Research On Social Network Forensic Analysis Modeling Based On Network Representation Learning

With the rapid development of network technology,more and more interpersonal communication is completed through the Internet.While people communicate with each other through wechat,e-mail and Internet phone,they also leave a lot of records on these message carriers,which hide very valuable information.How to excavate these hidden information has become an important topic in the field of social network research.In particular,when the network is a criminal group's information exchange network,the research usually could mark an important member or leader of a criminal group,which is of great significance to the case detection and the fight against crime,and attracts many scholars in the fields of public security criminal investigation?social psychology and computer forensics to study it unremittingly.In recent years,the forensic analysis of criminal social networks has achieved some success.It can accurately analyze the hierarchical structure and important members of a criminal network,but it also has obvious limitations:We can only analyze the relationship between members who are directly connected,and it is difficult to accurately measure the degree of intimacy between members with indirect relationships.Therefore,in view of the difficulty in measuring the indirect relationship among members in the field of social network forensics,this paper presents each member of the network as a node,uses the probability model of neural network language to learn the network representation of nodes(Network Representation Learning,NRL),transforms nodes into node vectors,and uses sampling and coding to make the nodes near each other.The topological information is embedded in vectors,and the rich meaning hidden by vectors is used to solve the problem of measuring the relationship between non-adjacent members and achieve richer semantic expression.Meanwhile,this paper proposes a new analysis and forensics tool to find the "criminal leaders" of criminal groups based on vector theory:Vector Forensic Analysis Model(VFAM)?The main work and innovations are as follows.:(1)Using network representation to represent the learning vector overcomes the difficulty of measuring the relationship between non-adjacent nodes.In this paper,we use the rich semantic information of vector representation to measure the relationship between nodes.Several typical neural language probabilistic model architectures are studied in depth.Node2 vec method with better vectorization effect is selected to preprocess node data into vectors.Data preprocessing into vectors has two advantages:First,in the process of vectorization,node2 vec will produce different vector values according to the degree of intimacy with other nodes.The farther the relationship between two nodes is,the larger the vector distance value will be.On the other hand,the smaller the vector distance value will be.Therefore,the vector distance can be directly used to characterize the relationship between non-adjacent nodes.Second,node vectors have good mathematic computational ability and are convenient for subsequent modeling and calculation.(2)The gradient updating process of network representation learning algorithm node2 vec algorithm is improved.When node2 vec trains node vectors,Huffman tree is constructed for non-leaf nodes according to the principle of equality,and vector superposition and input layer are used.However,when node2 vec updates the gradient using Huffman tree,the final gradient rise value does not contribute equally to each non-leaf node,which may make the update value of leaf node inaccurate,and the updating process does not conform to the input layer construction logic.The VFAM model improves this problem by making the gradient value of each iteration contribute to all non-leaf nodes on average,so that the algorithm is more accurate and conforms to the algorithm construction logic.(3)A new algorithm for finding important members of criminal gangs based on node vectors is proposed.This paper presents the hierarchical structure and mathematical formula of VFAM,a social network forensic analysis tool based on node vectors.VFAM divides the social network for forensic analysis into three layers,through clustering algorithm and weight calculation,it finds the important members of each layer and assigns them different weights.The higher the weight,the more important the member node is.By calculating the vector distance and weight expectation of the important members and other nodes,it finally finds the leading members of the whole network.For a criminal social network made up of criminals,this result often represents the leader of the criminal gang or the big Boss.(4)Evaluating the accuracy of the forensic scheme proposed in this paper by experiments.This paper chooses Enron's e-mail as the experimental data set,uses VFAM to analyze the e-mail data to find the leaders of Enron criminal groups,and compares the results with the classical forensic analysis tools CrimeNet Explorer and LogAnalysis.The experimental results show that VFAM has better forensic analysis ability in finding leaders of criminal groups,and has advantages in many accuracy indicators.