Detecting abusive collaborative activity using a graph neural network

A computing system for controlling network activity, comprising:

• a processing system including a processor;
• a network-inspecting mechanism for detecting network activity by a plurality of entities over a computing network;
• a storage device for storing machine-readable instructions that, when executed by the processing system, perform operations comprising:
• identifying a particular feature set associated with a particular entity under consideration having an unknown classification, the feature set including features that describe the network activity of the particular entity over the computing network;
• using a graph neural network to generate a result that indicates whether the particular entity is a kind of entity that engages in abusive network-related activity in collaboration with other network entities that also engage in the abusive network-related activity, with respect to a predetermined standard that defines what constitutes abusive network-related activity;
• and
• taking action to control interaction by the particular entity with the computing network based on the result generated by the graph neural network,
• the graph neural network being trained by a training framework by:
• associating respective nodes with the plurality of entities;
• identifying respective feature sets for the plurality of entities, each feature set including features that describe network activity exhibited by an associated entity;
• identifying a plurality of edges, each edge in the plurality of edges connecting two entities in the plurality of entities having feature sets that satisfy a prescribed test for similarity;
• labeling at least some of the entities with labels, each label indicating whether a corresponding entity is the kind of entity that engages in the abusive network-related activity,
• the nodes, edges, and labels defining a training set;
• and
• training the graph neural network based on the training set.

A computer-readable storage medium for storing computer-readable instructions, wherein a processing system executing the computer-readable instructions performs operations comprising:

• associating respective nodes with the entities that engage in network activity over a computing network;
• identifying respective feature sets for the plurality of entities, each feature set including features describing characteristics of engagement by a particular entity with content that is deliverable over the computing network via websites hosted by the computing network;
• identifying a plurality of edges, each edge in the plurality of edges connecting two entities in the plurality of entities having feature sets that satisfy a prescribed test for similarity;
• labeling at least some of the entities with labels, each label indicating whether a corresponding entity is a bot that engages in collaborative activity over the computing network with other bots,
• the nodes, edges, and labels defining a training set;
• training the graph neural network based on the training set, to provide a trained graph neural network for use by an abuse control system.