Identification of cyberbullying by neural network methods / Идентификация кибербуллинга нейросетевыми методами

Плешакова Екатерина Сергеевна ORCID: 0000-0002-8806-1478 кандидат технических наук доцент, кафедра Информационной безопасности, Финансовый университет при Правительстве Российской Федерации 125167, Россия, г. Москва, пр-д 4-Й вешняковский, 12к2, корпус 2 Pleshakova Ekaterina Sergeevna PhD in Technical Science Associate Professor, Department of Information Security, Financial University under the Government of the Russian Federation 125167, Russia, Moscow, 4th Veshnyakovsky Ave., 12k2, building 2 espleshakova@fa.ru Другие публикации этого автора     Филимонов Андрей Викторович кандидат физико-математических наук доцент, кафедра Информационной безопасности, Федеральное государственное образовательное бюджетное учреждение высшего образования «Финансовый университет при Правительстве Российской Федерации» 125167, Россия, г. Москва, пр-д 4-Й вешняковский, 4, оф. корпус 2 Filimonov Andrei Viktorovich PhD in Physics and Mathematics Associate Professor, Department of Information Security, Federal State Educational Budgetary Institution of Higher Education "Financial University under the Government of the Russian Federation" 125167, Russia, g. Moscow, pr-d 4-I veshnyakovskii, 4, of. korpus 2 remueur@yandex.ru Осипов Алексей Викторович кандидат физико-математических наук доцент, Департамент анализа данных и машинного обучения, Финансовый университет при Правительстве Российской Федерации 125167, Россия, г. Москва, ул. 4-Й вешняковский, 4, корпус 2 Osipov Aleksei Viktorovich PhD in Physics and Mathematics Associate Professor, Department of Data Analysis and Machine Learning, Financial University under the Government of the Russian Federation 125167, Russia, Moscow, 4th veshnyakovsky str., 4, building 2 avosipov@fa.ru Другие публикации этого автора

Гатауллин Сергей Тимурович кандидат экономических наук декан факультета «Цифровая экономика и массовые коммуникации» Московского технического университета связи и информатики; ведущий научный сотрудник Департамента информационной безопасности Финансового университета при Правительстве РФ 111024, Россия, г. Москва, ул. Авиамоторная, 8А Gataullin Sergei Timurovich PhD in Economics Dean of "Digital Economy and Mass Communications" Department of the Moscow Technical University of Communications and Informatics; Leading Researcher of the Department of Information Security of the Financial University under the Government of the Russian Federation 8A Aviamotornaya str., Moscow, 111024, Russia stgataullin@fa.ru Другие публикации этого автора

Статья подготовлена в рамках государственного задания Правительства Российской Федерации Финансовому университету на 2022 год по теме «Модели и методы распознавания текстов в системах противодействия телефонному мошенничеству» (ВТК-ГЗ-ПИ-30-2022).

Introduction

The influence of the mass media on the formation of national, political and religious views of the population is undeniable. Limited volumes, author's responsibility allows you to strictly control all the information material that is printed in newspapers, voiced on radio and television. In recent years, social networks have become very widespread. Now their degree of influence on the views of people is comparable to the degree of influence of television ^[1-3]. The conversational style of communication, the limited liability of authors and the huge number of publications do not allow the use of standard media tools and methods of control. Currently, social networks are actively used for malicious influence ^[4-5].

This paper deals with the problem of identifying cyberbullying in social networks. Cyberbullying is the users of social networks, forums and other discussion platforms on the Internet who escalate anger, conflict through covert or overt bullying, belittling, insulting another participant or participants in communication. Cyberbullying is expressed in the form of aggressive, mocking and offensive behavior ^[6-9].

Online cyberbullying causes great harm, since such users can incite conflicts based on religious hostility, ethnic hatred, etc. ^[10-13]. Even just the participation of cyberbullying in a discussion makes the rest of the participants nervous and wastes their time responding to such a user. It turns out that the discussion on any topic is littered with unnecessary messages. The problem of regulation of cyberbullying comments is getting bigger. One of the possible solutions is the use of machine learning to recognize cyberbullying.

Thus, the task of identifying and blocking cyberbullying is relevant.

Models and Methods

There are various methods to find cyberbullying users. The simplest and most reliable approach is manual moderation of discussions ^[14-15]. However, given that millions of users communicate on social networks, manual search becomes too costly. In this case, it is necessary to use methods of automated search for cyberbullying.

In 2011, a group of researchers from Canada developed an interesting method for identifying users who engaged in cyberbullying for money ^[1]. The method is based on the analysis of comments left by attackers and their behavior on the network. It is assumed that such users have similar behavior patterns, which makes it possible to identify them.

Table 1 lists the characteristics of user comments that were analyzed.

Table 1. List of characteristics of user comments

The researchers used a classification based on semantic and non-semantic analysis. The maximum detection accuracy was 88.79%. As the researchers themselves note, in earlier studies based only on the analysis of the content of messages, the accuracy did not exceed 50% ^[2-4].

At the same time, a significant drawback is the dependence of the proposed algorithm on easily changed indicators, such as Post Time or Post Location. Sequence No is also an unreliable parameter.

In our opinion, the most accurate way to determine whether a user is an attacker or not is only by analyzing the text of his comments and the frequency of posting.

Moreover, given the fact that attackers can write with errors, use formulaic phrases or disguise themselves as normal users, it is better to analyze not the semantic part of their comments, but the emotional component, since it is much more difficult to forge.

In addition, it should be taken into account that attackers do not just write comments, but try to manipulate other participants in the discussion, which should also manifest itself in the emotional component.

Let's try to qualitatively imagine typical models of user behavior in a social network when posting comments.

Most of the users practically do not leave comments on the message they like. Usually put "like" or "class". At best, they will write something like “super!”, “Cool”, or the like. Those. we are dealing with single comments, which are usually very short.

The next category of users writes longer comments, which, as a rule, reflect their emotional attitude to the message.

Another category of participants in the discussion is the “victims” of cyberbullying. As a rule, they try to prove something and at the same time write very detailed comments with an abundance of emotions.

And finally, cyberbullying attackers. These are people who constantly participate in the discussion, try to provoke other participants, and, therefore, cannot unsubscribe with short phrases.

To identify the emotional state of the discussion participant, we used the fact that the structure of the informational text is fundamentally different from the structure of the inspiring (manipulating) text and is characterized by the absence of intentional rhythmization of its lexical and phonetic units ^[16-17].

In practice, this means that some sound combinations can not only evoke certain emotions, but can also be perceived as certain images ^[5]. For example, in combinations, the letter “and” with an indication of the subject has the property of “reducing” the object, in front of which (or in which) it is clearly dominant. Also, the sound "o" gives the impression of softness and relaxation. The predominance of the sounds "a" and "e", as a rule, is associated with an emotional upsurge.

Based on the prerequisites listed above, we proposed the fields listed in Table 2 for analysis.

Table 2. List of fields for analysis

The values of these fields are calculated using the following formulas:

where p - is the user's serial number, i - is the message serial number for the p-th user, Mp - is the number of messages for the p-th user, x - is the symbol for which the calculation is made; Ni,x,p - is the number of characters x in the i-th message of the p-th user; Ni,p - is the total number of characters in the i-th message.

To train the classifier, we prepared a statistical sample of more than 1200 comments on a message on a political topic. There were 145 active participants in the discussion. In this sample, 2 intruders were manually identified.

In addition, another sample on religious topics was prepared for testing, consisting of 61 comments and 30 active participants. There were no perpetrators in this sample.

Table 3 shows an example of a training set.

Table 3. An example of a training set

Kohonen's self-organizing maps ^[3], implemented on the basis of the analytical package Deductor, were used as a classifier.

The following settings were used for training:

1. Determining the number of clusters is automatic;

2. The learning rate is 0.3 at the beginning and 0.005 at the end;

3. The learning radius at the beginning is 4, and at the end 0.1;

4. The maximum number of training epochs is 1000.

As a result of the training, the Kohonen map was obtained, shown in Figure

Picture. 1. Map of Kohonen

This figure shows the results of constructing the Kohonen map in projections on the input parameters. A total of 7 clusters were identified.

The cluster containing intruders is most clearly visible in the projection on the Mp parameter.

To test the correct operation of the neural network, we “manually” identified two typical attackers, and many participants in the discussion described these users in the same way. Both users ended up in cluster number 0 (in the figure it is marked with a dot). In the same group, there were two more users who, after additional analysis of their messages, were also characterized by us as malefactors.

There were no erroneous detections of intruders in the test sample.

As a result of the training, a table of the significance of the fields was also compiled to classify users as intruders.

Table 4. Table of significance of fields

This table shows that, although the number of comments is of the greatest importance, the frequency characteristics of individual characters that determine the emotional state of the user also affect the decision to classify a discussion participant as cyberbullying.

Figure 2 shows a generalized scheme of the proposed algorithm for detecting intruders.

Picture. 2. Generalized scheme of the algorithm

The proposed algorithm for detecting intruders consists of the following steps:

1. All comments are selected from the selected discussion in the social network;

2. Comments enter the data cleaning and transformation block, where, according to formulas 1 and 2, they are converted to the form presented in table 3;

3. This data is passed through the Kohonen network;

4. At the output of the network, we get for each participant in the discussion the number of the cluster to which he belongs;

5. Correlating the numbers of clusters with the initial user data in the interpretation block, we get a list of intruders identified in this discussion.

The proposed algorithm has a number of advantages compared to the one described at the beginning of the article:

1. For analysis, we do not use user IDs that are easily changed;

2. We do not need to take into account the geography of the participants in the discussion;

3. The discussion can be extended indefinitely in time, but this will not affect the quality of the algorithm in any way;

4. For analysis, we use the emotional component of comments, and we identify this component not by words, as in other authors, but by the frequencies of occurrence of certain characters. This gives the algorithm stability in case of text distortion or intruder masking.

Of the shortcomings, the following should be noted:

1. The algorithm works effectively only when the discussion already contains several hundred comments;

2. The proposed method does not work if attackers write single comments from different accounts or use special software bots.

Conclusion

This article proposed a method for detecting cyberbullying in social networks, which is based on an analysis of the emotional state of network users and behavioral activity. Testing has shown the effectiveness of the proposed method. Using the proposed method for detecting cyberbullying in social networks, it is possible to process large amounts of data without using user identifiers that are easily changed. For analysis, the emotional component of comments is used, and we identify this component not by words, as in other authors, but by the frequencies of occurrence of certain characters. This gives the algorithm stability in case of text distortion or intruder masking. The results obtained are not highly accurate. Such methods will greatly facilitate the search for cyberbullying and reduce processing costs for post moderators in order to improve the quality of communication and comfortable viewing of content for users of social networks.