A method and system for handling abnormal data in virtual games

Abstract

This invention discloses a method and system for processing abnormal data in virtual games, relating to the field of big data processing technology. The method involves receiving a sequence of interactive data frames uploaded by a terminal device and parsing it to obtain a set of input device sampling points and displacement coordinate vectors. Feature extraction is performed on the input device sampling point set to obtain a high-dimensional feature vector. This high-dimensional feature vector is mapped to a preset behavioral feature space, and the multidimensional statistical distance of the high-dimensional feature vector in the behavioral feature space is calculated to generate a first anomaly confidence coefficient. Spatial mapping data corresponding to the virtual scene is invoked. Discretized ray stepping detection is performed in the spatial mapping data based on the displacement coordinate vector to generate a second anomaly confidence coefficient. The first and second anomaly confidence coefficients are fused using a dynamic weighted algorithm to obtain a comprehensive anomaly score. Abnormal data is determined based on the comprehensive anomaly score, and a state rollback operation is performed on the virtual object.

Description

Technical Field

[0001] This invention relates to the field of big data processing technology, and in particular to a method and system for processing abnormal data in virtual games. Background Technology

[0002] With the booming development of large-scale multiplayer online virtual interactive systems (such as MMORPGs and metaverse platforms), data interaction within virtual scenes exhibits characteristics of high concurrency and complex logic. In order to maintain the fairness of the system and the stability of the economic system, the server must conduct strict legality verification on the interactive data uploaded by massive amounts of terminal devices to prevent malicious users from tampering with data by using cheats or exploiting network latency vulnerabilities.

[0003] Existing anomaly data processing technologies have significant technical limitations:

[0004] First, traditional methods for verifying the authenticity of input behavior mainly rely on client-side memory scanning or process hook detection. This not only involves user privacy compliance risks, but is also easily bypassed by kernel-level drivers or hardware macros, making it difficult for simple rule-based detection models to distinguish between high-level players and automated programs.

[0005] Secondly, regarding the validity verification of spatial displacement, existing high-precision solutions typically require the server to load a complete 3D scene geometry model and run a physics engine for continuous collision detection. However, in high-concurrency scenarios where thousands of objects move simultaneously, this can lead to excessive server load or even crashes, resulting in blind spots in the detection.

[0006] In summary, existing detection models based on simple rules are insufficient for accurate anomaly data identification; therefore, a method and system for anomaly data processing in virtual games is proposed. Summary of the Invention

[0007] This invention provides a method and system for processing abnormal data in virtual games, which solves the problems of low recognition accuracy and blind spots and lag in the detection of abnormal data in the prior art, and achieves the technical effect of accurate identification of abnormal data.

[0008] This invention provides a method for handling abnormal data in virtual games, comprising:

[0009] Receive the sequence of interactive data frames uploaded by the terminal device, and parse them to obtain the set of input device sampling points containing time information and the displacement coordinate vector of the virtual object in the three-dimensional scene;

[0010] Feature extraction is performed on the set of sampling points of the input device to construct a high-dimensional feature vector representing the current operation behavior; the high-dimensional feature vector is mapped to a preset behavior feature space, the multidimensional statistical distance of the high-dimensional feature vector in the behavior feature space is calculated, and the first anomaly confidence coefficient is generated;

[0011] Call the spatial mapping data corresponding to the virtual scene; based on the starting and ending coordinates of the displacement coordinate vector, perform discretized ray step detection in the spatial mapping data, extract the target voxel set covered by the displacement path, and count the proportion of the number of voxels in the target voxel set whose physical passage attribute is marked as blocked to the total number of voxels in the path, and generate the second anomaly confidence coefficient.

[0012] The first and second anomaly confidence coefficients are fused using a dynamic weighted algorithm to obtain a comprehensive anomaly score; abnormal data is identified, and a state rollback operation is performed on the virtual object.

[0013] The steps for receiving and parsing the sequence of interactive data frames include:

[0014] Establish a long-term communication channel between the server and the terminal device, and receive data packets encapsulated based on a binary serialization protocol; perform integrity verification and decryption processing on the data packets, and extract the global logical clock stamp and frame sequence number contained in the header; reassemble and sort out out-of-order data packets based on the frame sequence number, remove duplicate redundant frames, and construct an interactive data frame sequence with strictly increasing time sequence.

[0015] A sliding window buffer queue of a preset length is maintained for each terminal device. All continuous data points in the sliding window buffer queue are extracted, and the hardware event type, trigger timestamp, screen pixel coordinates and relative displacement of the input device are parsed through field mapping to form a set of input device sampling points.

[0016] The displacement coordinate vector is obtained by parsing the world coordinates, instantaneous velocity vector, and orientation quaternion of the virtual object in the physics engine.

[0017] The steps to construct a high-dimensional feature vector include:

[0018] The displacement sequence in the set of sampling points of the input device is denoised, and a reference motion trajectory representing the macroscopic intention is fitted using a zero-phase dual filter; the original displacement sequence is subtracted from the reference motion trajectory to obtain the micro residual sequence after removing the intention; the micro residual sequence is analyzed in the time domain to calculate the variance and autocorrelation coefficient to quantify the smoothness of the time domain trajectory.

[0019] The microscopic residual sequence is subjected to frequency domain transformation to calculate the power spectral density and extract the energy proportion of high-frequency components, thus quantifying the frequency domain energy distribution. A multi-scale entropy algorithm is applied to calculate the sample entropy values ​​of the residual sequence under different time scale factors, thus quantifying the microscopic operation residual complexity. The time domain trajectory smoothness, frequency domain energy distribution, and microscopic operation residual complexity are numerically normalized and then concatenated according to a preset dimensional order to form a high-dimensional feature vector describing the physiological tremor characteristics of the operator.

[0020] The training and generation process of pre-stored high-density behavioral clusters in the behavioral feature space includes:

[0021] During the offline phase, historical operation logs of users confirmed to be non-cheating users are collected as a positive sample dataset; a feature extraction step is performed on the positive sample dataset to obtain a set of historical feature vectors.

[0022] Principal component analysis (PCA) is used to reduce the dimensionality of the historical feature vector set, retaining principal components whose cumulative variance contribution rate exceeds a preset threshold. The dimensionality-reduced data is then input into a density-based spatial clustering algorithm model for unsupervised training. Through iterative calculation, high-density regions with a sample point distribution density greater than a preset core density are identified. The identified high-density regions are fitted with a multidimensional Gaussian distribution to construct a parameterized probability density model, and the fitted model region is defined as a high-density behavioral cluster. The geometric center position, boundary contour radius, and covariance matrix of the high-density behavioral clusters are calculated and stored as benchmark parameters for online determination.

[0023] The steps for generating the first anomaly confidence coefficient include:

[0024] The constructed high-dimensional feature vectors are projected into the same low-dimensional subspace as the high-density behavioral clusters;

[0025] Read the pre-stored covariance matrix and its inverse matrix, calculate the Mahalanobis distance between the high-dimensional feature vector and the geometric centroid of the cluster; input the calculated Mahalanobis distance into a preset nonlinear activation function, which is configured to output a value close to zero when the Mahalanobis distance is less than the boundary contour radius of the cluster, and output a value that increases exponentially with distance when the Mahalanobis distance exceeds the boundary contour radius.

[0026] The output of the activation function is truncated and mapped to a closed interval between 0 and 1, which serves as the first anomaly confidence coefficient characterizing the degree to which the input behavior deviates from normal features.

[0027] The process of constructing the spatial mapping data includes:

[0028] During the virtual scene initialization and loading phase, a 3D bounding box covering the entire scene is created and divided into a cubic voxel mesh with fixed side lengths.

[0029] Iterate through all static terrain and building geometric model data in the scene, and use the separating axis theorem to detect the spatial overlap between each voxel mesh and the geometric model; if there is an overlap, mark the corresponding index position of the voxel mesh in the three-dimensional Boolean array as a true value, representing a physically impassable blocking state; if there is no overlap, mark it as a false value, representing an air-passable state.

[0030] The three-dimensional Boolean array is compressed and stored using a sparse octree data structure and loaded into the server's high-speed cache memory to form a discretized voxel grid index for fast collision detection.

[0031] The steps for performing discretized ray step detection include:

[0032] Establish a voxel coordinate system with the origin of the virtual scene as the reference, and convert the starting and ending coordinate points of the displacement coordinate vector into the corresponding starting and ending voxel indices.

[0033] Calculate the unit direction vector along the ray direction and determine the step increment required for the ray to cross the voxel boundary in the three coordinate axis directions; using a three-dimensional digital differential analysis algorithm, starting from the initial voxel index, iterate through adjacent voxels along the ray direction until the termination voxel index is reached.

[0034] During each iteration, the index of the voxel currently traversed is recorded in a temporary list, and the temporary list is used as the set of target voxels covered by the displacement path.

[0035] The steps for generating the second anomaly confidence coefficient include:

[0036] The target voxel set is traversed, and the Boolean attribute value in the spatial mapping data is directly read according to the index of each voxel. A collision counter is set, and whenever a Boolean attribute value is detected as a true value representing the blocking state, the counter value is incremented, and different weights are assigned according to the position of the voxel in the path. The weight of voxels in the middle of the path is higher than that of voxels at the endpoints to tolerate edge errors. The weighted penetration rate is obtained by calculating the ratio of the total number of collision counts after weighting to the total number of voxels in the target voxel set.

[0037] The weighted penetration rate is mapped to the second anomaly confidence coefficient using a pre-defined piecewise linear function.

[0038] The dynamic weighting algorithm for fusion calculation includes:

[0039] Read the relative position density of the current high-dimensional feature vector in the behavioral feature space. If it is lower than the density of the core region but higher than the density of the sparse region, it is determined to be a fuzzy zone. At this time, the influence of the first anomaly confidence coefficient on the result is reduced by decreasing the weight factor, and the weight factor of the second anomaly confidence coefficient is increased accordingly. The weighted sum of the two is calculated as the comprehensive anomaly score.

[0040] An abnormal data processing system for a virtual game includes:

[0041] The data acquisition module receives the sequence of interactive data frames uploaded by the terminal device, and parses and obtains the set of input device sampling points containing time information and the displacement coordinate vector of the virtual object in the three-dimensional scene;

[0042] The first identification module extracts features from the set of sampling points of the input device to construct a high-dimensional feature vector representing the current operation behavior; maps the high-dimensional feature vector to a preset behavior feature space, calculates the multidimensional statistical distance of the high-dimensional feature vector in the behavior feature space, and generates the first anomaly confidence coefficient.

[0043] The second identification module calls the spatial mapping data corresponding to the virtual scene; based on the starting and ending coordinates of the displacement coordinate vector, it performs discretized ray step detection in the spatial mapping data, extracts the target voxel set covered by the displacement path, and counts the proportion of the number of voxels in the target voxel set whose physical passage attribute is marked as blocked to the total number of voxels in the path, and generates the second anomaly confidence coefficient.

[0044] The anomaly detection module calculates a comprehensive anomaly score by fusing the first anomaly confidence coefficient and the second anomaly confidence coefficient using a dynamic weighted algorithm. Based on the comprehensive anomaly score, it determines that the data frame sequence is abnormal data and performs a state rollback operation on the virtual object.

[0045] The beneficial effects of this invention are:

[0046] 1. This invention solves the core technical challenge of misjudgments by anti-fraud systems caused by poor data quality in weak network environments by constructing a rigorous network data preprocessing mechanism. Through a sequence number-based recombination and deduplication mechanism, it effectively eliminates the interference of network packet loss and out-of-order processing on logical verification. By using a sliding window to aggregate data within continuous time periods, subsequent algorithms can analyze complete action segments rather than isolated points, greatly improving the robustness of feature extraction. Combined with a global clock network latency compensation mechanism, it eliminates time discrepancies between the client and server, ensuring precise alignment of the displacement vector and input sampling points on the time axis, significantly improving the system's judgment accuracy.

[0047] 2. This invention addresses the problems of high maintenance costs and significant lag in traditional rule-based anti-cheating systems by introducing unsupervised learning and statistical modeling techniques. By learning the behavioral patterns of massive numbers of legitimate players, high-density clusters are constructed, defining the boundaries of legitimate operations. This enables defense against unknown threats. Furthermore, the combination of PCA dimensionality reduction and multidimensional Gaussian fitting not only mitigates the curse of dimensionality in online computation but also replaces massive sample storage with parameterized storage, significantly saving server memory and making it possible to support large-scale concurrent detection with limited resources. Attached Figure Description

[0048] Figure 1 This is a flowchart illustrating an abnormal data processing method for a virtual game according to the present invention.

[0049] Figure 2 This is a data logic diagram of an abnormal data processing method for a virtual game according to the present invention;

[0050] Figure 3 This is a schematic diagram of the structure of an abnormal data processing system for a virtual game according to the present invention;

[0051] Figure 4 This is a stability test data diagram of an abnormal data processing system for a virtual game according to the present invention. Detailed Implementation

[0052] The above technical solutions will be described in detail below with reference to the accompanying drawings and specific embodiments to better understand them. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments of the present invention. It should be understood that the present invention is not limited to the exemplary embodiments used only to explain the present invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. It should also be noted that, for ease of description, only the parts related to the present invention are shown in the drawings, not all of them.

[0053] Example 1:

[0054] This invention proposes a method for handling abnormal data in virtual games, the process of which is as follows: Figure 1 The data logic of the method is as follows: Figure 2 The above includes:

[0055] Receive the sequence of interactive data frames uploaded by the terminal device, and parse them to obtain the set of input device sampling points containing time information and the displacement coordinate vector of the virtual object in the three-dimensional scene;

[0056] Feature extraction is performed on the set of sampling points of the input device to construct a high-dimensional feature vector representing the current operation behavior; the high-dimensional feature vector is mapped to a preset behavior feature space, the multidimensional statistical distance of the high-dimensional feature vector in the behavior feature space is calculated, and the first anomaly confidence coefficient is generated;

[0057] Call the spatial mapping data corresponding to the virtual scene; based on the starting and ending coordinates of the displacement coordinate vector, perform discretized ray step detection in the spatial mapping data, extract the target voxel set covered by the displacement path, and count the proportion of the number of voxels in the target voxel set whose physical passage attribute is marked as blocked to the total number of voxels in the path, and generate the second anomaly confidence coefficient.

[0058] The first and second anomaly confidence coefficients are fused using a dynamic weighted algorithm to obtain a comprehensive anomaly score; abnormal data is identified, and a state rollback operation is performed on the virtual object.

[0059] The steps for receiving and parsing the sequence of interactive data frames include:

[0060] Establish a long-term communication channel between the server and the terminal device, and receive data packets encapsulated based on a binary serialization protocol; perform integrity verification and decryption processing on the data packets, and extract the global logical clock stamp and frame sequence number contained in the header; reassemble and sort out out-of-order data packets based on the frame sequence number, remove duplicate redundant frames, and construct an interactive data frame sequence with strictly increasing time sequence.

[0061] A sliding window buffer queue of a preset length is maintained for each terminal device. All continuous data points in the sliding window buffer queue are extracted, and the hardware event type, trigger timestamp, screen pixel coordinates and relative displacement of the input device are parsed through field mapping to form a set of input device sampling points.

[0062] The displacement coordinate vector is obtained by parsing the world coordinates, instantaneous velocity vector, and orientation quaternion of the virtual object in the physics engine.

[0063] Communication Establishment and Protocol Unpacking: The server listens on a specified port (e.g., UDP 8888) and establishes a long-lived connection channel based on the KCP or QUIC protocol. Received binary data packets are serialized and encapsulated using Google Protocol Buffers. First, the CRC32 checksum in the packet body is compared with the checksum in the packet header to ensure error-free transmission. Then, the data payload is decrypted using the AES-256 algorithm.

[0064] Timing reconstruction and deduplication: Parse the frame sequence number in the packet header; maintain a minimum heap buffer. When out-of-order data is received, it is temporarily stored in the heap without immediate processing (e.g., if frame 102 is received first, then frame 100); after a missing frame arrives or a timeout occurs, pop consecutive data frames from the top of the heap. If a duplicate sequence number is detected, the redundant frame is discarded.

[0065] Sliding window sampling: A circular buffer of length N is maintained for each client as a sliding window (e.g., N=60 frames, corresponding to approximately 1 second of data). The window is traversed, extracting the tuples and relative timestamps of mouse / touch events. The sampling rate is aligned using linear interpolation to form a set of input device sampling points. World coordinates, velocity vectors, and quaternions in the physical synchronization packet are parsed, and network latency compensation is performed using the server's global logical clock to correct the time reference of the displacement coordinate vector.

[0066] The uncertainty of network transmission can lead to discrepancies between the order in which data arrives and the order in which it is generated. Min-heap sort ensures that logical processing follows strict causality, preventing speed calculation errors caused by out-of-order processing. Single-frame data is sparse and accompanied by random noise. Sliding window, by accumulating historical data, significantly improves the signal-to-noise ratio of the signal, providing a statistically significant data foundation for feature extraction.

[0067] This invention solves the core technical challenge of misjudgments by anti-fraud systems caused by poor data quality in weak network environments by constructing a rigorous network data preprocessing mechanism. First, through a sequence number-based recombination and deduplication mechanism, it effectively eliminates the interference of network packet loss and out-of-order delivery on logical verification.

[0068] Secondly, the introduction of a sliding window buffer queue has significant technical value. In anti-fraud detection, a single data frame often contains only extremely small displacements or static states, lacking sufficient information to determine its behavioral attributes. This scheme utilizes a sliding window to aggregate data within a continuous time period, enabling subsequent algorithms to analyze based on complete action segments rather than isolated points, greatly improving the robustness of feature extraction.

[0069] Finally, by combining the network latency compensation mechanism of the global clock, the time deviation between the client and the server is eliminated, ensuring the precise alignment of the displacement vector and the input sampling point on the time axis. This avoids false instantaneous misjudgments caused by network latency and significantly improves the system's judgment accuracy and user experience.

[0070] The steps to construct a high-dimensional feature vector include:

[0071] The displacement sequence in the set of sampling points of the input device is denoised, and a reference motion trajectory representing the macroscopic intention is fitted using a zero-phase dual filter; the original displacement sequence is subtracted from the reference motion trajectory to obtain the micro residual sequence after removing the intention; the micro residual sequence is analyzed in the time domain to calculate the variance and autocorrelation coefficient to quantify the smoothness of the time domain trajectory.

[0072] The micro residual sequence is subjected to frequency domain transformation, the power spectral density is calculated and the energy proportion of high frequency components is extracted to quantize the frequency domain energy distribution;

[0073] The multi-scale entropy algorithm is applied to calculate the sample entropy values ​​of the residual sequence under different time scale factors, thereby quantifying the residual complexity of micro-operations.

[0074] The temporal trajectory smoothness, frequency domain energy distribution, and microscopic operation residual complexity are numerically normalized and then concatenated according to a preset dimensional order to form a high-dimensional feature vector describing the operator's physiological tremor characteristics.

[0075] The mathematical process of extracting biometric features from raw coordinate data includes:

[0076] Signal denoising and decomposition: The input is a displacement sequence within a sliding window; a zero-phase dual filter is used, first filtering the sequence in the forward direction, then filtering the result in the reverse direction; this eliminates the phase lag of conventional filters. The smoothed curve after filtering is defined as the baseline motion trajectory, representing the player's subjective intention.

[0077] The formula for obtaining the microscopic residual sequence is:

[0078] ;

[0079] in, Represents the microscopic residual sequence; Represents the original displacement sequence; It represents the baseline motion trajectory.

[0080] Multidimensional feature extraction:

[0081] Time domain dimension: Calculate the decay rate of the variance and autocorrelation function of the micro residual sequence.

[0082] Frequency domain dimension: Perform a Fast Fourier Transform with a Hanning window on the microscopic residual sequence to calculate the power spectral density. Integrate to extract the energy proportion of 8Hz-12Hz (the dominant frequency band of human physiological tremor).

[0083] Complexity dimension: Apply the multi-scale sample entropy algorithm, set the embedding dimension m=2, the tolerance r=0.15*std, and calculate the sequence of sample entropy values ​​with scale factors from 1 to 5.

[0084] Vectorization: All the above scalar features are Z-score standardized and concatenated in a fixed order to form a multidimensional feature vector.

[0085] When human skeletal muscles maintain posture or movement, they are inevitably accompanied by minute, quasi-periodic physiological tremors due to the discrete nature of control signals from the nervous system. These tremors have extremely stable statistical characteristics in the frequency domain (8-12Hz) and entropy (complexity), serving as the fingerprint of carbon-based organisms.

[0086] Signal processing principle: Trajectories generated by machine scripts are usually perfect mathematical curves with extremely low entropy; or they may be superimposed with pseudo-random white noise, resulting in high entropy but uniform distribution across the entire frequency band. Through joint time-frequency domain analysis, biological tremors and algorithmic noise can be accurately distinguished.

[0087] This invention introduces bidirectional filtering technology to solve the phase lag problem caused by traditional filtering. In fast-paced competitive games, players often make sharp turns. Ordinary filtering misinterprets these macroscopic sharp turns as microscopic high-frequency jitter, leading to feature distortion. Bidirectional filtering ensures zero deviation between the baseline trajectory and the original trajectory on the time axis, thereby separating a highly pure microscopic residual sequence. Furthermore, by fusing temporal smoothness, frequency domain energy proportion, and multi-scale entropy values, a highly orthogonal high-dimensional feature vector is constructed. This combination of multi-dimensional perspectives makes it difficult for attackers to deceive the system using simple fitting algorithms. Even if cheats simulate random jitter, they cannot simultaneously satisfy the energy concentration characteristics of a specific frequency band and the entropy decay law at a specific scale, significantly improving the system's defense against advanced anthropomorphic scripts.

[0088] The training and generation process of pre-stored high-density behavioral clusters in the behavioral feature space includes:

[0089] During the offline phase, historical operation logs of users confirmed to be non-cheating users are collected as a positive sample dataset; a feature extraction step is performed on the positive sample dataset to obtain a set of historical feature vectors.

[0090] Principal component analysis (PCA) is used to reduce the dimensionality of the historical feature vector set, retaining principal components whose cumulative variance contribution rate exceeds a preset threshold. The dimensionality-reduced data is then input into a density-based spatial clustering algorithm model for unsupervised training. Through iterative calculation, high-density regions with a sample point distribution density greater than a preset core density are identified. The identified high-density regions are fitted with a multidimensional Gaussian distribution to construct a parameterized probability density model, and the fitted model region is defined as a high-density behavioral cluster. The geometric center position, boundary contour radius, and covariance matrix of the high-density behavioral clusters are calculated and stored as benchmark parameters for online determination.

[0091] Sample set construction: Extract user data from historical logs that have been manually verified or have a high long-term reputation score.

[0092] PCA dimensionality reduction: Principal component analysis is performed on the high-dimensional feature set; the eigenvalues ​​of the covariance matrix are calculated, and the top-ranked principal components are selected so that the cumulative variance contribution rate is >95%; this removes redundancy between features, such as the correlation between velocity and acceleration.

[0093] Density clustering: Input the dimensionality-reduced data into the DBSCAN algorithm. Set the neighborhood radius and minimum number of points; the algorithm clusters high-density regions into core clusters and marks low-density outliers as noise.

[0094] Gaussian mixture modeling: For the identified largest core cluster, a multidimensional Gaussian distribution is used for fitting. The mean vector of the cluster is calculated to represent its geometric center; the covariance matrix is ​​calculated to represent the shape and orientation of the cluster; and the boundary threshold of the Mahalanobis distance is calculated, typically taking a threshold value of [value missing]. The 0.99 quantile of the distribution.

[0095] Unsupervised learning does not require collecting various external samples; instead, it defines anomalous data by learning what is normal. Any data point falling outside the normal distribution is considered an anomaly.

[0096] The covariance matrix describes the correlation between features; for example, normal people often have low accuracy at high speeds, and the covariance matrix can capture this correlation, forming an ellipsoidal distribution boundary, which is more accurate than a simple spherical boundary.

[0097] This invention addresses the problems of high maintenance costs and significant lag in traditional rule-based anti-cheating systems by introducing unsupervised learning and statistical modeling techniques. Traditional blacklist methods require writing specific detection code for each new cheat, such as detecting specific memory characteristics, which always lags behind cheat updates.

[0098] This solution employs a positive sample modeling approach, constructing high-density clusters by learning from the behavioral patterns of massive numbers of normal players, thus defining the boundaries of legitimate operations. Any unseen cheating behavior, as long as its feature distribution deviates from human physiological limits or statistical regularities, will automatically fall into the abnormal region, thereby achieving defense against unknown threats. Furthermore, the combination of PCA dimensionality reduction and multidimensional Gaussian fitting not only reduces the curse of dimensionality in online computation but also replaces massive sample storage with parameterized storage, significantly saving server memory and making it possible to support large-scale concurrent detection with limited resources.

[0099] The steps for generating the first anomaly confidence coefficient include:

[0100] The constructed high-dimensional feature vectors are projected into the same low-dimensional subspace as the high-density behavioral clusters;

[0101] Read the pre-stored covariance matrix and its inverse matrix, calculate the Mahalanobis distance between the high-dimensional feature vector and the geometric centroid of the cluster; input the calculated Mahalanobis distance into a preset nonlinear activation function, which is configured to output a value close to zero when the Mahalanobis distance is less than the boundary contour radius of the cluster, and output a value that increases exponentially with distance when the Mahalanobis distance exceeds the boundary contour radius.

[0102] The output of the nonlinear activation function is truncated and mapped to a closed interval between 0 and 1, which serves as the first anomaly confidence coefficient characterizing the degree to which the input behavior deviates from normal features.

[0103] Spatial projection: Projecting the real-time acquired feature vectors onto the PCA subspace.

[0104] Mahalanobis distance calculation: Read the trained mean and covariance matrices. Use a linear algebra library, such as BLAS, to calculate the squared Mahalanobis distance.

[0105] Nonlinear mapping, defining a nonlinear activation function;

[0106] ;

[0107] in, Represents a non-linear activation function; Indicates Mahalanobis distance; Represents the boundary radius of the cluster; This represents the growth rate parameter, used to control the slope of the exponential function, and is determined through learning and optimization based on historical data.

[0108] Normalized output: The final output is the first anomaly confidence coefficient.

[0109] Mahalanobis distance is a generalization of Euclidean distance. Euclidean distance assumes that each feature dimension is independent and identically distributed (i.e., circular distribution), while Mahalanobis distance considers the correlation between features (i.e., elliptical distribution). In anti-fraud scenarios, features are often highly correlated, such as mouse movement distance and time. Using Mahalanobis distance can effectively eliminate the influence of dimensions and provide a standardized measure of outliers. Non-linear activation functions map unbounded distance values ​​to bounded probability values, facilitating subsequent fusion.

[0110] In this invention, the distribution of normal behavior in a multidimensional feature space often resembles a tilted ellipsoid. Using Euclidean distance might misjudge normal extreme actions along the major axis of the ellipsoid as abnormal, or miss minor cheating along the minor axis. Mahalanobis distance, by introducing the inverse of the covariance matrix, essentially whitens the feature space, making the distance metric reflect the actual distribution density of the data. Combined with the design of a nonlinear activation function, a tolerant judgment mechanism is constructed: zero penalty is applied to fluctuations within the cluster boundaries, while once the boundaries are crossed, the anomaly coefficient increases exponentially. This design protects both skilled players with unique styles and maintains extremely high sensitivity to obvious outliers and cheaters.

[0111] The process of constructing the spatial mapping data includes:

[0112] During the virtual scene initialization and loading phase, a 3D bounding box covering the entire scene is created and divided into a cubic voxel mesh with fixed side lengths.

[0113] Iterate through all static terrain and building geometric model data in the scene, and use the separating axis theorem to detect the spatial overlap between each voxel mesh and the geometric model; if there is an overlap, mark the corresponding index position of the voxel mesh in the three-dimensional Boolean array as a true value, representing a physically impassable blocking state; if there is no overlap, mark it as a false value, representing an air-passable state.

[0114] The three-dimensional Boolean array is compressed and stored using a sparse octree data structure and loaded into the server's high-speed cache memory to form a discretized voxel grid index for fast collision detection.

[0115] Spatial discretization: Initialize a 3D mesh based on the scene's AABB bounding box.

[0116] Separating Axis Theorem Detection: Traverse the static meshes (terrain, walls) in the scene. For each voxel cube, use the separating axis theorem algorithm to detect whether it overlaps with triangular faces.

[0117] If there is overlap, the flag bit is set to 1 (blocking).

[0118] If there is no overlap, the flag bit is set to 0 (pass).

[0119] Sparse octree storage: Since the scene is mostly air, using a three-dimensional array for storage is extremely wasteful. Constructing a sparse octree: If all eight child nodes of a node are 0, prune that node and only store its parent node pointer. Serialize the generated sparse octree storage into a binary stream and load it into the L2 / L3 cache when the server starts.

[0120] Real-time physics engines are extremely expensive for mesh collision detection, involving floating-point operations and triangular facet traversal; voxelization transforms the geometric problem into a memory addressing problem.

[0121] The separating axis theorem is a standard algorithm for collision detection of convex polyhedra. It ensures that even the slightest overlap is detected, thus guaranteeing the conservatism of the voxel map.

[0122] Traditional anti-cheat systems are often limited by server CPU performance, making it impossible to perform 3D collision detection on all players. They can only use sampling detection or simple distance verification, leaving opportunities for "wallhack" cheats.

[0123] This invention transforms the complex intersection operation of triangular faces into a simple octree index query through voxelization preprocessing, reducing the time complexity of a single collision query to logarithmic or even constant time. Furthermore, the use of a sparse octree structure for compressed storage reduces memory usage and improves CPU cache hit rate. This allows the server to perform detailed physical path obstruction detection on tens of thousands of players simultaneously under extremely low load, achieving full-coverage, blind-spot-free defense under high concurrency.

[0124] The steps for performing discretized ray step detection include:

[0125] Establish a voxel coordinate system with the origin of the virtual scene as the reference, and convert the starting and ending coordinate points of the displacement coordinate vector into the corresponding starting and ending voxel indices.

[0126] Calculate the unit direction vector along the ray direction and determine the step increment required for the ray to cross the voxel boundary in the three coordinate axis directions; using a three-dimensional digital differential analysis algorithm, starting from the initial voxel index, iterate through adjacent voxels along the ray direction until the termination voxel index is reached.

[0127] During each iteration, the index of the voxel currently traversed is recorded in a temporary list, and the temporary list is used as the set of target voxels covered by the displacement path.

[0128] Phase 1: Quantization transformation of coordinate space;

[0129] Establish a voxel coordinate system: First, define the world origin of the virtual scene as the reference point, and set the unit side length of the voxel grid, for example, 0.5 meters.

[0130] Coordinate mapping: Convert world coordinates to grid index to obtain the starting and ending coordinate points in the displacement coordinate vector. Divide the three components (X, Y, Z) of these two coordinate points by the unit side length of a voxel and round the result down. For example, if the side length is 0.5 meters and the coordinates are 10.7 meters, the converted starting voxel index is 21, which is the 21st grid. This step determines the discrete starting and ending points of the ray in the grid.

[0131] Second stage: Initialization of ray stepping parameters;

[0132] Calculate direction and step sign: Calculate the direction vector from the starting coordinate point to the ending coordinate point, and normalize it to convert it into a unit vector of length 1. Determine the step direction sign based on the sign of the unit vector on the three axes. If the X-axis component is positive, the X-axis step direction is +1; if it is negative, it is -1. This step determines whether the ray moves forward or backward.

[0133] Calculate the single-axis span increment: Calculate the increment of the ray's physical length required to move one voxel unit in each coordinate axis direction. Specifically, take the absolute value of the reciprocal of each component of the unit direction vector. This value represents how far the ray actually needs to travel in space to span one grid boundary on the X-axis. It should be noted that if a component approaches zero, the step size increment corresponding to that component is set to the maximum value allowed by the computer to avoid division by zero errors.

[0134] Calculate the initial boundary distance: Calculate the physical distance from the ray to the first boundary wall of the current starting voxel from the starting coordinates, as the initial cumulative value for the iteration loop.

[0135] Third stage: Iterative traversal;

[0136] Minimum distance selection: Enter the loop logic and compare the current cumulative distance of the boundary along the X, Y, and Z axes. If the cumulative distance along the X axis is the smallest, it means that the ray will hit the grid wall in the X-axis direction first; if the cumulative distance along the Y or Z axis is the smallest, the same judgment is made.

[0137] Single-step advancement and update: Select the axis with the smallest cumulative distance (let's say the X-axis) and perform the step operation:

[0138] Index update: Add the budgeted step direction sign (+1 or -1) to the current voxel index on the X-axis, and move to the next adjacent voxel;

[0139] Distance update: Increase the current cumulative distance of the X-axis boundary by a single-axis crossing increment, and set the target distance for the next wall crossing;

[0140] Path recording: Whenever a new voxel index is entered, the index (containing three integer components X, Y, and Z) is immediately added to a temporary list of the target voxel set. This list is used for subsequent collision attribute queries.

[0141] Termination condition check: After each step, check if the current voxel index is equal to the index of the discrete endpoint. If they are equal, it means the ray has reached the endpoint, and the loop ends; if they are not equal, repeat the minimum distance selection step.

[0142] Fourth stage: Output of results;

[0143] After the loop ends, the generated target voxel set, which is a list containing all the cube mesh IDs passed along the ray path, is passed as the final output to the next level module to query the physical accessibility properties, i.e., to determine whether it passes through a wall.

[0144] Furthermore, to address the issue that a single ray cannot adequately represent a volumetric object, this invention can supplement and improve the single ray by employing bounding box multi-point detection or collision radius compensation; this includes establishing a voxel coordinate system based on the origin of the virtual scene; calculating the axis-aligned bounding box (AABB) corresponding to the displacement coordinate vector based on the collision volume radius of the virtual object; extracting the geometric center and vertex coordinates of the bounding box, and converting them into the corresponding start voxel index and end voxel index sets, respectively.

[0145] In conventional detection methods, if a player moves extremely fast, a simple start-to-end detection might skip over the thin wall in the middle, making wall-clipping cheats undetectable.

[0146] The 3D DDA algorithm employed in this invention guarantees strict topological continuity. Regardless of the displacement span, the algorithm traverses every voxel unit along the path. Furthermore, this algorithm avoids complex floating-point trigonometric function operations, relying primarily on simple comparison and addition operations, resulting in extremely high execution efficiency. Combined with voxel indexing, it can complete a long-distance penetration detection within microseconds. This not only ensures the rigor of anti-cheating measures but also guarantees that the detection logic does not consume excessive server tick time, ensuring the smooth operation of the main game logic.

[0147] The steps for generating the second anomaly confidence coefficient include:

[0148] The target voxel set is traversed, and the Boolean attribute value in the spatial mapping data is directly read according to the index of each voxel. A collision counter is set, and whenever a Boolean attribute value is detected as a true value representing the blocking state, the counter value is incremented, and different weights are assigned according to the position of the voxel in the path. The weight of voxels in the middle of the path is higher than that of voxels at the endpoints to tolerate edge errors. The weighted penetration rate is obtained by calculating the ratio of the total number of collision counts after weighting to the total number of voxels in the target voxel set.

[0149] The weighted penetration rate is mapped to the second anomaly confidence coefficient using a pre-defined piecewise linear function.

[0150] Traversal query: Traverse the output set of voxels, query the octree to get the blocking state of each voxel, which is 0 or 1.

[0151] Weight assignment: Define the path length as L, and for the k-th voxel, the distance from the starting point... Calculate weights Using the trapezoidal function, in <0.1L or >0.9L, meaning it's in the region near the endpoint, weight =0.1; in the middle region, i.e. Located in [0.1, 0.9], weight =1.0.

[0152] Furthermore, the formula for calculating penetration rate is:

[0153] ;

[0154] in, This represents the weighted penetration rate; Indicates weight; Indicates the blocking state parameter, when When =1, it indicates that it is in a blocked state; when When =0, it indicates that the system is in an unblocked state.

[0155] The formula for mapping the weighted penetration rate to the second anomaly confidence coefficient using a piecewise linear function is as follows:

[0156] ;

[0157] in, This represents the confidence coefficient for the second anomaly.

[0158] In actual online games, due to the slight time difference between client prediction and server synchronization, player characters often experience slight clipping issues at corners or edges of obstacles. If a rigid logic of banning accounts for touching walls is adopted, many legitimate players will be wrongly penalized due to network lag.

[0159] This scheme uses location-related dynamic weight allocation to assign extremely low penalty weights to collisions at both ends of the path, treating them as reasonable synchronization errors, while assigning high weights to obstacles in the middle of the path, treating them as insurmountable anomalous data features. This design endows the system with semantic-level judgment capabilities, enabling it to accurately identify truly anomalous data.

[0160] The dynamic weighting algorithm for fusion calculation includes:

[0161] Read the relative position density of the current high-dimensional feature vector in the behavioral feature space. If it is lower than the density of the core region but higher than the density of the sparse region, it is determined to be a fuzzy zone. At this time, the influence of the first anomaly confidence coefficient on the result is reduced by decreasing the weight factor, and the weight factor of the second anomaly confidence coefficient is increased accordingly. The weighted sum of the two is calculated as the comprehensive anomaly score.

[0162] Density interval partitioning: During the offline training phase, based on the statistical distribution of high-density behavioral clusters, two key Mahalanobis distance thresholds are set:

[0163] The core threshold, covering the boundary of approximately 68% of normal samples, represents the typical normal behavior area.

[0164] The sparse threshold, covering the boundary of approximately 99.7% of normal samples, represents the dividing line between normal and abnormal.

[0165] Real-time region determination: Obtain the Mahalanobis distance between the current high-dimensional feature vector and the cluster centroid; if the Mahalanobis distance is less than or equal to the core threshold, it is determined to be a core high-density region, i.e., normal; if the Mahalanobis distance is greater than the sparsity threshold, it is determined to be an outlier sparse region, i.e., highly suspected anomaly; if the Mahalanobis distance is between the core threshold and the sparsity threshold, it is determined to be an edge-ambiguous zone.

[0166] Dynamic weight adjustment: The initial weight factor is preset to the behavior weight. Weighting the confidence coefficient of the second anomaly; and the physical weights. The confidence coefficient of the second anomaly is weighted, and + =1.

[0167] When a feature vector is detected to fall into a blurred edge zone, the weight correction function is triggered:

[0168] ;

[0169] ;

[0170] in, , This represents the modified behavioral and physical weights; Indicates the correction factor, for example =0.5.

[0171] Implementation logic: At this point, the system considers the behavioral characteristics to be ambiguous, that is, like a script or a high-level player. Therefore, it automatically reduces the weight of the behavioral score, that is, the first abnormal confidence level, and instead relies more strictly on the physical collision detection results for the last resort judgment, that is, the second abnormal confidence level.

[0172] Overall score calculation: Perform the final linear weighted summation;

[0173] Traditional anti-fraud systems typically employ a one-size-fits-all approach with fixed weights. However, behavioral analysis is inherently probabilistic inference, which involves uncertainty; while physical verification is essentially deterministic verification.

[0174] When the confidence level of probabilistic inference decreases, i.e., when the data point is located at the edge of the cluster and the density is sparse but not completely out of the cluster, according to the principles of information theory, the decision system should reduce the weight of the information source and increase the weight of the physical laws of the deterministic information source in order to maintain the reliability of the overall decision.

[0175] This invention addresses the dilemma in anti-cheating systems—between misjudging high-level players and overlooking minor cheating attempts—by introducing a density-based adaptive weight adjustment mechanism, achieving a balance between robustness and fairness in the judgment logic. In virtual games, the operational characteristics of high-level players often fall on the edge of normal clusters, i.e., in a gray area. Using fixed weights can easily lead to misjudgments of scripting due to their high frequency of actions. This solution intelligently identifies this ambiguous state, automatically reducing the weight of behavioral analysis to avoid incorrect judgments of borderline users. Simultaneously, this mechanism does not reduce the system's defense capabilities; while reducing behavioral weights, it automatically increases the weight of physical verification.

[0176] If a user exhibits suspicious script-like behavior along with minor physical wall-clipping or illegal displacement, these actions will be quickly detected and flagged as abnormal by the amplified physical weighting. This ensures that the system can always make the optimal decision based on the most logical probability when faced with complex and ever-changing cheating methods.

[0177] Example 2:

[0178] An abnormal data processing system for a virtual game, the structure of which is as follows: Figure 3 As shown, it includes:

[0179] The data acquisition module receives the sequence of interactive data frames uploaded by the terminal device, and parses and obtains the set of input device sampling points containing time information and the displacement coordinate vector of the virtual object in the three-dimensional scene;

[0180] The first identification module extracts features from the set of sampling points of the input device to construct a high-dimensional feature vector representing the current operation behavior; maps the high-dimensional feature vector to a preset behavior feature space, calculates the multidimensional statistical distance of the high-dimensional feature vector in the behavior feature space, and generates the first anomaly confidence coefficient.

[0181] The second identification module calls the spatial mapping data corresponding to the virtual scene; based on the starting and ending coordinates of the displacement coordinate vector, it performs discretized ray step detection in the spatial mapping data, extracts the target voxel set covered by the displacement path, and counts the proportion of the number of voxels in the target voxel set whose physical passage attribute is marked as blocked to the total number of voxels in the path, and generates the second anomaly confidence coefficient.

[0182] The anomaly detection module calculates a comprehensive anomaly score by fusing the first anomaly confidence coefficient and the second anomaly confidence coefficient using a dynamic weighted algorithm. Based on the comprehensive anomaly score, it determines that the data frame sequence is abnormal data and performs a state rollback operation on the virtual object.

[0183] This system is deployed on a high-performance computing cluster in the cloud, and its physical architecture includes:

[0184] Computation layer: A multi-core CPU server (such as Intel Xeon Platinum 8380) is used to accelerate the FFT transformation and Mahalanobis distance matrix operation in the first recognition module by utilizing its AVX-512 instruction set.

[0185] Storage layer: Configure large-capacity DDR4 memory (e.g., 512GB) for sparse octree (SVO) voxel index data required by the second identification module, ensuring that physical collision queries achieve nanosecond-level response.

[0186] Network layer: Equipped with a 10 Gigabit Ethernet card (10GbE), it bypasses the operating system kernel and directly processes high-concurrency UDP packets of the data acquisition module through DPDK technology.

[0187] Cache layer: Maintains a circular snapshot buffer to store valid state snapshots of all objects within the past T seconds (e.g., T=5 seconds), serving the state rollback of the exception judgment module.

[0188] To verify the effectiveness of the technical solution in this application, a stress test containing 5000 concurrent objects was constructed in a simulation environment. The test dataset included 4000 normal human operation samples and 1000 mixed data anomalous samples. Experimental group settings:

[0189] Control Group 1: Fixed threshold detection method was used; Rule 1: Movement speed > 15 m / s was considered abnormal; Rule 2: Mouse clicks > 12 per second were considered abnormal. Control Group 2: Behavior-based judgment: Only the first identification module of this application was used, clustering Mahalanobis distance was employed, and judgment was made based on the first anomaly confidence coefficient. Control Group 3: The second identification module of this application, voxel ray detection, was used. Experimental Group: The fusion method of this application was used, employing the complete system, including a dynamic weighting algorithm.

[0190] After verifying the data using the above four methods, the resulting data table is shown in Table 1.

[0191] Table 1 Comparative Experimental Data

[0192]

[0193] The false alarm rate of control group 1 was as high as 12.4%, mainly because it could not distinguish between instantaneous high speed caused by network lag and teleportation by cheats. It was almost completely ineffective for fine-tuning cheats that simulated human operation, with a recall rate of only 45%.

[0194] Control group 2 performed well in recognizing automated scripts, but it could not recognize pure memory modification and wall-clipping that did not involve mouse input at all, and it was prone to misjudgment when the player was at the edge of the cluster.

[0195] Control group 3 was able to accurately intercept wall-penetrating behavior with extremely high accuracy, but it was completely powerless against automatic shooting or recoil-free shooting that did not violate the laws of physics, resulting in an extremely low overall recall rate.

[0196] The experimental group used a dual-channel complementary approach to capture script features (behavioral layer) and block illegal displacements (physical layer), increasing the recall rate to 97.5%.

[0197] To verify the recognition stability of the system described in this application when facing large-scale concurrency and dynamic changes in data distribution, this embodiment designed multiple random sampling tests for 5000 concurrent objects. This test aims to demonstrate that the combination of the dynamic weighting algorithm and the dual-channel verification mechanism in this application can maintain extremely low variance in recognition accuracy under different sample distributions, i.e., high stability.

[0198] Step S1: Random sampling;

[0199] Using a random number generator, 1000 objects are randomly selected without replacement from a pool of 5000 objects as the sample set for a single test. The random seed is reset before each sampling to ensure the randomness of the sample distribution in each round, meaning that the specific proportion of normal / abnormal samples in each round will fluctuate naturally.

[0200] Step S2: Data input and parsing;

[0201] The sampled data frame sequence of 1000 objects is input into the system's data acquisition module. The system parses and acquires the time information, the set of sampling points, and the displacement coordinate vector.

[0202] Step S3: Dual-channel parallel recognition;

[0203] Behavioral channel: The first identification module calculates a high-dimensional feature vector and maps it to the behavioral feature space to generate the first anomaly confidence coefficient.

[0204] Physical channel: The second identification module performs discretized ray step detection in the voxel grid, calculates the weighted penetration rate, and generates the second anomaly confidence coefficient.

[0205] Step S4: Dynamic weighted fusion;

[0206] Based on the density distribution of the feature vectors, a comprehensive anomaly score is calculated using a dynamic weighted algorithm. The criterion is that a comprehensive anomaly score > 0.85 is considered abnormal; otherwise, it is considered normal.

[0207] Step S5: Results statistics and cleaning;

[0208] The system's judgment results are compared with the true labels in the dataset, and the recognition accuracy is calculated as: (number of correctly identified normals + number of correctly identified outliers) / total number of samples. After recording the data, the objects are put back into the pool to prepare for the next round of sampling.

[0209] After the above steps, the system stability test data is shown in Table 2; the changes in the recognition accuracy of the method and system described in this invention are as follows: Figure 4 As shown.

[0210] Table 2 Stability Test Data

[0211]

[0212] With the proportion of abnormal samples fluctuating from 19.0% to 21.5%, the system's recognition accuracy remained stable between 98.4% and 99.1%, with a standard deviation of only 0.21%; this indicates that the system performance was not significantly affected by changes in the random distribution of samples.

[0213] In summary, this application significantly improves the accuracy of abnormal data identification by integrating system-level hardware and software collaboration with multi-dimensional algorithms, while ensuring real-time performance, and effectively solves the problem of misjudgment in traditional solutions.

[0214] It should be understood that the embodiments disclosed in this invention and the above description enable those skilled in the art to implement this invention. However, this invention is not limited to the embodiments mentioned above. It should be understood that those skilled in the art can still modify the technical solutions described in the foregoing embodiments or make equivalent substitutions for some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this invention, and should all be included within the protection scope of this invention.

Claims

1. A method for handling abnormal data in a virtual game, characterized in that, The method includes: Receive the sequence of interactive data frames uploaded by the terminal device, and parse them to obtain the set of input device sampling points containing time information and the displacement coordinate vector of the virtual object in the three-dimensional scene; Feature extraction is performed on the set of sampling points of the input device to construct a high-dimensional feature vector representing the current operation behavior; the high-dimensional feature vector is mapped to a preset behavior feature space, the multidimensional statistical distance of the high-dimensional feature vector in the behavior feature space is calculated, and the first anomaly confidence coefficient is generated; Call the spatial mapping data corresponding to the virtual scene; based on the starting and ending coordinates of the displacement coordinate vector, perform discretized ray step detection in the spatial mapping data, extract the target voxel set covered by the displacement path, and count the proportion of the number of voxels in the target voxel set whose physical passage attribute is marked as blocked to the total number of voxels in the path, and generate the second anomaly confidence coefficient. The process of constructing the spatial mapping data includes: During the virtual scene initialization and loading phase, a 3D bounding box covering the entire scene is created and divided into a cubic voxel mesh with fixed side lengths. Iterate through all static terrain and building geometric model data in the scene, and use the separating axis theorem to detect the spatial overlap between each voxel mesh and the geometric model; if there is an overlap, mark the corresponding index position of the voxel mesh in the three-dimensional Boolean array as a true value, representing a physically impassable blocking state; if there is no overlap, mark it as a false value, representing an air-passable state. The three-dimensional Boolean array is compressed and stored using a sparse octree data structure and loaded into the server's high-speed cache memory to form a discretized voxel grid index for fast collision detection. The steps for performing discretized ray step detection include: Establish a voxel coordinate system with the origin of the virtual scene as the reference, and convert the starting and ending coordinate points of the displacement coordinate vector into the corresponding starting and ending voxel indices. Calculate the unit direction vector along the ray direction and determine the step increment required for the ray to cross the voxel boundary in the three coordinate axis directions; using a three-dimensional digital differential analysis algorithm, starting from the initial voxel index, iterate through adjacent voxels along the ray direction until the termination voxel index is reached. During each iteration, the index of the voxel being traversed is recorded in a temporary list, and the temporary list is used as the set of target voxels covered by the displacement path. The first and second anomaly confidence coefficients are fused using a dynamic weighted algorithm to obtain a comprehensive anomaly score; abnormal data is identified, and a state rollback operation is performed on the virtual object.

2. The method for handling abnormal data in a virtual game as described in claim 1, characterized in that, The steps for receiving and parsing the sequence of interactive data frames include: Establish a long-term communication channel between the server and the terminal device, and receive data packets encapsulated based on a binary serialization protocol; perform integrity verification and decryption processing on the data packets, and extract the global logical clock stamp and frame sequence number contained in the header; reassemble and sort out out-of-order data packets based on the frame sequence number, remove duplicate redundant frames, and construct an interactive data frame sequence with strictly increasing time sequence. A sliding window buffer queue of a preset length is maintained for each terminal device. All continuous data points in the sliding window buffer queue are extracted, and the hardware event type, trigger timestamp, screen pixel coordinates and relative displacement of the input device are parsed through field mapping to form a set of input device sampling points. The displacement coordinate vector is obtained by parsing the world coordinates, instantaneous velocity vector, and orientation quaternion of the virtual object in the physics engine.

3. The method for handling abnormal data in a virtual game as described in claim 2, characterized in that, The steps to construct a high-dimensional feature vector include: The displacement sequence in the set of sampling points of the input device is denoised, and a reference motion trajectory representing the macroscopic intention is fitted using a zero-phase dual filter; the original displacement sequence is subtracted from the reference motion trajectory to obtain the micro residual sequence after removing the intention; the micro residual sequence is analyzed in the time domain to calculate the variance and autocorrelation coefficient to quantify the smoothness of the time domain trajectory. The microscopic residual sequence is subjected to frequency domain transformation to calculate the power spectral density and extract the energy proportion of high-frequency components, thus quantifying the frequency domain energy distribution. A multi-scale entropy algorithm is applied to calculate the sample entropy values ​​of the residual sequence under different time scale factors, thus quantifying the microscopic operation residual complexity. The time domain trajectory smoothness, frequency domain energy distribution, and microscopic operation residual complexity are numerically normalized and then concatenated according to a preset dimensional order to form a high-dimensional feature vector describing the physiological tremor characteristics of the operator.

4. The abnormal data processing method for a virtual game as described in claim 1, characterized in that, The training and generation process of pre-stored high-density behavioral clusters in the behavioral feature space includes: During the offline phase, historical operation logs of users confirmed to be non-cheating users are collected as a positive sample dataset; a feature extraction step is performed on the positive sample dataset to obtain a set of historical feature vectors. Principal component analysis (PCA) is used to reduce the dimensionality of the historical feature vector set, retaining principal components whose cumulative variance contribution rate exceeds a preset threshold. The dimensionality-reduced data is then input into a density-based spatial clustering algorithm model for unsupervised training. Through iterative calculation, high-density regions with a sample point distribution density greater than a preset core density are identified. The identified high-density regions are fitted with a multidimensional Gaussian distribution to construct a parameterized probability density model, and the fitted model region is defined as a high-density behavioral cluster. The geometric center position, boundary contour radius, and covariance matrix of the high-density behavioral clusters are calculated and stored as benchmark parameters for online determination.

5. The abnormal data processing method for a virtual game as described in claim 4, characterized in that, The steps for generating the first anomaly confidence coefficient include: The constructed high-dimensional feature vectors are projected into the same low-dimensional subspace as the high-density behavioral clusters; Read the pre-stored covariance matrix and its inverse matrix, calculate the Mahalanobis distance between the high-dimensional feature vector and the geometric centroid of the cluster; input the calculated Mahalanobis distance into a preset nonlinear activation function, which is configured to output a value close to zero when the Mahalanobis distance is less than the boundary contour radius of the cluster, and output a value that increases exponentially with distance when the Mahalanobis distance exceeds the boundary contour radius. The output of the nonlinear activation function is truncated and mapped to a closed interval between 0 and 1, which serves as the first anomaly confidence coefficient characterizing the degree to which the input behavior deviates from normal features.

6. The abnormal data processing method for a virtual game as described in claim 1, characterized in that, The steps for generating the second anomaly confidence coefficient include: The target voxel set is traversed, and the Boolean attribute value in the spatial mapping data is directly read according to the index of each voxel. A collision counter is set, and whenever a Boolean attribute value is detected as a true value representing the blocking state, the counter value is incremented, and different weights are assigned according to the position of the voxel in the path. The weight of voxels in the middle of the path is higher than that of voxels at the endpoints to tolerate edge errors. The weighted penetration rate is obtained by calculating the ratio of the total number of collision counts after weighting to the total number of voxels in the target voxel set. The weighted penetration rate is mapped to the second anomaly confidence coefficient using a pre-defined piecewise linear function.

7. The method for handling abnormal data in a virtual game as described in claim 1, characterized in that, The dynamic weighting algorithm for fusion calculation includes: Read the relative position density of the current high-dimensional feature vector in the behavioral feature space. If it is lower than the density of the core region but higher than the density of the sparse region, it is determined to be a fuzzy zone. At this time, the influence of the first anomaly confidence coefficient on the result is reduced by decreasing the weight factor, and the weight factor of the second anomaly confidence coefficient is increased accordingly. The weighted sum of the two is calculated as the comprehensive anomaly score.

8. An abnormal data processing system for a virtual game, characterized in that, A method for handling abnormal data in a virtual game according to any one of claims 1 to 7 includes: The data acquisition module receives the sequence of interactive data frames uploaded by the terminal device, and parses and obtains the set of input device sampling points containing time information and the displacement coordinate vector of the virtual object in the three-dimensional scene; The first identification module extracts features from the set of sampling points of the input device to construct a high-dimensional feature vector representing the current operation behavior; maps the high-dimensional feature vector to a preset behavior feature space, calculates the multidimensional statistical distance of the high-dimensional feature vector in the behavior feature space, and generates the first anomaly confidence coefficient. The second identification module calls the spatial mapping data corresponding to the virtual scene; based on the starting and ending coordinates of the displacement coordinate vector, it performs discretized ray step detection in the spatial mapping data, extracts the target voxel set covered by the displacement path, and counts the proportion of the number of voxels in the target voxel set whose physical passage attribute is marked as blocked to the total number of voxels in the path, and generates the second anomaly confidence coefficient. The anomaly detection module calculates a comprehensive anomaly score by fusing the first anomaly confidence coefficient and the second anomaly confidence coefficient using a dynamic weighted algorithm. Based on the comprehensive anomaly score, it determines that the data frame sequence is abnormal data and performs a state rollback operation on the virtual object.

Images