Integrating Transformer Embeddings with Graph Neural Networks: Building an End-to-End Malicious User Detection System

This article introduces an end-to-end malicious user detection system that combines BERT/RoBERTa text embeddings with GCN/GraphSAGE graph neural networks. The system constructs a user relationship graph using cosine similarity and achieves efficient identification on a dataset containing 2400 Twitter users, with the GraphSAGE model delivering the best performance. The project systematically compares the effects of different technical routes and provides empirical references for malicious user detection.

With the popularization of social media, the detection of malicious users (hate speech posters, banned accounts) has become a core challenge in platform governance. Traditional rule-based or single-feature methods struggle to cope with complex network environments. This project builds an end-to-end machine learning pipeline, integrating three technical routes: classic ML, Transformer embeddings, and GNN, and compares and validates the effectiveness of the solutions on a real Twitter dataset.

The project uses a dataset of approximately 2400 Twitter user nodes, each containing profile text and a binary label (1 = malicious/banned, 0 = normal). The dataset has a significant class imbalance: 387 malicious users and 2013 normal users, with a ratio of about 1:5. Therefore, ROC-AUC (reflecting the ranking ability across all thresholds) and F1 score (measuring classification quality) are used as the main evaluation metrics.

###1. Text Embedding Generation We compare BERT-base-uncased (bidirectional encoder, masked language model + next sentence prediction) and RoBERTa-base (BERT optimization: 10x more data, dynamic masking, removed NSP, byte-level BPE). RoBERTa has better embedding quality and stronger robustness to social media noise.

###2. Classic Machine Learning Benchmarks

• Logistic Regression: Best performance, simple model not prone to overfitting, fully leverages the linear separability of embeddings;
• SVM: Greatly affected by class imbalance, requires extensive hyperparameter tuning;
• Random Forest: Unstable, difficult to utilize the geometric structure of embeddings, low efficiency in processing high-dimensional vectors.

###3. Core Innovation of GNN A user semantic relationship graph is constructed using cosine similarity (edges are added if similarity exceeds a threshold). We compare GCN (spectral convolution, sensitive to graph density, easy to over-smooth) and GraphSAGE (sampling strategy, inductive learning, flexible aggregation of neighbor information, strong fault tolerance). GraphSAGE achieves the best performance.

The project experiments得出 three important conclusions:

1. Pre-training quality determines the upper limit of embeddings: RoBERTa outperforms BERT in all metrics, proving the key impact of pre-training data scale and strategy;
2. Feature-model matching is required: Dense embeddings are more suitable for linear models (e.g., logistic regression) than tree models;
3. Graph structure information gain is significant: GraphSAGE outperforms pure text methods, verifying the community clustering of malicious users—GNN can effectively mine structural patterns.

This architecture has wide transfer value and is applicable to user content moderation scenarios such as social media, forums, and e-commerce reviews. Reference ideas:

1. Multimodal feature fusion (text + user relations to build heterogeneous graphs);
2. Progressive model selection (iterative from logistic regression to GNN);
3. Imbalanced data handling (prioritize robust evaluation metrics and loss functions);
4. Enhance interpretability (use attention mechanisms or graph visualization to show decision-making basis).

This open-source project provides a complete technical reference implementation, covering the entire process from data preprocessing, feature engineering, model training to evaluation. It systematically compares the advantages and disadvantages of different technical routes and provides an empirical basis for the selection of malicious user detection schemes. Future exploration directions: introduce GAT, combine temporal modeling for user behavior evolution, and develop a real-time incremental learning framework to adapt to network changes.