A method and system for building a mobile game security platform based on big data

Abstract

The present invention discloses a method and system for constructing a mobile game security platform based on big data. The method collects mobile game client data, mobile game server data, and mobile game security crawler data; uses a distributed log collection system to collect the collected data and stores it in a distributed file system; uses a tree integration model and a neural network model to train the collected data stored in the distributed file system to generate a mobile game security model for identifying abnormal behaviors in the game. The technical solution provided by the present invention can identify mobile game security issues with unknown patterns, solves the problem of data islands, has good self-learning capabilities, and improves the reliability and scalability of the mobile game security platform.

Description

Technical Field

[0001] The present invention relates to the field of mobile phone game security, and in particular to the construction of a mobile phone game security platform based on big data. Background Art

[0002] With the advancement of network technology and the popularity of smart phones, the mobile game industry has developed rapidly and the mobile game market has become more prosperous. Behind the booming mobile game market, there are many hidden mobile game security issues: plug-ins, power leveling, account theft, illegal information and other mobile game security issues are emerging in an endless stream, infringing the interests of the majority of players and game manufacturers. For example: With the popularity of tactical games in the past two years, the number of mobile game plug-ins has increased 10 times, and the plug-in black industry has become more industrialized, and has shown trends such as platformization, customization and hardwareization.

[0003] Currently, there are technologies such as mobile game hardening and mobile game anti-cheating to solve these mobile game security issues. However, these technical means are increasingly unable to adapt to existing security challenges.

[0004] Existing solutions also analyze cheats and gold-farming studios that endanger game security based on the detection and reporting of cheat feature values ​​on the client and the user behavior on the server. However, existing solutions are based on rules set by experience and cannot identify cheats with unknown patterns. Moreover, existing cheat identification often requires consideration of a large number of feature fields. As far as feature rules are concerned, cheat patterns can only be judged from the perspective of each single feature, and the interaction between different features cannot be considered. In addition, existing solutions collect data in a small number of dimensions and in a single field, and cannot perform multi-dimensional correlation operations. Summary of the invention

[0005] The present invention provides a method for constructing a mobile game security platform based on big data, the method comprising the following steps: collecting mobile game client data, mobile game server data and mobile game crawler data; storing the collected data in a distributed file system; using a tree integration model and a neural network model to train the collected data to generate mobile game security models for identifying abnormal behaviors in games.

[0006] Furthermore, the collection of mobile game client data, mobile game server data, and mobile game crawler data includes: integrating the mobile game security SDK in the mobile game client to collect client data; using direct streaming protocol analysis or mirroring tools to collect server data for the mobile game server. Use crawler technology to monitor game forums and security technology website forums in real time to analyze mobile game security data. The collected data is collected using a distributed log collection system, and is transmitted and stored in a distributed file system in an encrypted or compressed form. Among them, the distributed log data collection system and the distributed file system are deployed with multiple nodes to improve data throughput efficiency and solve single point problems.

[0007] Furthermore, the tree integration model and the neural network model are used to train the collected data to generate mobile game security models for identifying abnormal behaviors in games, specifically including: using a feature extraction module to extract behavioral features from the collected data and standardize them as training samples; manually labeling the training samples as abnormal behavior samples and normal behavior samples based on the experience of operation and maintenance personnel, training the training tree integration model or the neural network model based on the manually labeled behavior samples, and evaluating the trained model according to the corresponding preset model measurement indicators. After the evaluation is passed, it is put online as a mobile game security identification model, and the mobile game security identification model identifies abnormal game behaviors based on standardized behavioral features extracted from mobile game client data, mobile game server data, and mobile game crawler data collected in real time using the feature extraction module.

[0008] Furthermore, the construction method also includes: associating the security results of specific gaming behaviors identified by the mobile game security identification model and the corresponding standardized behavior characteristics, and storing them in an identified behavior sample library; regularly retraining the tree integration model and the neural network model based on the newly added sample data in the identified behavior sample library to generate a new mobile game security model for identifying abnormal behaviors in the game, and using the new mobile game security model to iterate the old mobile game security model.

[0009] Furthermore, the tree ensemble model includes one or more of random forest, xgbt, catgboost and lightgb models. For some main parameters in the tree ensemble model: such as n_estimators, max_depth, and min_sample of leaves, grid search method is used to explore the hyperparameter space. In particular, the range of the exploration space needs to be adjusted according to the specific game. The neural network model is preferably a deep neural network model using a fully connected network, in which the number of layers (depth) of the network and the number of units of the hidden layer (network layer scale) are adjusted according to the specific game.

[0010] The present invention also provides a mobile game security platform system based on big data, the system comprising: a data acquisition module, used to collect mobile game client data, mobile game server data, and mobile game crawler data; a data acquisition module, used to store and store the data collected by the data acquisition module in a distributed file system; a model training module, which uses the collected data stored in the distributed file system to train a tree integration model and a neural network on the data to respectively generate a mobile game security model for identifying abnormal behavior in the game; and a model online module, which is used to set the mobile game security identification model to run on a risk control server to identify abnormal behavior in the game in real time.

[0011] The specific implementation details of the above-mentioned mobile game security platform system correspond to the details in the method for constructing a mobile game security platform based on big data provided by the present invention.

[0012] The beneficial effects of the present invention include:

[0013] 1. Compared with the existing mobile game security identification system that sets rules based on experience, the present invention collects multi-dimensional data such as client data, server data, and mobile game security crawler data, integrates relevant information from different fields for calculation and analysis, considers the interaction between different features, and constructs a mobile game security intelligent identification model through machine learning. It can identify plug-ins with unknown patterns and provide early warnings for mobile game security issues or anomalies;

[0014] 2. The present invention adopts the big data technology stack technology to improve the processing capability of sudden large amounts of data and effectively solve the problems of reliability and scalability;

[0015] 3. The present invention can realize feature classification and preprocessing of data from different channels, can regularize and integrate data with inconsistent standards, solve the problem of data islands, and enhance the reuse of heterogeneous data;

[0016] 4. The present invention adopts a distributed file system to disperse the access pressure to each node, and has no obvious transmission bottleneck, and supports online capacity expansion - avoiding downtime maintenance and other problems, solving single point failure and expansion problems. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 The present invention is a flowchart of a method for constructing a mobile game security platform based on big data according to an embodiment of the present invention.

[0018] Figure 2 2 is a system structure diagram of a mobile game security platform according to an embodiment of the present invention. DETAILED DESCRIPTION

[0019] In order to make the technical problems, technical solutions and beneficial effects solved by the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0020] Figure 1 The present invention shows a method for constructing a mobile game security platform. The method for constructing a mobile game security platform includes:

[0021] Step 100, collect mobile game client data, mobile game server data, and mobile game security crawler data.

[0022] Integrate the mobile game security SDK in the mobile game client to collect client data. Client data includes client hardware information (such as client IP address, MAC address, etc.), mobile game human-computer interaction information, sensor status information, network information, etc. Among them, the client data that needs to be collected can be notified to the user in the game privacy agreement.

[0023] The mobile game server uses direct streaming protocol analysis or mirroring tools to collect server data. Direct streaming protocol communication analysis can be performed by deploying traffic mirroring tools on the mobile game server or integrating relevant SDKs on the mobile game server. Streaming analysis tools can be used to perform streaming computing analysis on protocol communication data in real time and import it into the mobile game database. Among them, data stored in the mobile game database can also be imported in real time for analysis.

[0024] Use crawler technology to monitor relevant game forums and security technology website forums in real time, analyze mobile game security data, and import it into the mobile game client big data platform.

[0025] Step 200, the collected data is transmitted and stored in a distributed file system. The collected data can be collected and transmitted using a distributed log collection system (such as Flume, etc.), thereby realizing high-reliability collection of large quantities of data from different data sources.

[0026] The distributed log collection system may include an agent point layer, a collection node layer, and a storage layer, each of which can be horizontally expanded. Among them, the agent points and collection nodes are uniformly managed by the master node, making the system easier to monitor and maintain. Optionally, multiple master nodes can be allowed and set to avoid single point failure problems. Optionally, data is transmitted in a compressed manner, such as by gzip, bzip2, etc., to reduce network communication traffic. In addition, data can be transmitted in an encrypted manner to prevent sensitive data from being intercepted or tampered with midway.

[0027] The collected data is transmitted and stored in the distributed file system (such as HDFS) of the mobile game security big data platform. The distributed file system adopts a master-slave structure model. A cluster consists of a name node (NameNode) and several data nodes (DataNode). Among them, the name node acts as the master server to manage the namespace of the file system and the client's access to the file. The data nodes in the cluster manage the stored data. The distributed file system provides high fault tolerance and high-throughput data access, and provides high-reliability underlying storage support.

[0028] The data stored in the distributed file system may also include firewall data or firewall-related data. Some or all of the mobile game client data, mobile game server data, mobile game database data, firewall data, and security intelligence data (such as mobile game security crawler data) are formatted and stored in the distributed file system.

[0029] Step 300, using a tree integration model and a neural network to train the data, evaluate and determine the mobile game security model. In the step, the feature extraction module is used to extract behavioral features from the collected data and standardize them as training samples; the training samples are manually labeled as abnormal behavior samples and normal behavior samples based on the experience of game operators, and the training tree integration model or neural network model is trained based on the manually labeled behavior samples, and the trained model is evaluated according to the corresponding preset model measurement indicators. After the evaluation is passed, it is put online as a mobile game security identification model, and the mobile game security identification model uses the feature extraction module to extract standardized behavioral features from the real-time collected mobile game client data, mobile game server data, and mobile game crawler data to identify abnormal game behaviors.

[0030] Among them, mobile game client data may include client IP address, MAC address, etc. Mobile game database data includes: identification data, basic character data, spatiotemporal data, and game behavior data. Identification data includes account name, account ID, region ID, game character ID, game character name, etc. Basic character data includes player level, occupation, player guild name, etc. Spatiotemporal data includes location map ID, coordinate information, timestamp, etc. Game behavior data includes character unique identifier, behavior type (such as login, attack, exit, etc.), timestamp, etc., as shown in Table 1 below.

[0031] Id Action_type Time_stamp A Login 2020-04-16 12:20 B attack 2020-04-16 12:21 A Log_out 2020-04-16 12:22

[0032] Table 1 Game behavior data

[0033] Then, the feature extraction module is used to extract behavioral features from the collected data and standardize them as training samples. Set a time window to collect statistics. For example, a daily window with a basic unit time of 5 minutes can be set for statistical data. The time window can be set according to the required business. According to the game business, the data will be divided into basic character data, game client data and character behavior data. Within the set time window, the basic character data and game client data can be used directly. For the character behavior data, it is necessary to first count the counts of each feature of the character in the basic unit time, and then obtain the descriptive statistics of each feature based on the count. The descriptive statistics of the features include: total, mean, quartile, and maximum value. The statistics of these features and the basic character data and client data constitute the feature space for training the model. According to different game businesses, different fields, feature types and corresponding feature processing methods are set. Among them, the feature type can be set to continuous feature or classification feature, and the preprocessing method of the feature can be set to no processing, digital sequence encoding, unique hot encoding, and standardized preprocessing. Preferably, in the tree model, continuous feature data is processed without processing, and categorical feature data is encoded in digital sequence; in the neural network model, continuous feature data is processed in a standardized manner, and categorical feature data is encoded in one-hot manner.

[0034] The following shows an exemplary data preprocessing method under the tree model:

[0035] Character basic data

[0036] Feature Name Feature Type Feature processing Game Level Continuous none Profession Classification Digital sequence code Join the family Classification Digital sequence code Maximum single login time Continuous none Total active time Continuous none Number of logins Continuous none

[0037] Character behavior data

[0038]

[0039]

[0040] Game client data

[0041] Feature Name Feature Type Feature processing Number of different client IPs Continuous none Number of different MAC addresses of clients Continuous none

[0042] The following shows an exemplary data preprocessing method under the neural network model:

[0043] Character basic data

[0044] Feature Name Feature Type Feature processing Game Level Continuous standardization Profession Classification One-hot encoding Join the family Classification One-hot encoding Maximum single login time Continuous standardization Total active time Continuous standardization Number of logins Continuous standardization

[0045] Character behavior data

[0046]

[0047]

[0048] Game client data

[0049] Feature Name Feature Type Feature processing Number of different client IPs Continuous standardization Number of different MAC addresses of clients Continuous standardization

[0050] The data is standardized according to the following formula (1):

[0051]

[0052] Among them, x initial is the current value of the variable, x mean is the mean of the variable, x std is the standard deviation of the variable.

[0053] Step 303: Train the tree ensemble model and the neural network model, use the model measurement indicators to verify and determine the mobile game security identification model.

[0054] To train the tree ensemble model, you need to train the random forest, xgbt, catgboost, and lightgb models separately, and then take the weighted average of the results of each model as the output of the tree ensemble model. The main parameters in the tree ensemble model (such as n_estimators, max_depth, and min_sample of leaves, etc.) can use the grid search method to explore the hyperparameter space. In particular, the exploration space range can be adjusted according to the specific game. The neural network model uses a fully connected neural network model. The number of layers (depth) of the neural network and the number of units in the hidden layer (network layer scale) can be adjusted according to the specific game.

[0055] The final mobile game security identification model is determined based on the model measurement indicators. Model measurement indicators include performance score, precision, recall, etc. You can use roc_auc_score to measure the performance of the model. At the same time, it is necessary to comprehensively consider the precision and recall rate according to business needs to determine the final model. The generated mobile game security identification model can identify mobile game plug-ins, gold-making studios, DDOS attacks, mobile game account security, mobile game information security, etc.

[0056] The security results of specific game behaviors identified by the mobile game security identification model and the corresponding standardized behavior features are associated and stored in the identification behavior sample library; the tree integration model and the neural network model are regularly retrained according to the newly added sample data in the identification behavior sample library to generate a new mobile game security model for identifying abnormal behaviors in the game, and the new mobile game security model is used to iterate the old mobile game security model. Generally speaking, player behavior data will change with the change of version, that is, the data distribution will change with the change of version. Then the data used for model training is time-sensitive. By default, the model is trained using data within the past six months and is updated every month. When iteratively updating the model, the sample labels will be updated in time according to the model prediction results and manual verification to improve model performance.

[0057] The method for building a mobile game security platform also includes displaying and alerting alarm information. Audiences who need game security data can register and subscribe to relevant alarm information and obtain relevant data in real time, such as forecast data, so as to predict the prospects of the game business, adjust the game business module according to the forecast information, and better serve the game business.

[0058] The present invention also provides a mobile game security identification system. Figure 2 As shown, the system comprises:

[0059] A data collection module is used to collect mobile game client data, mobile game server data, and mobile game crawler data; a data collection module is used to store and store the data collected by the data collection module in a distributed file system; a model training module uses the collected data stored in the distributed file system to train the tree integration model and the neural network on the data to generate a mobile game security model for identifying abnormal behavior in the game; a model online module is used to set the mobile game security identification model to run on a risk control server to identify abnormal behavior in the game in real time.

[0060] The data collection module includes: a client data collection module, which uses the mobile game SDK to collect mobile game client data; a server data collection module, which uses direct streaming protocol analysis or mirroring tools to collect mobile game server data; and a mobile game security crawler data collection module, which uses crawler technology to collect data related to mobile game security services on the Internet. The collection data storage module uses a distributed log collection system to collect data, and encrypts and / or compresses the collected data before transmitting and storing it in the distributed file system; wherein the distributed log data collection system and the distributed file system both deploy multiple nodes to solve single point problems and provide data throughput efficiency.

[0061] Furthermore, the system also includes: an identification result database and a model iteration module. The identification behavior sample library is used for associating and storing the results of abnormal behavior identification performed by the mobile game safety identification model on the data collected in real time by the data collection module and the corresponding standardized behavior features, wherein before the mobile game safety identification model performs abnormal identification on the data collected in real time by the data collection module, the feature extraction module extracts and standardizes the behavior features of the data collected by the data collection module; the model iteration module is used to regularly retrain the tree integration model and the neural network model according to the newly added sample data in the identification behavior sample library to generate a new mobile game safety model for identifying abnormal behaviors in the game, and use the new mobile game safety model to iteratively update the old mobile game safety model.

[0062] The specific implementation details of the above-mentioned mobile game security platform system correspond to the details in the method for constructing a mobile game security platform based on big data provided by the present invention.

Claims

1. A method for constructing a mobile game security platform based on big data, characterized in that: The method comprises the following steps: Collect mobile game client data, mobile game server data, and mobile game security crawler data; Store the collected data in a distributed file system; The collected data are trained using a tree integration model and a neural network model to generate a mobile game security model for identifying abnormal behaviors in the game; specifically, the feature extraction module is used to extract behavioral features from the collected data and standardize the data as training samples; the training samples are manually labeled as abnormal behavior samples and normal behavior samples according to the experience of game operators, and the training tree integration model or the neural network model is trained according to the manually labeled behavior samples, and the trained model is evaluated according to the corresponding preset model measurement indicators, and after the evaluation is passed, it is put online as a mobile game security identification model, and the mobile game security identification model uses the feature extraction module to extract standardized behavioral features from real-time collection of mobile game client data, mobile game server data, and mobile game crawler data to identify abnormal game behaviors; The security results of specific gaming behaviors identified by the mobile game security identification model and the corresponding standardized behavior features are associated and stored in the identification behavior sample library; the tree integration model and the neural network model are regularly retrained according to the newly added sample data in the identification behavior sample library to generate a new mobile game security model for identifying abnormal behaviors in the game, and the new mobile game security model is used to iterate the old mobile game security model.

2. The construction method according to claim 1, characterized in that: The collecting of mobile game client data, mobile game server data, and mobile game crawler data includes: Integrate the mobile game security SDK into the mobile game client to collect client data; Collect server data from mobile game servers using direct streaming protocol analysis or mirroring tools; Use crawler technology to monitor game forums and security technology website forums in real time to collect mobile game security intelligence data.

3. The construction method according to claim 1, characterized in that: The storing of the collected data in the distributed file system includes: using a distributed log collection system to collect data, and encrypting and / or compressing the collected data before transmitting and storing it in the distributed file system; wherein the distributed log data collection system and the distributed file system both deploy multiple nodes to solve single point problems and provide data throughput efficiency.

4. The construction method according to claim 3, characterized in that: The tree ensemble model includes: one or more of random forest, xgbt, catgboost and lightgb models. During training, a grid search method is used to explore the hyperparameter space, and the range of the hyperparameter space is adjusted according to the specific game. The neural network model is a deep neural model with a fully connected layer network.

5. The construction method according to claim 1, characterized in that: The construction method also includes: after identifying abnormal behavior, sending an alarm message to users who subscribe to mobile game safety information.

6. A mobile game security platform system based on big data, characterized in that: The system comprises: Data collection module, used to collect mobile game client data, mobile game server data, and mobile game security crawler data; A data collection and storage module, used for transferring and storing the data collected by the data collection module to a distributed file system; A model training module, which uses the collected data stored in the distributed file system to train a tree ensemble model and a neural network on the data to generate a mobile game security model for identifying abnormal behaviors in the game; The model online module is used to set the mobile game security identification model to run on the risk control server to identify abnormal behaviors in the game in real time.

7. The mobile game security platform system according to claim 6, characterized in that: The data acquisition module comprises: The client data collection module is used to collect mobile game client data using the mobile game SDK; The server-side data collection module uses direct streaming protocol analysis or mirroring tools to collect server data; and the mobile game security crawler data collection module is used to use crawler technology to collect data related to mobile game security services on the Internet.

8. The mobile game security platform system according to claim 7, characterized in that: The data collection and storage module uses a distributed log collection system to collect data, and encrypts and / or compresses the collected data before transmitting and storing it in the distributed file system; wherein the distributed log data collection system and the distributed file system both deploy multiple nodes to solve single point problems and provide data throughput efficiency.

9. The mobile game security platform system according to any one of claims 6 to 8, characterized in that: The model training module includes: a feature extraction module, a sample annotation module, and a model training evaluation module; The feature extraction module is used to extract behavioral features from the collected data and standardize them as training samples; The sample labeling module is used to manually label the training samples into abnormal behavior samples and normal behavior samples according to the experience of the game operators; The model training evaluation module is used to train the training tree integration model or the neural network model according to the manually labeled behavior samples, and evaluate the trained model according to the corresponding preset model measurement indicators. After passing the evaluation, it is used as the mobile game safety identification model.

10. The mobile game security platform system according to claim 9, characterized in that: The system also includes: a recognition behavior sample library and a model iteration module; The recognition behavior sample library is used for the mobile game safety recognition model to perform abnormal behavior recognition on the data collected by the data collection module in real time and the corresponding standardized behavior features to associate and store the results, wherein before the mobile game safety recognition model performs abnormal recognition on the data collected by the data collection module in real time, the feature extraction module extracts behavior features from the data collected by the data collection module and standardizes them; The model iteration module is used to regularly retrain the tree integration model and the neural network model according to the newly added sample data in the identification behavior sample library to generate a new mobile game security model for identifying abnormal behavior in the game, and use the new mobile game security model to iteratively update the old mobile game security model.

Images