A prototype of the system for searching and detecting extremist messages on the VKontakte social network

Baumtrog Viktor Etmontovich PhD in Physics and Mathematics Professor at the Department of Computer Studies and Special Equipment of Barnaul Juridical Institute of the Ministry of Internal Affairs of Russia 656052, Russia, Altai Krai, Barnaul, 49 Chkalova str., room 432 barnaul@list.ru Other publications by this author     Es'kov Aleksandr Vasil'evich Doctor of Technical Science Head of the Department of Information Security ; Krasnodar University of the Ministry of Internal Affairs of Russia 350005, Russia, Krasnodar Territory, Krasnodar, Yaroslavskaya str., 128 alesc72@mail.ru Other publications by this author

Smirnov Yurii Aleksandrovich Research Associate of the Data Transmission Department of the Center for Communication Facilities and Systems; Scientific Research Institute of Special Equipment of the Federal State Budgetary Institution NPO STIs of the Ministry of Internal Affairs of Russia 111024, Russia, Moscow, Prudsky Klyuchiki str., 2 yra.smirnov01@mail.ru

Introduction

The social network VKontakte (VK) is widely used and especially popular among Russian-speaking users around the world (The social network "In contact" and its audience. URL: https://www.seowizard.ru/blog/faq/wiki/с/socialnaya-set-v-kontakte-i-ee-auditoriya ). Individual publications on this network may entail legal liability for the owners of the platforms and resources on which they are posted (Legal framework for countering Extremism and Terrorism. URL: https://252.56.xn--b1aew.xn--p1ai/news/item/45436942 ), in this regard, there is a need to detect and control content that has illegal specifics. For effective monitoring and management of this content, sophisticated tools and methods are needed, which, despite all efforts ^{[2,3,4,5,6,7,8,9]}, turn out to be insufficient. To solve the problems of monitoring and managing content on the VKontakte social network, the authors of this work have created and tested a prototype computer system that is able to identify and prevent the dissemination of illegal information.

Selection of tools

The Python scripting programming language was chosen as the programming language for the prototype computer system, as it is universal and suitable for solving problems on various platforms, including iOS and Android, as well as server operating systems and allows the use of a neural network. In addition, it already has a library responsible for working with the software interface of the VKontakte social network (VKontakte API) – the Transformers library with the Torch software platform (Introduction to the Transformers library and the Hugging Face platform. [electronic resource]. URL: https://habr.com/ru/articles/704592/). The VKontakte API is a powerful tool for developers and researchers, capable of providing access to an extensive amount of data on this social network. The VKontakte API is an interface that allows you to extract information from a database vk.com via HTTP requests to a specialized server ^{[5, 8, 10]}. The query syntax and the type of data returned are strictly defined by the service. The next tool used is the Hugging Face platform, which is a collection of ready-made modern pre-trained deep learning models. Deep learning is a type of machine learning based on data analysis through multi—layered networks similar to the human brain. The essence of deep learning is that computers find solutions on their own. They learn from their own mistakes and make more accurate predictions every time (Deep learning: what it is, how it works and where it is applied. URL: https://getcompass.ru/blog/posts/deep-learning). The Transformers library provides tools and interfaces for easy download and use.

The generalized scheme of the model and the order of interaction of its modules

The model of the system is shown in Fig. 1. Telegram messenger was chosen as the user interface due to its convenient and simple language for creating bots, as well as its availability on personal computers and smartphones ^{[10, 11]}. In addition, the Telegram platform already has a built-in user registration and verification system, which facilitates the authentication process. When a user sends a message containing a link to a VKontakte group, the link is sent to the server. Using the VKontakte API, the server of the developed system collects the required number of messages from the specified VKontakte group. On the server, these messages are processed by a neural network, and a report is generated, which is then returned to the Telegram messenger to the user.

Fig. 1. Generalized diagram of the computer system model.

The entire structure of the data processing and receipt process can be divided into separate functional modules, the interaction scheme of which is shown in Fig. 2 and each of which performs its own task. The modules have names: bot, creating_network, messagedumper, processing, reportgen.

Fig. 2. The scheme of interaction of the system modules.

At the initial stage, you need to create an initial database (a reference file). To do this, the creating_network module was developed, which accepts a csv file from the user for input. This reference file, created by the developers, contains messages (phrases, words) divided into two groups, with appropriate labels: 1 — information contains illegal information and 0 — does not contain. The data of the reference file allows the neural network to perform binary text classification ^{[13, 14, 15, 16, 17, 18, 19]}.

The work uses a pre-trained DeepPavlov/rubert-base-cased-sentence model designed for processing the Russian language ^{[15, 18]}. The data of the reference file is divided by the user into three groups in the ratio of 60/20/20:

train — training data;

val — validation data;

test — test data.

The training data is used to train the model. However, to avoid overfitting, validation data is created. This data is gradually included in the training set during the training of the model, until an optimal ratio is reached in which the model demonstrates high accuracy in recognizing illegal content without signs of retraining. Test data play a key role in evaluating the effectiveness and reliability of the model based on new, previously unknown data ^{[19, 20]}.

The next step involves dividing all the data into two main parts: messages and headers. Headers are used to set labels (0 or 1) that characterize the context or type of the message. It is also important to tokenize the text, which means splitting it into separate words, phrases, or other significant elements in order to prepare the data for subsequent processing and analysis.

The resulting text is converted into a tensor (in the context of neural networks, a tensor is a multidimensional array of numbers used for storing and processing data) and loaded into a DataLoader, which piecemeal feeds data for training and validation of the model. The user does not need to train the model, it is possible to add their own data for text classification.

In the process of training the model, 20 generations of weights are generated, from which the most successful ones are selected. A file is created based on the results of this process saved_weights.pt , containing weights optimal for binary text classification. These weights are then checked against test data to evaluate their effectiveness.

An illustration of the work of a prototype computer system

The results of the module's work with DeepPavlov/rubert-base-cased-sentence are formed in the form of floating-point numbers in the range from 0 to 1. It is noteworthy that the threshold determining the correctness of recognition is empirically set at 0.92: values up to 0.92 are considered negative, and values above positive. This threshold will be used in the future as a criterion for classifying the text.

A small part of the final results of the prototype computer system is shown in Fig. 3, which presents the following data:

messages – messages (shown in the picture in a modified encoding);

labels – the initially set weights of the corresponding messages;

confidence – the exact value of the model's confidence in recognition;

pred is the final recognition result.

These components help to understand how the model interprets and classifies input data.

Fig. 3. The results of processing the test data.

Most often, the system interprets the data in the same way as the user, but there are also inconsistent results. For example, in line 894, the user defined the data as not containing illegal information (Label=0), and the system interpreted this data as containing such information.

The module responsible for the operation of the bot is called Bot, respectively. He explains how to work with him, collects messages and sends a link to the VKontakte group for further processing (Kruglik R. I. Creating a chatbot in Telegram // Postulate. 2019. №. 9) ^{[11, 12]} . In addition, the bot module sends the result of reportgen's work to the user who monitors the available content of the social network if extremist or terrorist information has been recognized.

Next, Messagedumper collects the last 10 non-empty community messages and sends them to the server for verification (Fig. 4). The number of messages can be increased, but this will also increase the processing time in proportion to the increase in the number of messages.

Fig. 4. Illustration of the program code of the process of collecting messages from the VKontakte social network.

Processing processes received messages from messagedumper using weights taken from creating_network. The accuracy of illegal information recognition reaches 95% if the messages have a large volume and are similar in subject matter to the database. The obtained results are transmitted to the reportgen module, which generates a report and sends it to the bot ^[21]. If illegal information was not detected during the processing, the report generation is skipped, and the bot issues a message stating that the group meets the established standards.

Conclusion

The proposed prototype of the computer system has significant potential for further development and improvement in the future. Technically, it is possible to check not only the posts of VKontakte groups, but also the comments under them, save user statistics and form their overall rating, which could help in identifying terrorist or extremist activities. At the moment, the platform's Rules prohibit the use of user data, which does not allow the above-mentioned features to be implemented at the moment. Here are the restrictions set out in section 2 "Working with data" of the Platform Rules when using the VKontakte public API (Rules for using the VKontakte API. Revision dated 03/01/2024. URL: https://dev.vk.com/ru/rules ).

Applications are prohibited from:

2.1. Collect and store user data, including the User ID, for purposes unrelated to the operation of the Application. The requested data should only be used in the context of the application.

For example, you can cache the IDs of a user's friends to display the list faster on a mobile device. You cannot transfer the IDs of all users to your server in order to store them in your own database, just in case.

2.2. Transfer any user data obtained automatically through the API (including User ID) to third-party services (for example, advertising) both directly and through intermediaries.

2.3. Use user data in any advertisements. For example, to address a user by name from an advertising banner.

2.4. Data obtained through the API, including the methods of newsfeed.search, wall.get, wall.search, including user IDs, cannot be used for transfer or resale, creation of analytical reports, scoring, etc. directly or through intermediaries without the express consent of the Site Administration. Such consent, for example, may be an agreement with an advertising agency for the use of data on ad impressions in reports to clients.

The learning process of the developed computer system was implemented offline. For real-time self-learning, sufficiently powerful equipment and constant administration are needed, which will lead to an increase in the percentage of recognition of illegal text content.

The modular structure of the system allows you to constantly upgrade its individual components. The scheme of building a prototype of a computer system can also be applied to platforms of other social networks.

It is possible to reconfigure the model for binary classification of text that is not related to terrorism and extremism. The model works with the source data coming into its input database. If you need to search for other information, changing keywords will allow you to quickly reconfigure the model in accordance with the necessary requirements.

Illustrations 3 and 4 show the testing of a prototype computer system. As a result, they were found:

1) The performance of the system.

2) Ease of use, including on smartphones.

3) Sufficiently high accuracy in the search for illegal content.

4) The ability of the system to analyze content not only by keywords, but also by the semantic meaning of the text.

So, the developed prototype of a computer system using neural network technologies greatly simplifies the process of detecting extremist (illegal) information on the VKontakte social network. The system allows you to automate the content monitoring process, ensuring timely identification and response to publications that are potentially dangerous or violate the rules of the social network, which allows you to increase security and ensure that the content used in the platform meets regulatory requirements. An important advantage of the prototype is that it is constructed from freely distributed software.

The article will be of interest to researchers in the field of information security, developers of automated content monitoring systems, as well as specialists in social network analysis. It is important to note that the practical application of the proposed system may be of interest to government agencies and organizations involved in the fight against extremism.