WO2021223275A1 - Online water army group detection method and apparatus - Google Patents

Abstract

Disclosed is an online water army group detection method. The detection method comprises: acquiring review data information in a network, wherein the review data information comprises reviewed products, reviewers, review time, and reviewer's ratings of the reviewed products (S101); identifying a target product attacked by an online water army group on the basis of the review data information (S102); and generating a candidate online water army group on the basis of the identified target product (S103). By means of the online water army group detection method, locating a target product attacked by an online water army group to detect the online water army group that attacks each target product can greatly improve the time and space efficiency of detecting the online water army group.

Description

Navy group detection method and device

Cross-references to related applications

This application claims the priority and rights of the Chinese patent application No. 202010372504.1 filed with the State Intellectual Property Office of China on May 6, 2020, and the content of the application is incorporated herein by reference in its entirety.

Technical field

This application relates to the field of network security, and more specifically, to a navy group detection method and device.

Background technique

In e-commerce transactions, online product reviews have an important influence on users' purchasing decisions. Users generally tend to buy products with large transaction volume and more positive reviews rather than products with more negative reviews. Therefore, in order to offset transaction volume, increase or decrease the reputation of a product, and earn more profits, many businesses often hire false reviewers to post a large number of false reviews that praise their own products or slander competitors' products. The navy group refers to a group of people who publish false comments in an organized and coordinated manner. Compared with individual naval forces, naval groups have greater influence. This is because the navy group has a larger scale, can conduct fraudulent activities in an organized manner, and can even completely control the public opinion of a product, thereby misleading the buyer’s purchase decision, causing distortion of the e-commerce reputation system, and affecting the seller’s status in the e-commerce platform. Fair competition between the two countries, reducing the credibility of the trading environment, and ultimately affect the sustainable development of e-commerce companies and even the entire industry. Therefore, the excavation and discovery of naval groups is of great significance.

Since Jindal and Liu first proposed the problem of detecting false reviews (false reviewers), more and more researchers have begun to pay attention to the problem and have done a lot of related research, including algorithms based on machine learning, algorithms based on probability, and based on behavior. Feature-based algorithms, graph-based algorithms and rule-based algorithms. In recent years, the detection problem of the navy group has attracted more and more attention.

The existing naval group detection algorithms can be divided into algorithms based on frequent item mining (FIM) and algorithms based on topological graphs. The algorithm based on FIM assumes that members of the same navy group tend to jointly write false reviews for the same product or service, the so-called co-review. They use Frequent Item Mining (FIM) to generate candidate navy groups, and then build a model to rank the suspiciousness of the groups to find the real navy groups. However, co-review does not necessarily mean joint fraud (that is, multiple people work together to conduct fraudulent activities on the same target product). As the performance of the recommendation system improves, many consumers may purchase the same products or use the same services. In other words, the total comment is not reliable enough, and it is easy to misjudge a normal commenter as a navy.

Moreover, based on the algorithm of frequent item mining (FIM), reviewers who have reviewed the same product together are regarded as a candidate group. The intensity of frequent item mining affects the reliability of FIM. If the intensity of the setting is too high (for example, if the number of products reviewed is greater than 5), a very close group will be generated, and the number of groups mined will be greatly reduced. On the contrary, if the intensity is too low, the obtained candidate group will contain many normal commenters, and these algorithms do not consider filtering the normal commenters in the candidate group.

Algorithms based on topological graphs model the relationship between reviewers (undirected graphs were used in early research, and directed weighted graphs are often used now), and group them according to graph partitioning algorithms or community partitioning algorithms Group. Generally speaking, algorithms based on topological graphs first construct a topological graph of reviewers through the relationship characteristics of the reviewers (such as co-comments), and then use graph partitioning algorithms, clustering algorithms, etc. to generate candidate navy groups. Since the reviewer relationship graph is constructed based on review data metadata, with the rapid increase of review data, the construction and processing of the reviewer relationship graph requires a high degree of time complexity and space complexity. In particular, in graph-based algorithms, candidate navy groups are usually generated by graph partitioning algorithms like min-cut. However, these groups manually divided by the graph partition algorithm may not match the actual navy group.

Summary of the invention

In order to solve the above-mentioned problems, the present invention provides a navy group detection method and device. The method and device can not only improve the detection efficiency, but also can better filter out real (or innocent) commenters, thereby improving Accurately locate the navy group.

In order to achieve the above objective, a naval group detection method is provided. The detection method includes: obtaining review data information in the network, the review data information including: review products, reviewers, review time, and reviewers’ comments on the review products The score; based on the review data information to identify the target product attacked by the navy group; based on the identified target product to generate a candidate navy group.

Further, identifying the target product attacked by the navy group based on the review data information includes: calculating the product score distribution abnormal value and the product average score distribution abnormal value based on the review product's rating by the reviewer; and passing the product Score distribution abnormal value and product average score distribution abnormal value Calculate the suspicious value of the target product attacked by the navy group, compare the suspicious value with the set threshold of the suspicious value of the target product, and identify the navy based on the comparison result Target product attacked by the group

Further, the generating a candidate navy group based on the identified target product includes: using a nuclear density estimation method to obtain a review outbreak area of the identified target product, where the review outbreak area is a part of the identified target product An area where comments surge in a short period of time; obtain commenters in the comment outbreak area to generate candidate navy groups.

Further, the detection method further includes: calculating a group fraud value of the candidate navy group, comparing the group size of the candidate navy group with a set value, and falsifying the group The value is compared with the set threshold value of the naval group fraud index, and the candidate naval group is output according to the comparison result, wherein the group fraud value is used to measure the degree of fraud of the navy group, and the group size is used Yu represents the number of commenters in the navy group.

Further, in calculating the group fraud value of the candidate navy group, the group size of the candidate navy group is compared with a set value, and the group fraud value is compared with the set water. Before outputting the candidate navy group according to the comparison result, the detection method further includes: calculating the individual false value of each commenter of each candidate navy group, and comparing the The individual fraud value is compared with the set threshold value of the individual fraud index of the navy, and the commenters with low suspiciousness are eliminated according to the comparison result to obtain a purified candidate group, wherein the individual fraud value is used to measure the degree of fraud by the commenter .

Further, the suspicious value STP(p) of the target product attacked by the navy group is calculated by the following formula:

S _TP (p)=ωS _avg (p)+(1-ω)S _ext (p)

Among them, p represents the target product attacked by the navy group, Savg(p) is the abnormal value of the average score distribution of the product, Sex(p) is the abnormal value of the product score distribution, and ω is used to balance the Savg(p) And Sext(p) weighting factor, the value range is between 0 and 1.

Further, using the kernel density estimation method to obtain the comment outbreak area of the identified target product includes: calculating the life cycle of the identified target product; using the kernel density estimation method to evaluate the comments of the identified target product and the corresponding comments Model the time series of comments; set the size of the time window, and divide the life cycle of the identified target product into multiple sub-time windows; select the upper bound of each sub-time window and the number of comments in the sub-time window as sample points ;according to

Calculate the kernel density estimate to obtain the extreme point set of the number of reviews for the identified target product; calculate the average number of reviews for each sub-time window, where the average number of reviews = total number of reviews/the sub-time window And determine whether the number of comments in the sub-time window where the extreme point in the obtained extreme point set is greater than the average number of comments and greater than 1, and obtain the comment outbreak area according to the determination result, wherein the comment outbreak area It is the area formed by adding or subtracting the set number of days to the time corresponding to the extreme points that are greater than the average number of comments and greater than 1 in the obtained extreme points.

Further, the group fraud value GSS(g) is obtained by the following formula:

Among them, g represents the group formed by reviewers, GTW(g) is the group time window, GRD(g) is the group score deviation, GS(g) is the group size, and GRT(g) is the group Group comment closeness, GOR(g) is the number of group comments in a day, GER(g) is the extreme score ratio of the group, GCA(g) is the co-active degree of the group, GCAR(g) is the group’s total active period of comments accounted for Compare,

The GTW(g) is used to measure the activity level of the group;

The GRD(g) is used to reflect the degree to which the score of the group deviates from the average score of the target product;

The GRT(g) is used to measure how closely group members collaborate to write false comments;

The GOR(g) is used to reflect the number of comments posted by a group in a day;

The GER(g) represents the average value of extreme score ratios of group members;

The GCA(g) is used to indicate the degree to which group members are active together in a certain period of time;

The GCAR(g) is used to indicate the proportion of the group's total comments published by the group during the common active period for the comments on the target product.

Further, the individual fraud value ISS(a) is obtained by the following formula:

Among them, a represents the reviewer, EXR(a) is the extreme rating ratio, RD(a) is the rating deviation; MRO(a) is the maximum number of comments in a day, RTI(a) is the comment interval, and AD(a) is the account survival Period, ATR(a) is the proportion of comments in the active period,

The EXR(a) represents the ratio of the number of extreme ratings to the total number of reviews by the reviewer;

The RD(a) reflects the degree to which the reviewer’s rating deviates from the overall product rating;

The MRO(a) reflects the maximum number of comments posted by a commenter in a single day;

The RTI(a) is used to indicate the length of the time interval for a commenter to post comments;

The AD(a) is used to indicate the time interval between the first and last comments posted by the commenter;

The ATR(a) is used to measure the relationship between the number of reviews during the active period of the reviewer and the total number of reviews.

According to another aspect of the present application, there is provided a navy group detection device, the detection device comprising: a data information acquisition module, the data information acquisition module acquires comment data information in the network, the comment data information includes: The review product, the reviewer, the review time, and the reviewer’s rating of the review product; an abnormal value calculation module, which calculates the product score distribution abnormal value and the product average score distribution abnormality based on the reviewer’s rating of the review product Value; target product identification module, the target product identification module calculates the suspicious value of the target product attacked by the navy group through the product score distribution abnormal value and the product average score distribution abnormal value, and combines the suspicious value with the design The threshold value of the suspicious value of the target product is compared, and the target product attacked by the navy group is identified according to the comparison result; and a candidate navy group generation module, which is based on the identified target product Generate candidate navy groups.

According to another aspect of the present application, there is provided a computer device, including a memory and a processor, the memory stores a computer program that can run on the processor, and the processor implements the above-mentioned water force when the computer program is executed. Steps of the group detection method.

According to another aspect of the present application, there is provided a computer-readable storage medium on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned naval group detection method are realized.

The navy group detection method of the present application detects the navy group attacking the target product by locating the target product attacked by the navy group, which can greatly improve the time and space efficiency of detecting the navy group.

Description of the drawings

The drawings of the specification constituting a part of the present application are used to provide a further understanding of the present invention. The exemplary embodiments of the present invention and the description thereof are used to explain the present invention, and do not constitute an improper limitation of the present invention. In the attached picture:

Figure 1 shows a flow chart of the navy group detection method according to the present application;

Figure 2 shows a schematic diagram of a commentary outbreak according to this application;

FIG. 3 shows a flow chart of obtaining a comment outbreak area of an identified target product by using a kernel density estimation method according to an embodiment of the present application;

Fig. 4 shows a flowchart of a method for detecting a navy group according to a preferred embodiment of the present application;

Figures 5a to 5f show comparison diagrams of CDF curves of individual fraud indicators of the first 500 navy groups respectively generated by GSBC and GSDB according to this application;

6a to 6i show the CDF curve of the first 500 navy group fraud behavior indicators generated by GSBC and the GSDB according to the application, and the comparison diagrams of the average curve of all the group indicators;

Fig. 7 shows the size comparison diagram of the first 500 groups respectively generated by GSBC and GSDB according to this application;

Figures 8a to 8c show comparison diagrams of GSBC and GSDB according to the present application on the first n groups.

FIG. 9 shows a schematic diagram of the structure of the navy group detection device according to the present application.

Detailed ways

In order to make the purpose, technical solutions, and advantages of this application clearer and clearer, the following further describes the application in detail with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application, and are not used to limit the present application.

According to the present application, there is provided a navy group detection method. The detection method includes: obtaining review data information in the network, the review data information including: review products, reviewers, review time, and reviewers’ comments on review products Score; identify the target product attacked by the navy group based on the review data information; generate a candidate navy group based on the identified target product.

According to the navy group detection method of the present application, the navy group that attacks each target product is detected by locating the target product attacked by the navy group, which can greatly improve the time and space efficiency of detecting the navy group.

In the process of mining and discovering naval groups, a series of effective indicators (or characteristics) are needed to evaluate the suspiciousness of individuals and groups. Therefore, on the basis of big data analysis, this application uses the following data characteristics as indicators for evaluating the suspiciousness of individual naval forces and naval groups.

The following is a detailed introduction to individual fraud behavior indicators and group fraud behavior indicators.

In this application, the extreme rating ratio (EXR), rating deviation (RD), maximum number of comments per day (MRO), comment interval (RTI), account life cycle (AD), and active period comment percentage (ATR) are used to reflect individuals Counterfeit behavior indicators.

The extreme rating ratio (EXR) reflects the ratio of the number of extreme ratings to the total number of reviewers' ratings. The higher the EXR, the more suspicious. On the five-star scale, the calculation formula of EXR(a) is as follows:

Wherein, R _a is a reviewer ratings set, r _a is the set of elements of R _a.

Rating deviation (RD) reflects the extent to which the reviewer's rating deviates from the overall product rating. The overall rating of the reviewer can reflect the basic situation of a product. The higher the RD, the more suspicious. The calculation formula of RD(a) is as follows:

Among them, r _ap is the rating of product p by reviewer a,

Is the average rating of product p. This application is normalized by dividing by 4, that is, using the largest scoring deviation under the five-point system.

The maximum number of comments per day (MRO) reflects the maximum number of comments posted by a commenter in a single day, and normalizes it to the maximum value among all commenters. The higher the MRO, the more suspicious. The calculation formula of MRO(a) is as follows:

Among them, MaxRev(a) is the maximum number of comments made by commenter a in one day, and A is the set of commenters.

The comment interval (RTI) is used to indicate the length of the time interval for a commenter to post comments, which reflects the activity level of a commenter. The higher the RTI, the more suspicious. The calculation formula of RTI(a) is as follows:

Among them, T ^a is the review time series of reviewer a,

Is T ^a of the l th element, [rho] is the time interval (also referred to as a time window) of threshold value of the threshold value the time interval may be selected according to the amount of data, the amount of data, you can select a relatively small value, the data If the amount is small, a relatively large value can be selected.

The account life cycle (AD) is used to indicate the time interval between the first and the last comment posted by the commenter. The higher the AD, the more suspicious. The calculation formula of AD(a) is as follows:

in,

with

They are the time when commenter a posted the first and last comment, and t _data is the time span of the entire data set.

The percentage of comments in the active period (ATR) is used to measure the relationship between the number of comments in the active period of the reviewer and the total number of comments. According to the law of the development of things, real commentators publish comments by demand, so the release time and quantity are very random, while the time and quantity released by the navy have an active period, that is, a large number of fake comments are usually posted in a short period of time. The larger the ATR, the more suspicious. The calculation formula of ATR(a) is as follows:

ActiveTimePeriod (a) represented by a comment in the comments posted on the active collection, R _a is a reviewer for the publication of a collection of all reviews of all products.

In addition, according to this application, the average value of the above 6 indicators is set as the individual fraud value (ISS) to measure the degree of fraud by the reviewer, and the calculation formula is as follows:

In this application, the group time window (GTW), group rating deviation (GRD), group size (GS), group comment tightness (GRT), number of group comments per day (GOR), and group extreme rating ratio are adopted in this application (GER), Group Co-active (GCA), Group Co-active Comment Percentage (GCAR) to reflect group fraud behavior indicators.

The time window (TW) is usually used to measure the activity of the navy group. In this application, a group time window (GTW) is set to measure the activity of the navy group. This indicator was first proposed by Mukherjee et al., which considers the interval between the time of the first comment and the time of the last comment. In contrast, Wang et al. used the standard deviation of group members' comment time to measure the distribution of the group's overall comment time.

This application sets a threshold for a time window, and considers the time window below the threshold as an active window, and then calculates the activity of the active window. The higher the GTW, the more suspicious. The calculation formula is as follows:

SD ^g _p is the standard deviation of the time when members of group g comment on product p. The standard deviation is calculated according to the standard standard deviation calculation formula. It is used to observe whether group members’ comment time on a target product is concentrated. If When the comment time is concentrated, the data distribution is concentrated, and the corresponding standard deviation is small, which is more suspicious.

T is a user-defined time window threshold, which is used to evaluate whether the comment time of a group is concentrated. Generally, the threshold is set to be larger, such as 30 days. The ρ in the individual fraud behavior index is set for the comment interval of an individual reviewer, and the threshold is generally set to be relatively small, such as 7 days. Of course, ρ in the individual fraud behavior index and T in the group fraud behavior index can be set according to actual needs.

p ∈ _{P g} , P _g is the target product set of group g, and refers to the set of products that have been reviewed by at least half of the members of group g.

Group Rating Deviation (GRD) is used to reflect the degree to which the group's rating deviates from the average rating of the target product. The higher the GRD, the more suspicious. The calculation formula of GRD(g) is as follows:

r _ap is the rating of product p by user a in group g,

Is the average score of product p, p∈P _g , P _g is the target product set of group g, which refers to the set of products that have been reviewed by at least half of the members of group g. RD _p (g) calculates the scoring deviation of group g to target product p. It should be noted that this application is normalized by dividing by 4, which is the maximum scoring deviation under the five-point scoring system. GRD(g) is the average value of group g's score deviations for all target products.

The group size (GS) represents the number of commenters in the navy group and is used to reflect the size of the group. The larger the size of a group, the more suspicious and harmful the group. This is because small groups are often formed by accident, and large groups are generally formed under certain goals. The calculation formula of GS(g) is as follows:

Among them, Rg represents the set of members in group g, and |Rg| represents the number of members in group g.

Group Comment Tightness (GRT) is used to measure how closely group members collaborate to write false comments. Among them, GRT(g) is calculated as follows:

Among them, Vg refers to a group of comments on the target product commented on the group.

Group comments per day (GOR) focuses on the number of comments posted by a group in a day. If group members often post many comments in one day, the group is very suspicious. Mukherje and others estimate that the navy usually publishes at least 6 comments a day, while normal commenters usually only publish 1-2 comments.

In this application, the number of days when the number of comments posted by group members exceeds 5 is calculated, and then the average value of group members is taken as the number of group comments per day. The calculation formula of GOR(g) is as follows:

T ^a set of all the group members review date of a, t ^a T ^a is an element, CountRev (t ^a) represents the number of group members comment on a t ^a release date. .

The group extreme score ratio (GER) is defined as the average of the extreme score ratios of group members. The calculation formula is as follows:

R _a is a group member of the set of comments, r _a is the element of R _a.

Group members posting comments together in a short period of time can be considered a suspicious co-active fraud activity. Group Co-Activity (GCA) is used to indicate the number or degree of group members being active together in a time, and is normalized by the logistic function. The calculation formula of GCA(g) is as follows:

CA _g is a co-active time set that satisfies all members of the group to post comments together in δ days, where δ is a set threshold, such as the group being active together for 5 consecutive days. |CA _g | is the number of time periods during which the group g is active, and the unit is day.

The percentage of group comments in total active period (GCAR) is used to indicate the percentage of the group's total comments published during the active period for the target product. The group has a large co-active ratio, and a large number of comments were posted during the co-active period, revealing a suspicious fraudulent behavior. The higher the GCAR, the more suspicious the group. The calculation formula of GCAR(g) is as follows:

Represents the collection of comments posted by the group g during the total active time.

In this application, the average value of the above 8 indicators is used as the group fraud value (GSS) to measure the degree of group fraud. The calculation formula is as follows:

According to this application, the above-mentioned data characteristics are selected as the suspiciousness index for evaluating the navy individual and navy group, so as to confirm the candidate navy group based on the obtained suspiciousness index.

The method of detecting a navy or navy group based on the above-mentioned indicator characteristics will be described in detail below.

This application discovers the candidate navy group from the perspective of products, that is, first obtains the target product attacked by the navy, and then discovers the candidate navy group based on the target product.

Fig. 1 shows a flowchart of a method for detecting a navy group according to the present application.

As shown in Figure 1, the navy group detection method includes:

S101: Obtain review data information in the network, where the review data information includes: review product, reviewer, review time, and reviewer's rating on the review product;

S102: Identify the target product attacked by the navy group based on the review data information;

Whether a product is attacked by the navy can be reflected by the product's abnormal score distribution, such as the product's average normal score, abnormal average score, normal all scores, and abnormal all scores. This application combines abnormal product score distribution and abnormal product average score distribution to calculate the abnormal value of the target product to detect the target product.

Specifically, according to a preferred embodiment of the present application, the identification of the target product attacked by the navy group based on the review data information can be achieved in the following ways:

S1021: Calculate the outlier value of the product score distribution and the outlier value of the product average score based on the reviewer's score on the reviewed product; and

S1022: Calculate the suspicious value of the target product attacked by the navy group based on the calculated product score distribution abnormal value and the product average score distribution abnormal value, and compare the suspicious value with the set threshold of the target product suspicious value , And then, according to the comparison result to identify the target product attacked by the navy group.

It is known that the target product attacked by the navy has an abnormality in the distribution of extreme scores (1, 5). In this application, the product score distribution outlier Sext(p) is calculated from the ratio of the extreme scores of each product :

r _p is the score of product p, the _{higher S ext} (p), the more likely product p is to be attacked.

Moreover, most of the navy accounts are used only once, that is, one-time commenters. In this application, the average product score distribution outlier Savg(p) is obtained by calculating the ratio of the average score of reviews posted by general reviewers (TR) to the average score of reviews posted by one-time reviewers (SR). The formula for calculating the average score distribution outlier Savg(p) of the product is as follows:

It is the average score of the one-time reviewer group SR on the release score of product p,

It is the average score of the general reviewer group TR on the release score of product p.

Through the above formulas (17) and (18), the outlier value of product score distribution and the outlier value of product average score distribution can be obtained.

According to this application, the suspicious value of a product can be calculated by combining the abnormal value of the product score distribution and the abnormal value of the product average score distribution to quantify the degree of suspiciousness of a product as a target product. According to a preferred embodiment of the present application, the suspicious value STP(p) of the target product attacked by the navy group can be calculated by the following formula:

S _TP (p)=ωS _avg (p)+(1-ω)S _ext (p) (19)

Among them, p represents the target product attacked by the navy group, Savg(p) is the abnormal value of the average product score distribution, Sext(p) is the abnormal value of the product score distribution, and ω is used to balance Savg(p) and Sext(p). ) Weighting factor, with a value range between 0 and 1, preferably, ω is 0.5.

According to this application, for a product, the suspicious value STP(p) of the target product attacked by the navy group is calculated, and the suspicious value is compared with the set threshold δ _TP of the target product suspicious value. If the calculated target product If the suspicious value STP(p) of is greater than or equal to the threshold δ _TP , the product is considered to be the target product of the navy group attack. Among them, the set threshold δ _TP of the suspicious value of the target product is obtained through experiments with the difference method, and the lowest value with a good effect is taken. Of course, you can also take a higher value for better results.

S103: Generate a candidate navy group based on the identified target product.

According to a preferred embodiment of the present application, the navy group detection method uses a nuclear density estimation method to generate a candidate navy group. Specifically, the kernel density estimation method is used to obtain the comment outbreak area of the identified target product, and the candidate navy group is generated by obtaining reviewers in the comment outbreak area, where the comment outbreak area is the identified target product Areas where comments have surged in a short period of time.

The sudden increase in reviews of a product in a short period of time is called a review burst. Figure 2 schematically shows an example of a comment burst. The abscissa is the normalization of the time span, and the ordinate is the number of comments. The cycle of comment burst occurs between 0.5-0.6.

Assuming that the comment explosion indicates the fraudulent activities of the navy group, in order to obtain the information of the candidate navy group, the comment explosion area can be obtained first. This application uses the kernel density estimation method (KDE) to obtain the comment explosion area. Specifically, as shown in FIG. 3, it shows a flowchart for obtaining a comment outbreak area.

As shown in Figure 3, using the kernel density estimation method to obtain the identified target product review outbreak area mainly includes:

S201: Calculate the life cycle of the identified target product (see the first row in the following algorithm).

Assuming that the product has a total of m comments, the time of the first comment is t ₁ , the time of the last comment is t _m , and the time interval between the first comment and the last comment is the life cycle dur of the product, then dur=tm- t1.

S202: Use the kernel density estimation method to model the identified reviews of the target product and the review time series corresponding to the reviews (see lines 2-3 in the following algorithm).

In this step, the review sequence of product p and the review time sequence corresponding to the review set of product p are set.

S203: Set the size of the time window, and divide the identified life cycle of the target product into multiple sub-time windows (see row 4 in the following algorithm).

In this application, an appropriate time window size ISIZE is selected to divide the life cycle dur of a product into small time windows (ie, sub-time windows), then the number of sub-time windows k = dur/ISIZE. According to a preferred embodiment of the present application, ISIZE can be set to 7 days.

S204: Select the upper bound of each sub-time window and the number of comments in the sub-time window as sample points (see lines 5-9 in the following algorithm).

S205: According to

Calculate the kernel density estimate, and obtain the extreme point set of the number of reviews for the identified target product (see lines 10-11 in the following algorithm).

In the formula, use Gaussian kernel

And use h to control the smoothness of the estimate. The specific value of h is selected through experiments to select the most suitable value, so that the estimated curve is neither too smooth nor jagged. Take the derivative of KDE(x) and make its derivative zero to calculate a series of extreme points of the estimated curve. These extreme points correspond to the number of reviews of the identified target product. Obtain the extreme point set of the number of reviews for the identified target product in the above manner.

S206: Calculate the average number of comments in each sub-time window, where the average number of comments=the total number of comments/the number of the sub-time windows (see line 12 in the following algorithm).

The average number of comments avgrev=m/k, where m is the total number of comments, and k is the number of the aforementioned sub-time windows.

S207: Determine whether the number of comments in the sub-time window where the extreme point in the obtained extreme point set is located is greater than the average number of comments and greater than 1, and obtain the comment outbreak area according to the determination result, wherein the comment outbreak area is Obtain the area formed by adding or subtracting the set number of days to the time corresponding to the extreme points in the set of extreme points greater than the average number of comments and greater than 1 (see lines 13-19 in the following algorithm).

The goal of this application is to discover the comment outbreak area, that is, the area where the reviews of the target product surge in a short period of time, so this application does not consider those extreme points that fall in the number of reviews less than or equal to the average number of reviews, nor does it consider those reviews. The extreme points of the window less than or equal to 1, that is, only the extreme points with the number of reviews greater than the overall average number of reviews and greater than one are considered.

After obtaining the extremum points, according to this application, select the area formed by adding or subtracting the set number of days corresponding to the above-mentioned filtered extremum points as the comment outbreak area, such as selecting the above-mentioned extremum after screening Three days before and after the time corresponding to the point, that is, a total of 7 days as the comment outbreak area.

After that, the candidate navy group is generated by obtaining commenters in the comment outbreak area.

Through the above method, the candidate navy group for attacking the target product can be obtained.

Among them, the above-mentioned use of the kernel density estimation method to generate candidate navy groups can be implemented by the following algorithm:

1. Calculate the life cycle of product p dur=t _m -t ₁

2. Let Vp={v1,v2,……,vm};

3. Let Tp={t1,t2,……,tm};

4. Set the appropriate window size ISIZE, and divide dur into k windows

5. For window i∈{1,……,k}do

6. Let R _i ={v _j |t _j ∈(b _i-1 ,b _i ]}, where b _i ＝i·ISIZE

7. Let b _i = b _i /dur

8. Let x _i = b _i , w _i = |R _i |

9.end for

10. Calculation

in

11. Calculate the derivative of KDE(x), set it to 0, and get all extreme point sets

12. Calculate the average number of comments for each window avg _rev = m/k

13.for

in x _peak do

14.if

Fall in the window i then

15.if|H _i |≠1and|H _i |＞avg _rev then

16. Let t _{peak be} equal to

17. Output the commenters in the time interval {t _peak -3, t _peak +3} as the candidate navy group

18.end if

19.end for

According to a preferred embodiment of the present application, the navy group detection method can use a series of group fraud indicators to measure the suspiciousness of the group, eliminate groups with low suspiciousness, and obtain a purified candidate navy group.

Specifically, the navy group detection method further includes: S105: calculating the group fraud value GSS(g) of the candidate navy group obtained in step S103, and comparing the group size of the candidate navy group with the set value , And compare the group fraud value with the set threshold value of the Navy group fraud index, and output the candidate Navy group according to the comparison result.

In this application, if the group size GS of the candidate navy group is greater than or equal to the set value (for example, the set value is 2), and the group fraud value is greater than the set threshold GSS of the naval group fraud index, then Output the corresponding candidate navy group. Among them, the threshold value of the false index of the navy group is obtained through experiments with the difference method. According to this application, the lowest value with good effect is taken, of course, a higher value with good effect can also be taken.

In order to obtain a more accurate navy group and prevent misjudgment problems caused by normal reviewers who may happen to comment on the target product during a comment outbreak, according to a preferred embodiment of the present application, before step S105 is performed, the navy group The group detection method can also use a series of individual fraud indicators to measure the suspiciousness of individual reviewers, so as to eliminate individual reviewers with low suspiciousness.

Specifically, before step S105, the navy group detection method may further include: S104: Calculate the individual fraud value ISS(a) of each reviewer of each candidate navy group, and compare the individual fraud value with the setting The set threshold ISS of the individual fraud indicators of the navy is compared, and the commenters with low suspiciousness are eliminated according to the comparison result, and the candidate group after purification is obtained.

In this application, if the individual fraud value is less than the threshold value of the individual fraud indicator of the navy, the corresponding commenter is eliminated, so as to obtain a purified candidate group. Among them, the threshold value of the individual fraud index is obtained through experiments with the difference method. According to the present application, the lowest value with good effect is taken, of course, a higher value with good effect can also be taken.

Through the above steps S104 and S105, the obtained candidate navy group can be purified and classified, so as to obtain a more accurate navy group.

The following experiments are used to illustrate the advantages of the burst-based spammer group detection method (GSDB, burst-based spammer group detection method) of this application.

According to this application, using the Amazon review data set (without tags), AmazonBooks review data from 1993 to 2014 includes 22,507,155 reviews, 8,026,324 reviewers and 2,330,066 products. Due to the large amount of data, this application only extracts 2013 review data, which includes 6,990,316 reviews, 2,998,38 reviewers, and 1,079,741 products. The statistical data of the processed data set is shown in Table 1 (data set overview list).

Table 1 Overview of the data set

Dataset	Original Amazon Books Dataset	2013 data
#Comment	22,507,155	6,990,316
#Comment by	8,026,324	2,998,380
#product	2,330,066	1,079,741

The problem of navy group detection is very challenging because there is no labeled standard data set (marked as false/real) that can be used for model building or evaluation. Previous research mainly relied on manual labeling to obtain labels. Mukherjee et al. and Xu et al. first used FIM (Frequent Itemset Mining) algorithm to obtain candidate navy groups, and then manually labeled them by 8 experts. Wang et al. used an algorithm based on topological graphs to generate candidate navy groups, which were manually annotated by three individuals.

The navy group detection method according to this application is a completely unsupervised algorithm and does not require any tags in model construction. However, the label is essential for evaluating its performance. Since the group fraud behavior of the navy group is easier to be observed manually, manually marking the navy group is more maneuverable than marking the navy individual. Therefore, in this application, three graduate students who are very familiar with the e-commerce environment are hired to manually label the top 300 navy groups detected by the GSDB and GSBC (Group Spam detection via Bi-Connected graphs) methods. Under the guidance of the method previously marked as a navy group, coupled with the application’s own observations, this application strives to minimize human bias in the evaluation process.

Based on the 2013 Amazon data set (detailed information is listed in the third column of Table 1), this application designs a set of experiments and three analyses. First, compare and analyze the performance of the algorithm in the counterfeiting index; second, compare and analyze the performance of the algorithm in the size of the generated navy group; finally, combine the results of manual labeling to compare and analyze the accuracy, recall and F1 value of the algorithm Performance.

In the experiment and analysis, the GSBC algorithm is used as a benchmark to compare with the GSDB algorithm of this application. The GSBC method is the latest proposed algorithm for naval group detection based on topological graphs. It also uses the Amazonbooks data set for experiments. In particular, when Wang et al. proposed the GSBC algorithm, the algorithm has been compared with some previous typical algorithms, GSBP , SCAN, FraudEagle and SpEagle were compared. The GSBP and SCAN algorithms are unsupervised, while the FraudEagle and SpEagle algorithms are supervised. Both the GSBP algorithm and the GSBC algorithm are proposed by Wang et al. The latter is an improved algorithm of the former. SCAN is a graph-based clustering algorithm. FraudEagle and SpEagle algorithms are algorithms based on probabilistic graph models that use circular belief propagation (LBP) to infer the degree of falsehood of reviews (commenters). The experimental results of Wang et al. show that the GSBC method can produce higher quality navy groups than the other two unsupervised methods (GSBP and SCAN). Compared with the supervised algorithms (FraudEagle and SpEagle), the GSBC method also achieves higher accuracy, and the GSBC algorithm has achieved better results in comparison. Therefore, this application only needs to compare the GSDB and GSBC methods.

Mukherjee et al. first proposed that the performance of the algorithm is evaluated by comparing the cumulative distribution function (CDF) curve of the fraud behavior index, which has also been widely used in the prior art. Similarly, this application also uses the CDF curve for comparison to analyze the performance of the algorithm. In addition, thanks to manual labeling, this application can use Precision, Recall, and F1 as the evaluation criteria for algorithm evaluation. The relevant formulas are as follows.

Among them, TP (True Cases) refers to the number of positive samples that are correctly classified as positive by the classifier, and FP (False Positive Cases) refers to the number of negative samples that are incorrectly marked as positive by the classifier. And FN (false negative) refers to the number of positive samples that are falsely marked as negative.

In this application, the CDF curves of the garbage fraud behavior indicators of the navy group detected by the GSDB and GSBC methods are compared. First of all, this application uses the GSBC algorithm to generate 500+ groups on the data set of this application according to the parameter settings of Wang et al. The specific parameter settings and the number of groups generated are shown in the table. τ is a user-specified value of the time window for co-review; δ is the threshold of the edge weight of the reviewer graph. MP is a user-specified parameter, and MINSPAM is the threshold for group fraud scores.

For the sake of fairness, this application adjusts the algorithm parameters of the GSDB to generate a number of navy groups equivalent to the GSBC algorithm. The specific parameter settings and the number of groups generated are shown in the table. It can be seen from the table that the GSBC and GSDB algorithms produced 545 and 555 groups respectively. This application extracts the first 500 groups of the GSBC and GSDB algorithms, and draws the CDF curves of the individual fraud indicators of the Navy and the group fraud indicators defined in this application for comparison, as shown in Figures 5a to 5f and Figures 6a to 6f. Show.

Table 2 GSBC parameter settings and the number of groups generated

τ	δ	MP	MINSPAM	#Groups
30	0.1	1000	0.49	545

Table 3 GSDB parameter settings and the number of groups generated

δ TP	δ I	δ G	#groups
0.1	0.43	0.54	555

Figures 5a to 5f show comparison diagrams of the CDF curves of individual fraud indicators of the first 500 navy groups respectively generated by GSBC and the GSDB according to the application; A comparison chart of the CDF curve and the average value (AVG) curve of all the group indicators generated by the GSDB of the first 500 navy groups. The horizontal axis represents the normalization of the number of groups, and the vertical axis represents the CDF value. The closer the curve is to the right, the better the performance of the algorithm. It can be seen from Figure 5a to Figure 5f that the GSDB method achieves higher scores than GSBC on most indicators.

In Fig. 6a to Fig. 6f, the GSDB method also achieved higher scores than GSBC in most indicators. In the average (AVG) curve, GSDB has always been better than GSBC. The under-performing EXR and GER indicators in this application are indicators of extreme scores. In the GSBC algorithm, user scores are screened. Therefore, on these two indicators, the GSBC algorithm has achieved higher scores. Overall, GSDB performed better.

In this application, the group size generated by GSDB and GSBC is statistically analyzed (see Figure 7). It can be seen from Figure 7 that most of the groups generated by the GSBC algorithm are small groups (2-4 members). Compared with the GSBC algorithm, GSDB can generate more groups with larger sizes. As mentioned earlier, the larger the group size, the greater the harm. The GSDB algorithm can detect more and larger groups, which is undoubtedly more effective in reducing the harm of navy groups.

Based on the manual detection of the GSDB and GSBC methods to detect the labels of the first 300 groups, this application compares the accuracy of the GSDB method and the GSBC method. Figures 8a to 8c show the accuracy, recall, and continuous changes of the F1-value of the two algorithms on top-n groups.

It can be seen from Figure 8a that the accuracy of the GSDB algorithm has always been better than that of the GSBC algorithm. And, with the increase of n, the accuracy value of the GSDB method decreases slowly, while the accuracy value of the GSBC method drops sharply, and then rises again. In other words, the accuracy of the GSDB method of this application does not depend on the number of samples, while the accuracy of the GSBC method largely depends on the number of samples.

It can be seen from Figure 8b that GSDB is still better than GSBC method overall, but the gap is not big. In addition, the recall curve increases linearly with the increase of n.

It can be seen from Fig. 8c that the GSDB method of the present application is always better than the GSBC method in F1 value. In addition, when considering enough samples, both algorithms tend to be stable.

The above experimental results show that the GSDB method proposed in this application is better than the GSBC method.

According to another aspect of the present application, there is provided a navy group detection device. As shown in FIG. 9, the device includes: a data information acquisition module 100, and the data information acquisition module The review data information includes: review product, reviewer, review time, and reviewer’s rating of the review product; outlier calculation module 200, which calculates the product rating distribution abnormal value based on the reviewer’s rating of the review product And the product average score distribution abnormal value; the target product identification module 300, the target product identification module calculates the suspicious value of the target product attacked by the navy group through the product score distribution abnormal value and the product average score distribution abnormal value, and The suspicious value is compared with the set threshold of the suspicious value of the target product, and the target product attacked by the navy group is identified according to the comparison result; a candidate navy group generation module 400, the candidate navy group generation module Generate candidate navy groups based on the identified target products.

In one embodiment, a computer device is provided, including a memory and a processor. The memory stores a computer program that can run on the processor. step.

In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned navy group detection method are realized. The computer-readable storage medium according to the present application may include non-volatile and/or volatile memory, for example. For example, non-volatile memory may include read only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. As an illustration and not a limitation, RAM can have many forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), double data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link (Synchlink) DRAM (SLDRAM), memory bus (Rambus) direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

As mentioned above, the navy group detection method according to the present application starts from the product score and screens out products that may be attacked by navy groups by detecting whether the product score distribution is abnormal; and uses the nuclear density algorithm to find out the comment outbreak area, and will explode. All reviewers in the interval are regarded as candidate navy groups; in view of the misjudgment problem caused by normal reviewers who may happen to comment on the product during the review outbreak, this application uses a series of individual fraud indicators to measure the suspiciousness of individual reviewers , And exclude commenters with low suspiciousness; moreover, this application uses a series of group fraud indicators to measure the suspiciousness of the group and realize group classification. The naval group detection method according to the present application can greatly improve the time and space efficiency of detecting naval groups. Moreover, this method is consistent with the responsibilities and obligations of the electronic platform, and can supervise and manage the seller.

The above are only preferred embodiments of the present invention and are not used to limit the present invention. For those skilled in the art, the present invention can have various modifications and changes. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims (10)

1. A navy group detection method, characterized in that, the detection method includes:

   Obtain review data information in the network, where the review data information includes: review product, reviewer, review time, and reviewer's rating on the review product;

   Identify the target product attacked by the navy group based on the comment data information; and

   Generate candidate navy groups based on the identified target products.
2. The navy group detection method according to claim 1, wherein the identification of the target product attacked by the navy group based on the comment data information comprises:

   Calculate the abnormal value of the product score distribution and the abnormal value of the product average score distribution based on the score of the review product by the reviewer; and

   Calculate the suspicious value of the target product attacked by the navy group based on the abnormal value of the product score distribution and the abnormal value of the average product score distribution, and compare the suspicious value with the set threshold of the target product suspicious value, according to the comparison The result identifies the target product attacked by the navy group.
3. The navy group detection method according to claim 1 or 2, wherein said generating a navy group candidate based on the identified target product comprises:

   Obtaining the identified comment burst area of the target product by using the kernel density estimation method, where the comment burst area is an area where the identified target product reviews surge in a short period of time;

   Obtain commenters in the comment outbreak area, and generate candidate navy groups.
4. The navy group detection method according to claim 3, wherein the detection method further comprises:

   Calculate the group fraud value of the candidate navy group, compare the group size of the candidate navy group with a set value, and compare the group fraud value with the set naval group fraud The threshold values of the indicators are compared, and the candidate navy group is output according to the comparison result, wherein the group fraud value is used to measure the degree of fraud of the navy group, and the group size is used to represent the commenters in the navy group. quantity.
5. The navy group detection method according to claim 4, wherein when calculating the group fraud value of the candidate navy group, the group size and the set value of the candidate navy group are calculated. Compare, and compare the group fraud value with the set threshold value of the naval group fraud index, and before outputting the candidate naval group according to the comparison result, the detection method further includes:

   Calculate the individual fraud value of each reviewer in each candidate navy group, compare the individual fraud value with the set threshold value of the individual naval fraud indicator, and eliminate commenters with low suspiciousness based on the comparison result. The purified candidate group is obtained, wherein the individual fraud value is used to measure the degree of fraud by the reviewer.
6. The navy group detection method according to claim 2, wherein the suspicious value STP(p) of the target product attacked by the navy group is calculated by the following formula:

   S _TP (p)=ωS _avg (p)+(1-ω)S _ext (p)

   Among them, p represents the target product attacked by the navy group, Savg(p) is the abnormal value of the average score distribution of the product, Sex(p) is the abnormal value of the product score distribution, and ω is used to balance the Savg(p) And Sext(p) weighting factor, the value range is between 0 and 1.
7. The navy group detection method according to claim 4, wherein the use of the nuclear density estimation method to obtain the identified target product comment outbreak area comprises:

   Calculate the life cycle of the identified target product;

   Use the kernel density estimation method to model the identified target product reviews and the review time series corresponding to the reviews;

   Set the size of the time window and divide the life cycle of the identified target product into multiple sub-time windows;

   Select the upper bound of each sub-time window and the number of comments in the sub-time window as sample points;

   according to

   

   Calculate the kernel density estimate and obtain the extreme point set of the number of reviews for the identified target product;

   Calculate the average number of comments in each sub-time window, where the average number of comments = the total number of comments/the number of the sub-time windows;

   as well as

   It is judged whether the number of comments in the sub-time window where the extreme point in the obtained extreme point set is greater than the average number of comments and greater than 1, and the comment explosion area is obtained according to the judgment result, wherein the comment explosion area is the obtained extreme point. The value point concentration is the area formed by adding or subtracting the set number of days to the time corresponding to the extreme points that are greater than the average number of comments and greater than 1.
8. The navy group detection method according to claim 4, wherein the group fraud value GSS(g) is obtained by the following formula:

   

   Among them, g represents the group formed by reviewers, GTW(g) is the group time window, GRD(g) is the group score deviation, GS(g) is the group size, and GRT(g) is the group Group comment closeness, GOR(g) is the number of group comments in a day, GER(g) is the extreme score ratio of the group, GCA(g) is the co-active degree of the group, GCAR(g) is the group’s total active period of comments accounted for Compare,

   The GTW(g) is used to measure the activity level of the group;

   The GRD(g) is used to reflect the degree to which the score of the group deviates from the average score of the target product;

   The GRT(g) is used to measure how closely group members collaborate to write false comments;

   The GOR(g) is used to reflect the number of comments posted by a group in a day;

   The GER(g) represents the average value of extreme score ratios of group members;

   The GCA(g) is used to indicate the degree to which group members are active together in a certain period of time;

   The GCAR(g) is used to indicate the proportion of the group's total comments published by the group during the common active period for the comments on the target product.
9. The navy group detection method according to claim 5, wherein the individual fraud value ISS(a) is obtained by the following formula:

   

   Among them, a represents the reviewer, EXR(a) is the extreme rating ratio, RD(a) is the rating deviation; MRO(a) is the maximum number of comments in a day, RTI(a) is the comment interval, and AD(a) is the account survival Period, ATR(a) is the proportion of comments in the active period,

   The EXR(a) represents the ratio of the number of extreme ratings to the total number of reviews by the reviewer;

   The RD(a) reflects the degree to which the reviewer’s rating deviates from the overall product rating;

   The MRO(a) reflects the maximum number of comments posted by a commenter in a single day;

   The RTI(a) is used to indicate the length of the time interval for a commenter to post comments;

   The AD(a) is used to indicate the time interval between the first and last comments posted by the commenter;

   The ATR(a) is used to measure the relationship between the number of reviews during the active period of the reviewer and the total number of reviews.
10. A navy group detection device, characterized in that the detection device includes:

    A data information acquisition module, where the data information acquisition module acquires review data information in the network, the review data information includes: review products, reviewers, review time, and reviewers’ ratings of review products;

    An abnormal value calculation module, which calculates the abnormal value of the product score distribution and the abnormal value of the product average score distribution based on the reviewer's rating of the reviewed product;

    The target product identification module, the target product identification module calculates the suspicious value of the target product attacked by the navy group through the product score distribution abnormal value and the product average score distribution abnormal value, and compares the suspicious value with the set Compare the suspicious value threshold of the target product, and identify the target product attacked by the navy group based on the comparison result; and

    A candidate navy group generation module, which generates a candidate navy group based on the identified target product.

Images