynamic change factors can be, for example, the flow of time or the occurrence of emergencies, real users may have active connections with the occurrence of an emergencies, the ability to reproduce and spread will change, and attacks The user only affects the real user when it is first injected. With the disappearance of its spreading ability, no matter how the dynamic factors change, the attacking user will not interact with the real user, and will no longer have any effect on the behavior of the real user. By using this point, we can effectively improve the existing methods for detecting tossing attacks, so as to improve the accuracy of tossing-up attacks.

SUMMARY OF THE INVENTION

The present invention provides a method, system, device and computer-readable storage medium for spoofing attack detection based on a dynamic knowledge graph, which simulates users as social sensors, and establishes a dynamic knowledge graph of user relationships in combination with changes in user relationships with dynamic change factors, which is more accurate Describe the dynamic changes of user relationships in social activities, without relying too much on information such as user historical scores, and not only based on the relationship of users at a certain moment to detect attacking users, but the set changes at certain moments with dynamic factors The user relationship of the user can be analyzed and detected, and the false social relationship of the attacking user can be amplified and detected more accurately.

The present invention provides a method for detecting spoofing attacks based on a dynamic knowledge graph, comprising:

collect user information;

According to the user information, combined with the change of the user relationship with the dynamic change factor, a dynamic knowledge map of the user relationship is established;

According to the fact that the user relationship of the real user changes with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears, and the graph community clustering method is used to perform user clustering on the dynamic knowledge graph of the user relationship. , to detect users who are under attack.

According to a method for detecting spoofing attacks based on a dynamic knowledge graph provided by the present invention, the establishment of a dynamic knowledge graph of user relationships according to the user information and in combination with changes in user relationships with dynamic change factors, includes:

According to the user information, the closeness of the relationship between users and the social style of the user are calculated, and a static knowledge map of user relationships corresponding to several moments is established;

According to the user information, combined with the changes of the user relationship with the dynamic change factors, calculate the relationship weight between users and the change value of the user relationship at several moments, and fuse several static knowledge graphs of the user relationship and the relationship weight between users at the corresponding moment. The value and the change value of the user relationship are obtained, and the dynamic knowledge map of the user relationship is obtained.

According to a method for detecting fraudulent attacks based on a dynamic knowledge graph provided by the present invention, the collection of user information includes:

Collect user set R, where,

R={R ₁ , R ₂ ,...,R _i ,...,R _n }, i∈[1,n],

R represents a set of user groups, and the set R includes n user groups, denoted as R ₁ , R ₂ , ..., R _i , ... , R _n , and R _i represents the users of the ith user group among the n user groups The set, including m users in the set R _i , is expressed as

Collect a set of user profiles UP, where,

UP={z ₁ , z ₂ , z ₃ , ... z _i ... z _n }, i∈[1,n],

Ia=w ₁ ×he+w ₂ ×we+w ₃ ×se+w ₄ ×ag+w ₅ ×pr,

Sa=w ₆ ×ac+w ₇ ×fe+w ₈ ×in+w ₉ ×ad,

表示m个用户中的第j个用户的档案，<Ia|Sa>表示<用户个体属性|用户社会属性>，在用户个体属性Ia中：he表示身高属性、we表示体重属性、se表示性别属性、ag表示年龄属性、pr表示职业属性，在用户社会属性Sa中：ac表示活跃度属性、fe表示反馈性属性、in表示影响力属性、以及ad表示适应性属性，w_i表示权重比例；UP represents a set of profiles of user groups, and the set UP includes profiles of n user groups, denoted as z ₁ , z ₂ , z ₃ , ... z _i ... z _n , and z _i represents the i-th user in n user groups The set of files of users in the group, the set _zi includes the files of m users, which is expressed as

Represents the profile of the jth user among m users, <Ia|Sa> represents <user individual attribute|user social attribute>, in the user individual attribute Ia: he represents the height attribute, we represents the weight attribute, and se represents the gender attribute , ag means age attribute, pr means occupation attribute, in user social attribute Sa: ac means activity attribute, fe means feedback attribute, in means influence attribute, and ad means adaptability attribute, w _i means weight ratio;

Collect user access set UH, where,

UH={u ₁ ,u ₂ ,u ₃ ,…u _i ,…,u _n }, i∈[1,n],

表示在第i个用户群体中的第j个用户的访问记录，{Item|number,action,…}表示用户对项目的访问记录，{User|number,action…}表示用户对用户的访问记录。UH represents the set of access records of user groups, and the set UH includes the access records of n user groups, denoted as u ₁ , u ₂ , u ₃ , ... u _i , ..., u _n , where u _i represents the nth user group among the n user groups The set of access records of i user groups, the set _ui includes the access records of m users, which is expressed as

Indicates the access record of the jth user in the ith user group, {Item|number, action,...} represents the user's access record to the item, {User|number, action...} represents the user's access record to the user.

According to a method for detecting fraudulent attacks based on a dynamic knowledge graph provided by the present invention, the closeness of the relationship between users and the social style of the user are calculated according to the user information, and the static knowledge of user relationships corresponding to several moments is established. Atlas, including:

The direct interaction information of the user is extracted through the user access set UH, the direct interaction information includes the number of followers IC of the user, the number of followers NO, the number of items NI accessed by the user, the number of items SN accessed by the user in the same field, and the number of comments of the user. NC, the time TC of the user's comment, and the rating RO of the target user by other users;

According to the user information, the closeness of the relationship between users is calculated by formula 1, where formula 1 is:

与第N层级的用户

的关系紧密度，层级为以目标用户为中心向外围扩散有关系用户的层数。Ia表示目标用户的个体属性数据，

表示其他用户的个体属性数据，

为Ia与

的点积，用于表示目标用户和其他用户在个体属性数据上的相关程度，Sa表示目标用户的社会属性数据，

表示其他用户的社会属性数据，

为Sa与

的点积，用于表示目标用户和其他用户在社会属性数据上的相关程度，Cl表示目标用户和其他用户在个体属性数据上的相关程度和社会属性数据上的相关程度的和；where F _N represents the user

with Nth tier users

The level of relationship is the number of layers of related users that spread from the center to the periphery of the target user. Ia represents the individual attribute data of the target user,

Represents individual attribute data of other users,

for Ia with

The dot product of is used to represent the degree of correlation between the target user and other users on individual attribute data, Sa represents the social attribute data of the target user,

Represents social attribute data of other users,

for Sa and

The dot product of , is used to represent the degree of correlation between the target user and other users on social attribute data, and C1 represents the sum of the degree of correlation between the target user and other users on individual attribute data and the degree of correlation on social attribute data;

According to the user information, the user's social style is calculated by Equation 2, where Equation 2 is:

CO＝exp{ad+Ia+NO′}，

CO=exp{ad+Ia+NO'},

ST=exp{ac+pr+Ia+Sa+SN′+TC′+RO′},

DI=exp{fe+Sa+NI′+NC′},

表示第i个用户群体中第j个用户的社交风格，在社交风格中：CO表示趋同性、ST表示稳定性、DI表示方向性，γ为评级参数，w_i表示权重比例，exp表示对参数进行指数函数计算，IC′、NO′、NI′、SN′、NC′、TC′、和RO′分别表示对应的直接交互信息进行归一化处理后的数值；in

Represents the social style of the jth user in the ith user group. In the social style: CO represents convergence, ST represents stability, DI represents directionality, γ represents the rating parameter, w _i represents the weight ratio, and exp represents the pair parameter Perform exponential function calculation, IC', NO', NI', SN', NC', TC', and RO' respectively represent the normalized value of the corresponding direct interaction information;

According to the closeness of the relationship between users and the user's social style, a static knowledge graph of user relationships corresponding to several moments is established.

According to a method for detecting spoofing attacks based on a dynamic knowledge graph provided by the present invention, the relationship weights between users and the change values of user relationships at several moments are calculated according to the user information and in combination with the changes of the user relationship with the dynamic change factors. , and fuse several static knowledge graphs of user relationships and the relationship weights between users and the change values of user relationships at corresponding moments to obtain a dynamic knowledge graph of user relationships, including:

其中，According to the user's social style, combined with the time interval function TI _v , the user relationship weights at several moments are calculated by Equation 3-7

in,

The time interval function TI _v is:

TI _v =(T _s +(j-1)×d, T _s +j×d),

T _s +(j-1)×d represents the start time of detecting user relationship weights, T _s +j×d represents the end time of detecting user relationship weights, TI _v represents the moment of detecting user relationship weights, and d represents the interval Width, e represents the number of emergencies at time TI _v , Δn represents the change in the number of comments at time TI _v , Δr represents the change in user relationship at time TI _v , and K is a calculation parameter;

Formula 3 is:

Formula 4 is:

Formula 5 is:

Formula 6 is:

Formula 7 is:

表示在TI_v时刻下的用户关系权值，

表示在TI_v时刻下用户的社交风格、REC表示在TI_v时刻下用户的关联度、CDL表示在TI_v时刻下用户的可信度、SIM表示在TI_v时刻下用户的相似度、以及IFL表示在TI_v时刻下用户的影响力；in,

represents the user relationship weight at time TI _v ,

represents the user's social style at TI _v time, REC represents the user's relevance at TI _v time, CDL represents the user's reliability at TI _v time, SIM represents the user's similarity at TI _v time, and IFL Indicates the influence of the user at the moment of TI _v ;

According to the user relationship weight, the user relationship change value at several moments is calculated by Equation 8. Equation 8 is:

表示在TI_v时刻下用户关系变化值，

表示在TI_v-1时刻下的用户关系权值，

表示在TI_v时刻下的用户关系权值，

表示对参数

进行指数函数计算，

表示对参数

进行指数函数计算；in,

represents the change value of the user relationship at time TI _v ,

represents the user relationship weight at TI _v-1 time,

represents the user relationship weight at time TI _v ,

Indicates the pair of parameters

Perform exponential function calculations,

Indicates the pair of parameters

Perform exponential function calculations;

A dynamic knowledge map of user relationships is established by integrating several of the static knowledge maps of user relationships and the relationship weights between users and the change values of user relationships at corresponding moments.

According to the method for detecting spoofing attacks based on a dynamic knowledge graph provided by the present invention, the method further includes: displaying the dynamic knowledge graph of user relationships in real time in the form of a relational graph network.

According to a method for detecting a trusted attack based on a dynamic knowledge graph provided by the present invention, the user relationship according to the real user changes with the dynamic change factor, and the user relationship of the trusted attack user does not change with the dynamic change factor after the dissemination of the propagation ability. , using the graph community clustering method to perform user clustering on the user relationship dynamic knowledge graph to detect the users who attack users, and the step includes:

According to the change of the user relationship of the real user with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears. The user modularity of the dynamic knowledge graph of the user relationship is calculated by using Equation 9. Equation 9 is:

表示用户

的度，

表示用户

的度，

的值为用户关系动态知识图谱中图的邻接矩阵中的值，

表示用户

的聚类，

表示用户

的聚类，δ为克罗内克函数，即

若用户

和用户

均随动态变化因素产生变化，即属于同一聚类，则

为1，若用户

和用户

中的一个随动态变化因素不产生变化，即不属于同一聚类，则

为0，若用户

和用户

均随动态变化因素不产生变化，即属于同一聚类，则

为1；Among them, M represents the user modularity of the user relationship dynamic knowledge graph, L represents the number of edges contained in the graph in the user relationship dynamic knowledge graph, that is, the user relationship, H represents the number of users,

represents the user

degree,

represents the user

degree,

The value of is the value in the adjacency matrix of the graph in the user relationship dynamic knowledge graph,

represents the user

clustering,

represents the user

The clustering of , δ is the Kronecker function, that is

If the user

and users

All change with dynamic factors, that is, belong to the same cluster, then

is 1, if the user

and users

One of them does not change with the dynamic change factor, that is, it does not belong to the same cluster, then

is 0, if the user

and users

All of them do not change with dynamic changing factors, that is, they belong to the same cluster, then

is 1;

Perform multiple modular calculations on the user relationship dynamic knowledge graph until all users are clustered, so as to obtain a set of real users and a set of attacked users.

The present invention also provides a spoofing attack detection system based on a dynamic knowledge graph, comprising:

User information collection module, used to collect user information;

A user relationship dynamic knowledge graph establishment module is used to establish a user relationship dynamic knowledge graph according to the user information and in combination with the changes of the user relationship with the dynamic change factors;

The trust attack detection module is used to change the user relationship of the real user with the dynamic change factor, and the user relationship of the trust attack user does not change with the dynamic change factor after the propagation ability disappears, and uses the graph community clustering method to analyze the user relationship. The dynamic knowledge graph performs user clustering to detect users who are under attack.

The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, when the processor executes the program, the dynamic knowledge-based dynamic knowledge-based method described in any of the above-mentioned processes is implemented when the processor executes the program. Steps of the Graph's toll attack detection method.

The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, implements the steps of any of the above-mentioned methods for detecting spoofing attacks based on dynamic knowledge graphs.

The present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the steps of any of the above-mentioned methods for detecting spoofing attacks based on a dynamic knowledge graph.

The method, system, device and computer-readable storage medium for spoofing attack detection based on dynamic knowledge graph provided by the present invention take into account the influence of dynamic change factors on the social relationship of real users, simulate users as social sensors, and combine user relationships with dynamic The change of changing factors establishes a dynamic knowledge map of user relationships, which more accurately describes the dynamic changes of user relationships in social activities, without relying too much on information such as user historical scores, and not only based on the relationship between users at a certain moment. , but collects the user relationship that changes with dynamic factors at several moments to analyze and detect the user who is under attack. The fake social relationship of the under attack user is amplified and can be detected more accurately.

Description of drawings

In order to explain the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the accompanying drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are the For some embodiments of the invention, for those of ordinary skill in the art, other drawings can also be obtained according to these drawings without any creative effort.

Fig. 1 is the schematic flow chart of the method for detecting spoofing attack based on dynamic knowledge graph provided by the present invention;

Figure 2 is a schematic diagram of the dissemination of social sensors;

Fig. 3 is a line graph of the behaviors of users who attack users, real users, and zombie users. The vertical axis I represents the user's influence, the horizontal axis t represents time, the line A represents the behavioral representation of the attacking user, and the line B represents the behavioral representation of the real user. , C is the behavioral representation of zombie users, and D is the dynamic change factor.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the technical solutions in the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are part of the embodiments of the present invention. , not all examples. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

The following describes the method for detecting spoofing attacks based on the dynamic knowledge graph of the present invention with reference to FIG. 1 to FIG. 3 .

The method for detecting an attack based on a dynamic knowledge graph of the present invention, as shown in Figure 1, includes the steps:

S1: Collect user information.

Specifically, S1 includes:

S11: Collect the user set R, where,

R={R ₁ ,R ₂ ,…,R _i ,…,R _n }, i∈[1,n],

R represents the set of user groups, and the set R includes n user groups, denoted as R ₁ , R ₂ ,…,R _i ,…,R _n , and R _i indicates the users of the ith user group among the n user groups The set, including m users in the set R _i , is expressed as

S12: Collect the user profile set UP, wherein,

UP={z ₁ , z ₂ , z ₃ ,...z _i ...z _n }, i∈[1,n],

Ia=w ₁ ×he+w ₂ ×we+w ₃ ×se+w ₄ ×ag+w ₅ ×pr,

Sa=w ₆ ×ac+w ₇ ×fe+w ₈ ×in+w ₉ ×ad,

表示m个用户中的第j个用户的档案，<Ia|Sa>表示<用户个体属性|用户社会属性>，属性是一对多关系和多对一关系的主要来源，在用户个体属性Ia中：he表示身高属性、we表示体重属性、se表示性别属性、ag表示年龄属性、pr表示职业属性，在用户社会属性Sa中：ac表示活跃度属性、fe表示反馈性属性、in表示影响力属性、以及ad表示适应性属性，优选对用户个体属性和用户社会属性的各种属性参数进行归一化处理，归一化处理后的数值区域为[0，5]，有利于保持参数统一性，w_i表示权重比例，权重比例可以根据实际托攻击检测所应用的领域特点或专家经验来调整。UP represents a collection of profiles of user groups. The set UP includes profiles of n user groups, which are denoted as z ₁ , z ₂ , z ₃ , …z _i …z _n , and z _i represents the i-th user in n user groups The set of files of users in the group, the set _zi includes the files of m users, which is expressed as

Represents the profile of the jth user among m users, <Ia|Sa> represents <user individual attribute|user social attribute>, attribute is the main source of one-to-many relationship and many-to-one relationship, in user individual attribute Ia : he means height attribute, we means weight attribute, se means gender attribute, ag means age attribute, pr means occupation attribute, in user social attribute Sa: ac means activity attribute, fe means feedback attribute, in means influence attribute , and ad represent adaptive attributes. It is preferable to normalize various attribute parameters of the user's individual attributes and user's social attributes. The normalized value range is [0, 5], which is conducive to maintaining the uniformity of parameters. w _i represents the weight ratio, and the weight ratio can be adjusted according to the domain characteristics or expert experience used in the actual attack detection.

S13: Collect user access set UH, wherein,

UH={u ₁ ,u ₂ ,u ₃ ,…u _i ,…,u _n }, i∈[1,n],

表示在第i个用户群体中的第j个用户的访问记录，{Item|number,action,…}表示用户对项目的访问记录，{User|number,action…}表示用户对用户的访问记录。UH represents the set of access records of user groups, and the set UH includes access records of n user groups, denoted as u ₁ , u ₂ , u ₃ ,…u _i ,…,u _n , where u _i represents the nth user group among the n user groups The set of access records of i user groups, the set _ui includes the access records of m users, which is expressed as

Indicates the access record of the jth user in the ith user group, {Item|number, action,...} represents the user's access record to the item, {User|number, action...} represents the user's access record to the user.

The more and more comprehensive user information is collected, the more accurate the subsequent attack detection is.

S2: According to the user information, and in combination with the change of the user relationship with the dynamic change factor, a dynamic knowledge graph of the user relationship is established.

Specifically, the dynamic change factor may be a time factor, an unexpected event factor, and the like.

S2 includes:

S21: Calculate the closeness of the relationship between users and the social style of the user according to the user information, and establish a static knowledge map of user relationships corresponding to several moments.

More specifically, S21 includes:

S211: Extract the user's direct interaction information DEI through the user access set UH, where the direct interaction information DEI includes the number of followers IC of the user, the number of followers NO, the number of items NI accessed by the user, the number of items SN in the same field accessed by the user, The number of comments NC by the user, the time TC of the user's comment, and the ratings RO of the target user by other users.

S212: According to the user information, calculate the closeness of the relationship between users by formula 1, where formula 1 is:

与第N层级的用户

的关系紧密度，层级表示以目标用户为中心向外围扩散有关系用户的层数，像图2示出的，F1-F3为以目标用户为中心的三个层级，Ia表示目标用户的个体属性数据，

表示其他用户的个体属性数据，

为Ia与

的点积，用于表示目标用户和其他用户在个体属性数据上的相关程度，Sa表示目标用户的社会属性数据，

表示其他用户的社会属性数据，

为Sa与

的点积，用于表示目标用户和其他用户在社会属性数据上的相关程度，Cl表示目标用户和其他用户在个体属性数据上的相关程度和社会属性数据上的相关程度的和。F_N的值越大，代表目标用户与该第N层级的用户的关系紧密度越高，随层级向外扩展，F_N的值会逐渐趋近于零。where F _N represents the target user

with Nth tier users

The degree of relationship closeness, the level represents the number of layers of related users that spread from the target user as the center to the periphery. As shown in Figure 2, F1-F3 are the three levels centered on the target user, and Ia represents the individual attributes of the target user. data,

Represents individual attribute data of other users,

for Ia with

The dot product of is used to represent the degree of correlation between the target user and other users on individual attribute data, Sa represents the social attribute data of the target user,

Represents social attribute data of other users,

for Sa and

The dot product of is used to represent the degree of correlation between the target user and other users on social attribute data, and C1 represents the sum of the degree of correlation between the target user and other users on individual attribute data and the degree of correlation on social attribute data. The larger the value of F _N , the higher the relationship between the target user and the user at the Nth level. As the level expands outward, the value of F _N will gradually approach zero.

Preferably, if F _N ∈ [0, 0.3], a static knowledge graph of user relationships corresponding to several moments is directly established.

S213: According to the user information, calculate the user's social style by formula 2, where formula 2 is:

CO=exp{ad+Ia+NO'},

ST=exp{ac+pr+Ia+Sa+SN′+TC′+RO′},

DI=exp{fe+Sa+NI′+NC′},

表示第i个用户群体中第j个用户的社交风格，在社交风格中：CO表示趋同性、ST表示稳定性、DI表示方向性，γ为评级参数，对用户偏好进行统一量级评估，值域为[0，5]，w_i表示权重比例，exp表示对参数进行指数函数计算，以更好地进行对比计算，IC′、NO′、NI′、SN′、NC′、TC′、和RO′分别表示对应的直接交互信息进行归一化处理后的数值。in

Represents the social style of the jth user in the ith user group. In the social style: CO represents convergence, ST represents stability, DI represents directionality, γ is a rating parameter, and a uniform magnitude evaluation is performed on user preferences. The domain is [0, 5], _wi represents the weight ratio, exp represents the exponential function calculation of the parameters for better comparison calculation, IC', NO', NI', SN', NC', TC', and RO' represents the normalized value of the corresponding direct interaction information, respectively.

Convergence is a phenomenon in which users refer to other users’ preferences. For example, users like to follow some bloggers to make purchases; stability means that the social relations of real users will not change easily. In the event of emergencies, user relations will change slightly , but two users with high intimacy will not suddenly break the relationship, and the relationship network is relatively stable; the directionality is the output and feedback between the user and other users, such as the user only viewing the website without feedback, it is unidirectional. Feedback such as commenting is bidirectional.

S214: According to the closeness of the relationship between users and the social style of the user, establish a static knowledge graph of user relationships corresponding to several moments. The static knowledge graph of user relationships at a certain moment includes attribute information (including user individual attributes and user social attributes), social style, and user relationship descriptions of users at that moment.

S22: According to the user information, combined with the change of the user relationship with the dynamic change factor, calculate the relationship weight between users and the change value of the user relationship at several moments, and fuse several static knowledge graphs of the user relationship and the user relationship at the corresponding moment. The relationship weight and the change value of the user relationship are used to obtain the dynamic knowledge graph of the user relationship.

Specifically, S22 includes:

S221: According to the user's social style, combined with the time interval function TI _v , calculate the user relationship weight MW _TIv at several moments by formula 3-7, wherein,

The time interval function TI _v is preferably:

TI _v =(T _s +(j-1)×d,T _s +j×d),

T _s +(j-1)×d represents the start time of detecting the user relationship weight, T _s +j×d represents the end time of detecting the user relationship weight, d represents the interval width, and e represents the sudden change at the time TI _v . is the number of events, Δn represents the change in the number of comments at the time TI _v , Δr represents the change in the user relationship at the time TI _v , and K is the calculation parameter;

Formula 3 is:

Formula 4 is:

Formula 5 is:

Formula 6 is:

Formula 7 is:

表示在TI_v时刻下多因素权值的比重，即用户关系权值，v为任意时间序列号，

的大小与

因素有关，

表示在TI_v时刻下内用户的社交风格、REC表示在TI_v时刻下用户的关联度、CDL表示在TI_v时刻下用户的可信度、SIM表示在TI_v时刻下用户的相似度、以及IFL表示在TI_v时刻下用户的影响力。其中加上标的参数表示不同用户的参数，即进行不同用户之间的参数计算，例如

表示不同用户之间在社交风格中的稳定性上的差值，当参数差值大于1时，说明用户不属于同一量级，对数值进行求取方式实现调整，对于REC、CDL、SIM、IFL进行归一化，设定值域为[0，5]。in,

Represents the proportion of multi-factor weights at TI _v time, that is, the user relationship weights, v is an arbitrary time series number,

size with

factors,

represents the social style of the user at time TI _v , REC represents the relevance of the user at time TI _v , CDL represents the credibility of the user at time TI _v , SIM represents the similarity of the user at time TI _v , and IFL represents the user's influence at TI _v time. The marked parameters represent the parameters of different users, that is, the parameter calculation between different users is performed, for example

Represents the difference in the stability of social styles between different users. When the parameter difference is greater than 1, it means that the users do not belong to the same order of magnitude. For normalization, the set value range is [0, 5].

Relevance is the closeness of the relationship between users, such as leaving messages, comments, and following each other; credibility is a form of user influence. will have a great influence on followers; similarity is the degree of similarity between users' preferences and other behaviors. According to research, good friends have high similarity, and their preferences are similar. Influence is the user’s ability to influence. When an emergency occurs, the influence will change greatly due to factors such as negative news. Therefore, it is necessary to detect the user’s relevance, credibility, similarity, and Influence, further, the detection frequency can be adjusted according to the detection needs, and the detection accuracy can be improved.

S222: According to the weight of the user relationship, calculate the change value of the user relationship at a number of moments through Equation 8, where Equation 8 is:

表示在TI_v时刻下用户关系变化值，

表示在TI_v-1时刻下的用户关系权值，

表示在TI_v时刻下的用户关系权值，

表示对参数

进行指数函数计算，

表示对参数

进行指数函数计算，

的值越大，表示在TI_v时刻下的用户关系变化越大，用户越活跃，对事件的反应越强烈，相反，

的值越接近于0，表示在TI_v时刻下的用户关系长时间保持不变，托攻击用户在影响力消逝后的长时间内不会再对任何动态影响因素产生反应，其URC接近于0保持不变，无法参加社交活动，可将其归为可疑候选组。in,

represents the change value of the user relationship at time TI _v ,

represents the user relationship weight at TI _v-1 time,

represents the user relationship weight at time TI _v ,

Indicates the pair of parameters

Perform exponential function calculations,

Indicates the pair of parameters

Perform exponential function calculations,

The larger the value of , the greater the change in the user relationship at the moment TI _v , the more active the user, the stronger the reaction to the event, on the contrary,

The closer the value is to 0, it means that the user relationship at the time TI _v remains unchanged for a long time, and the attacking user will no longer respond to any dynamic influencing factors for a long time after the influence disappears, and its URC is close to 0 Remaining the same, unable to participate in social activities, can be classified as a suspect candidate group.

It is preferable to repeatedly calculate the interrelated functions between users to ensure the accuracy of the obtained data.

S223: Integrate a plurality of the static knowledge graphs of user relationships and the relationship weights between users and the change values of user relationships at corresponding moments to establish and obtain a dynamic knowledge graph of user relationships.

Step S2 simulates users as social sensors. Figure 2 shows the dissemination of social sensors. The innermost users are first affected by dynamic changing factors (for example, the impact of emergencies), and their preference behavior changes, which is first related to the F1 level. The user relationship changes, and then the users at the F1 level give feedback to the corresponding users at the F2 level, but the influence of the users at the F2 level is obviously much weaker than that of the users at the F1 level, and so on. changes are minimal. This is the influence of social sensors on their own environment and their ability to reproduce and spread. Due to the existence of real-time feedback capabilities of social sensors, although the influence will become weaker, the changes in their relationship are more complicated, and corresponding changes will occur immediately when encountering emergencies.

When the attacked user is injected, it will have a certain influence on the real user, and the ability to reproduce and spread in a short period of time is relatively strong. However, the user does not have the nature of social sensors, and after the transmission power disappears, the behavior curve almost returns to a zero state. In the real social process, some users have simple social relationships, weak responses to emergencies, and small changes in behavior curves, which can be called "zombie users". Figure 3 shows the behavioral line graph of three types of users, the vertical axis I represents the user's influence, the horizontal axis t represents time, the A polyline represents the behavioral representation of the attacking user, the B polyline is the behavioral representation of the real user, and the C polyline is the zombie user. The behavioral representation of , D represents dynamic changing factors (such as the occurrence of emergencies). When the attacking user injection and emergencies occur, the real users react very strongly and engage in active social activities, while the zombie user's response is relatively gentle. Although it is gentle, it is also responsive. Inability to respond to emergencies, the behavioral curve approaches zero, overlaps the horizontal axis, and can be classified as unresponsive.

The relationship between the user and other users in the social network is falsely established. For the sales volume of the target product, it will affect the users who establish the false relationship and achieve the purpose of the attack, but in a short period of time, this influence will be weakened or even disappear. In the event of an emergency, the fake user will not change accordingly, and the weight of the fake relationship with the real user is always at the set value and will not change. After real users are affected, they will recover their self-judgment ability in a certain period of time, resulting in resistance. After the attacker's ability to influence wears off, without injecting new relationships, the ability to spread will not regenerate, and it will not be affected by other social sensors.

The present invention takes into account that with the passage of time and the occurrence of emergencies, the user relationship of real users will change dynamically, and the reproduction and dissemination ability will also change, so as to build a user relationship dynamic knowledge map, which can also be used to attack users by trusting Due to the characteristics of the disappearance of communication ability due to false social relations, and the characteristics that users cannot participate in social activities, suspicious candidate groups are generated, but the suspicious candidate groups may contain "zombie users". In order to further improve the accuracy of attack detection, it is necessary to Perform user clustering on the dynamic knowledge graph of user relationships.

Preferably, in this embodiment, the dynamic knowledge graph of user relationships is displayed in real time in the form of a relationship graph network.

S3: According to the fact that the user relationship of the real user changes with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears, and the user relationship dynamic knowledge graph is analyzed by using the graph community clustering method. Clustering to detect users who are under attack.

Specifically, S3 performs user clustering on the user relationship dynamic knowledge graph through a graph community detection method, and step S3 includes:

S31: According to the fact that the user relationship of the real user changes with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears, and the user modularity of the dynamic knowledge graph of the user relationship is calculated by using Equation 9, Equation 9 for:

表示用户

的度，

表示用户

的度，

的值为用户关系动态知识图谱中图的邻接矩阵中的值，

表示用户

的聚类，

表示用户

的聚类，δ为克罗内克函数，即

若用户

和用户

均随动态变化因素产生变化，即属于同一聚类，则

为1，若用户

和用户

中的一个随动态变化因素不产生变化，即不属于同一聚类，则

为0，若用户

和用户

均随动态变化因素不产生变化，即属于同一聚类，则

为1。Among them, M represents the user modularity of the user relationship dynamic knowledge graph, L represents the number of edges contained in the graph in the user relationship dynamic knowledge graph, that is, the user relationship, H represents the number of users,

represents the user

degree,

represents the user

degree,

The value of is the value in the adjacency matrix of the graph in the user relationship dynamic knowledge graph,

represents the user

clustering,

represents the user

The clustering of , δ is the Kronecker function, that is

If the user

and users

All change with dynamic factors, that is, belong to the same cluster, then

is 1, if the user

and users

One of them does not change with the dynamic change factor, that is, it does not belong to the same cluster, then

is 0, if the user

and users

All of them do not change with dynamic changing factors, that is, they belong to the same cluster, then

is 1.

表示用户

和

的度，那么

表示当该网络是随机分配的时候用户

和

之间的预期边数，当

都比较大时，连接用户

和

的边出现的概率就越大，

表示网络的真实结构和随机组合时的预期结构之间的差，当

且

很小时，其返回的值越高，这表明用户

和

之间存在连接，归为一个聚类。Specifically,

represents the user

and

degree, then

Indicates that users are assigned when the network is randomly assigned

and

The expected number of edges between, when

are relatively large, connecting users

and

The greater the probability of the edge appearing,

represents the difference between the true structure of the network and the expected structure when randomly combined, when

and

very small, the higher the value returned, which indicates that the user

and

There is a connection between them and they are classified as a cluster.

Calculate the clusters of all users in the user relationship dynamic knowledge graph, fuse users belonging to the same cluster to form a new cluster, and then calculate the modular change value caused by the formation of the new cluster, and select the largest modular change value The two clusters are fused again, and then the modular change value caused by the formation of a new cluster is calculated, and then fused until all users have been clustered, and finally the "island user set" will be obtained, which is the attacking user. gather. Because the attacked user is a fake social relationship, it has no relationship with the real user, and will not have a social relationship with the real user, so it cannot be clustered with the real user, that is, it is left.

In addition, in order to save events and reduce technical difficulty, it is also possible to cluster only the users in the suspicious candidate group obtained from the dynamic knowledge graph of user relationships, so as to separate out the users under attack.

S32: Perform multiple modular calculations on the user relationship dynamic knowledge graph until all users are clustered to obtain a set of real users and a set of attacking users.

The method for detecting spoofing attacks based on dynamic knowledge graphs of the present invention takes into account the influence of dynamic change factors on the social relations of real users, simulates users as social sensors, and establishes a dynamic knowledge graph of user relations based on the changes of user relations with dynamic change factors. To more accurately describe the dynamic changes of user relationships in social activities, it is not only based on the relationship between users at a certain moment to detect users who are attacking users, but also does not rely too much on data labels such as user historical scores. The ever-changing user relationship is used to analyze and detect the attacking users, so that the false social relations of the attacking users are amplified and can be detected more accurately and efficiently.

More, the present invention integrates the static knowledge graph of user relationship with the weight of the relationship between users and the change value of the user relationship at the corresponding moment, so that the established dynamic knowledge graph of user relationship changes continuously with dynamic change factors, and is more real-time and informative. more comprehensive use.

Further, when the method for detecting fraudulent attacks based on the dynamic knowledge graph of the present invention is applied to a recommender system, when a set of users who are attacking users is detected, the users who are attacking users can be screened out to protect the correct use of the system.

Further, the dynamic knowledge graph of user relationship used in the present invention belongs to a white box, which can increase the interpretability of the system applying the method for detecting fraudulent attacks based on the dynamic knowledge graph of the present invention, which is also conducive to the optimal design of the system, and is convenient for protecting the system. , making people's lives more efficient and faster.

The device for detecting fraudulent attacks based on dynamic knowledge graphs provided by the present invention is described below. The device for detecting fraudulent attacks based on dynamic knowledge graphs described below and the methods for detecting fraudulent attacks based on dynamic knowledge graphs described above may refer to each other correspondingly.

The present invention also provides a spoofing attack detection system based on a dynamic knowledge graph, comprising:

User information collection module, used to collect user information;

A user relationship dynamic knowledge graph establishment module is used to establish a user relationship dynamic knowledge graph according to the user information and in combination with the changes of the user relationship with the dynamic change factors;

The trust attack detection module is used to change the user relationship of the real user with the dynamic change factor, and the user relationship of the trust attack user does not change with the dynamic change factor after the propagation ability disappears, and uses the graph community clustering method to analyze the user relationship. The dynamic knowledge graph performs user clustering to detect users who are under attack.

The present invention also provides an electronic device, which may include: a processor, a communications interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus. communication. The processor can call the logic instructions in the memory to execute the method for detecting spoofing attacks based on the dynamic knowledge graph, and the method includes:

collect user information;

According to the user information, combined with the change of the user relationship with the dynamic change factor, a dynamic knowledge map of the user relationship is established;

According to the fact that the user relationship of the real user changes with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears, and the graph community clustering method is used to perform user clustering on the dynamic knowledge graph of the user relationship. , to detect users who are under attack.

In addition, the above-mentioned logic instructions in the memory can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product. Based on this understanding, the technical solution of the present invention can be embodied in the form of a software product in essence, or the part that contributes to the prior art or the part of the technical solution. The computer software product is stored in a storage medium, including Several instructions are used to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .

In another aspect, the present invention also provides a computer program product, the computer program product includes a computer program, the computer program can be stored on a non-transitory computer-readable storage medium, and when the computer program is executed by a processor, the computer can Execute the method for detecting spoofing attacks based on the dynamic knowledge graph provided by the above methods, and the method includes:

collect user information;

According to the user information, combined with the change of the user relationship with the dynamic change factor, a dynamic knowledge map of the user relationship is established;

According to the fact that the user relationship of the real user changes with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears, and the graph community clustering method is used to perform user clustering on the dynamic knowledge graph of the user relationship. , to detect users who are under attack.

In yet another aspect, the present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored, and the computer program is implemented by a processor to perform the dynamic knowledge graph-based spoofing attack detection provided by the above methods when the computer program is executed. method, which includes:

collect user information;

According to the user information, combined with the change of the user relationship with the dynamic change factor, a dynamic knowledge map of the user relationship is established;

According to the fact that the user relationship of the real user changes with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears, and the graph community clustering method is used to perform user clustering on the dynamic knowledge graph of the user relationship. , to detect users who are under attack.

The device embodiments described above are only illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in One place, or it can be distributed over multiple network elements. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution in this embodiment. Those of ordinary skill in the art can understand and implement it without creative effort.

From the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a necessary general hardware platform, and certainly can also be implemented by hardware. Based on this understanding, the above-mentioned technical solutions can be embodied in the form of software products in essence or the parts that make contributions to the prior art, and the computer software products can be stored in computer-readable storage media, such as ROM/RAM, magnetic A disc, an optical disc, etc., includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to perform the methods described in various embodiments or some parts of the embodiments.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, but not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that it can still be The technical solutions described in the foregoing embodiments are modified, or some technical features thereof are equivalently replaced; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims (10)

1. a method for detecting an attack based on dynamic knowledge graph, is characterized in that, comprises: collect user information; According to the user information, combined with the change of the user relationship with the dynamic change factor, a dynamic knowledge map of the user relationship is established; According to the fact that the user relationship of the real user changes with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears, and the graph community clustering method is used to perform user clustering on the dynamic knowledge graph of the user relationship. , to detect users who are under attack. 2. the method for detecting the attack based on dynamic knowledge graph according to claim 1, is characterized in that, described according to described user information, in conjunction with the change of user relationship with dynamic change factor, establish user relationship dynamic knowledge graph, comprising: According to the user information, the closeness of the relationship between users and the social style of the user are calculated, and a static knowledge map of user relationships corresponding to several moments is established; According to the user information, combined with the changes of the user relationship with the dynamic change factors, calculate the relationship weight between users and the change value of the user relationship at several moments, and fuse several static knowledge graphs of the user relationship and the relationship weight between users at the corresponding moment. The value and the change value of the user relationship are obtained, and the dynamic knowledge map of the user relationship is obtained. 3. The method for detecting an attack based on a dynamic knowledge graph according to claim 2, wherein the collection of user information comprises: Collect user set R, where, R=(R ₁ , R ₂ ,...,R _i ,...,R _n }, i∈[1,n],

R represents a set of user groups, and the set R includes n user groups, denoted as R ₁ , R ₂ , ..., R _i , ... , R _n , and R _i represents the users of the ith user group among the n user groups The set, including m users in the set R _i , is expressed as

Collect a set of user profiles UP, where, UP=(z ₁ , z ₂ , z ₃ , ... z _i ... z _n }, i∈[1,n],

Ia=w ₁ ×he+w ₂ ×we+w ₃ ×se+w ₄ ×ag+w ₅ ×pr,

Sa=w ₆ ×ac+w ₇ ×fe+w ₈ ×in+w ₉ ×ad,

UP represents a set of profiles of user groups, and the set UP includes profiles of n user groups, denoted as z ₁ , z ₂ , z ₃ , ... z _i ... z _n , and z _i represents the i-th user in n user groups The set of files of users in the group, the set _zi includes the files of m users, which is expressed as

Indicates the profile of the jth user among m users, <Ia|Sa> indicates <user individual attribute|user social attribute>, in the user individual attribute Ia: he indicates the height attribute, we indicates the weight attribute, and se indicates the gender attribute , ag means age attribute, pr means occupation attribute, in user social attribute Sa: ac means activity attribute, fe means feedback attribute, in means influence attribute, and ad means adaptability attribute, w _i means weight ratio; Collect user access set UH, where, UH={u ₁ , u ₂ , u ₃ ,...u _i ,...,u _n }, i∈[1,n],

UH represents the set of access records of user groups, and the set UH includes the access records of n user groups, denoted as u ₁ , u ₂ , u ₃ , ... u _i , ..., u _n , where u _i represents the nth user group among the n user groups The set of access records of i user groups, the set _ui includes the access records of m users, which is expressed as

represents the access record of the jth user in the ith user group, {Item|number, action, ...} represents the user's access record to the item, {User|number, action...} represents the user's access record to the user. 4. the method for detecting attack based on dynamic knowledge graph according to claim 3, is characterized in that, described according to described user information, calculates the relationship tightness between users and user's social style, and establishes several moments The corresponding static knowledge graph of user relationships, including: The direct interaction information of the user is extracted through the user access set UH, the direct interaction information includes the number of followers IC of the user, the number of followers NO, the number of items NI accessed by the user, the number of items SN accessed by the user in the same field, and the number of comments of the user. NC, the time TC of the user's comment, and the rating RO of the target user by other users; According to the user information, the closeness of the relationship between users is calculated by formula 1, where formula 1 is:

where F _N represents the user

with Nth tier users

The relationship tightness of , Ia represents the individual attribute data of the target user,

Represents individual attribute data of other users,

for Ia with

The dot product of is used to represent the degree of correlation between the target user and other users on individual attribute data, Sa represents the social attribute data of the target user,

Represents social attribute data of other users,

for Sa and

The dot product of , is used to represent the degree of correlation between the target user and other users on social attribute data, and C1 represents the sum of the degree of correlation between the target user and other users on individual attribute data and the degree of correlation on social attribute data; According to the user information, the user's social style is calculated by Equation 2, where Equation 2 is:

j∈[1,m], i∈[1,n],

CO=exp{ad+Ia+NO'}, ST=exp{ac+pr+Ia+Sa+SN′+TC′+RO′}, DI=exp{fe+Sa+NI′+NC′}, in

Represents the social style of the jth user in the ith user group. In the social style: CO represents convergence, ST represents stability, DI represents directionality, γ represents the rating parameter, w _i represents the weight ratio, and exp represents the pair parameter Perform exponential function calculation, IC', NO', NI', SN', NC', TC', and RO' respectively represent the normalized value of the corresponding direct interaction information; According to the closeness of the relationship between users and the user's social style, a static knowledge graph of user relationships corresponding to several moments is established. 5. The method for detecting spoofing attacks based on a dynamic knowledge graph according to claim 4, characterized in that, according to the user information, in combination with the change of the user relationship with the dynamic change factor, the relationship weight between users under several moments is calculated. value and the change value of user relationship, fuse several static knowledge maps of user relationship and the relationship weight between users and user relationship change value at the corresponding moment to obtain the dynamic knowledge map of user relationship, including: According to the user's social style, combined with the time interval function TI _v , the user relationship weights at several moments are calculated by Equation 3-7

in, The time interval function TI _v is: TI _v =(T _s +(j-1)×d, T _s +j×d),

T _s +(j-1)×d represents the start time of detecting user relationship weights, T _s +j×d represents the end time of detecting user relationship weights, TI _v represents the moment of detecting user relationship weights, and d represents the interval Width, e represents the number of emergencies at time TI _v , Δn represents the change in the number of comments at time TI _v , Δr represents the change in user relationship at time TI _v , and K is a calculation parameter; Formula 3 is:

Formula 4 is:

Formula 5 is:

Formula 6 is:

Formula 7 is:

in,

represents the user relationship weight at time TI _v ,

represents the user's social style at TI _v time, REC represents the user's relevance at TI _v time, CDL represents the user's reliability at TI _v time, SIM represents the user's similarity at TI _v time, and IFL Indicates the influence of the user at the moment of TI _v ; According to the user relationship weight, the user relationship change value at several moments is calculated by Equation 8. Equation 8 is:

in,

represents the change value of the user relationship at time TI _v ,

represents the user relationship weight at TI _v-1 time,

represents the user relationship weight at time TI _v ,

Indicates the pair of parameters

Perform exponential function calculations,

Indicates the pair of parameters

Perform exponential function calculations; A dynamic knowledge map of user relationships is established by integrating several of the static knowledge maps of user relationships and the relationship weights between users and the change values of user relationships at corresponding moments. 6 . The method for detecting fraudulent attacks based on a dynamic knowledge graph according to claim 1 , further comprising: displaying the dynamic knowledge graph of user relationships in real time in the form of a relational graph network. 7 . 7. the method for detecting an attack based on dynamic knowledge graph according to claim 6, it is characterized in that, the user relationship according to the real user produces a change with the dynamic change factor, and the user relationship of the attack user is followed after the propagation ability disappears. If the dynamic change factors do not change, use the graph community clustering method to perform user clustering on the user relationship dynamic knowledge graph, so as to detect the users who attack users, including: According to the change of the user relationship of the real user with the dynamic change factor, the user relationship of the attacking user does not change with the dynamic change factor after the dissemination ability disappears. The user modularity of the dynamic knowledge graph of the user relationship is calculated by using Equation 9. Equation 9 is:

Among them, M represents the user modularity of the user relationship dynamic knowledge graph, L represents the number of edges contained in the graph in the user relationship dynamic knowledge graph, that is, the user relationship, H represents the number of users,

represents the user

degree,

represents the user

degree,

The value of is the value in the adjacency matrix of the graph in the user relationship dynamic knowledge graph,

represents the user

clustering,

represents the user

The clustering of , δ is the Kronecker function, that is

If the user

and users

All change with dynamic factors, that is, belong to the same cluster, then

is 1, if the user

and users

One of them does not change with the dynamic change factor, that is, it does not belong to the same cluster, then

is 0, if the user

and users

All of them do not change with dynamic changing factors, that is, they belong to the same cluster, then

is 1; Perform multiple modular calculations on the user relationship dynamic knowledge graph until all users are clustered, so as to obtain a set of real users and a set of attacked users. 8. A system for detecting attacks based on dynamic knowledge graph, characterized in that, comprising: User information collection module, used to collect user information; A user relationship dynamic knowledge graph establishment module is used to establish a user relationship dynamic knowledge graph according to the user information and in combination with the changes of the user relationship with the dynamic change factors; The trust attack detection module is used to change the user relationship of the real user with the dynamic change factor, and the user relationship of the trust attack user does not change with the dynamic change factor after the propagation ability disappears, and uses the graph community clustering method to analyze the user relationship. The dynamic knowledge graph performs user clustering to detect users who are under attack. 9. An electronic device, comprising a memory, a processor and a computer program stored on the memory and running on the processor, wherein the processor implements the program as claimed in claim 1 when executing the program Steps of any one of the steps of the method for detecting spoofing attacks based on the dynamic knowledge graph described in any one of 7. 10. A non-transitory computer-readable storage medium on which a computer program is stored, characterized in that, when the computer program is executed by a processor, the dynamic knowledge graph based dynamic knowledge graph according to any one of claims 1 to 7 is implemented. The steps of the tow attack detection method.

Images