Method and device for external device recognition, electronic device, and storage medium

Abstract

The present application provides an external plug-in recognition method and device, an electronic device, and a storage medium. The method includes: obtaining interface operation data of a terminal device, where the interface operation data includes a first sequence composed of a plurality of interface operation events, and the operation position and timestamp corresponding to each interface operation event; matching the first sequence with a preset standard operation mode according to the preset standard operation mode, and extracting the interface operation event sequence corresponding to the standard operation mode from the first sequence as a second sequence; obtaining standard operation data according to the second sequence; the standard operation data includes the mode identifier of the standard operation mode corresponding to the second sequence, and the operation position and timestamp corresponding to each interface operation event in the second sequence; judging whether there is an external plug-in program according to the standard operation data through a detection engine. This solution does not rely on manual extraction of external plug-in program features, improves the accuracy of detection, and reduces the labor cost.

Description

Technical Field

[0001] This application relates to the field of Internet technologies, and particularly to a method and apparatus for identifying external devices, an electronic device, and a computer-readable storage medium. Background Art

[0002] With the popularization of smart phones and the development of mobile Internet, mobile games have gradually occupied the main part of the game market. However, there are endless external devices for mobile games on the market, which have had a bad impact on the game's reputation, economic system, player experience, etc., causing huge losses to game companies.

[0003] A large category of external devices for mobile games are simulated click external devices, which simulate human operations through key pressing elves, emulator scripts, recording and playback, etc. to play game content, so as to obtain game rewards at low cost. It is very difficult to identify abnormal players using simulated click external devices through general server game logs. How to design and implement a set of high-precision and highly reusable monitoring solutions for simulated click external devices is a major problem faced by game companies during the operation process. Summary of the Invention

[0004] Embodiments of this application provide a method for identifying external devices to accurately identify simulated click external devices.

[0005] Embodiments of this application provide a method for identifying external devices, and the method includes:

[0006] Embodiments of this application provide a method for identifying external devices, and the method includes:

[0007] Obtain interface operation data of a terminal device, where the interface operation data includes a first sequence composed of a plurality of interface operation events, and an operation position and a timestamp corresponding to each interface operation event;

[0008] Match the first sequence with a preset standard operation mode according to the preset standard operation mode, and extract an interface operation event sequence corresponding to the standard operation mode from the first sequence as a second sequence;

[0009] Obtain standard operation data according to the second sequence; the standard operation data includes a mode identifier of the standard operation mode corresponding to the second sequence, and an operation position and a timestamp corresponding to each interface operation event in the second sequence;

[0010] Judge whether there is an external program according to the standard operation data through a detection engine.

[0011] In an embodiment, the interface operation data further includes a control identifier, and a plurality of interface operation events in the first sequence correspond to the same control identifier.

[0012] In one embodiment, the obtaining of the interface operation data of the terminal device includes:

[0013] Obtaining the original interface operation events of the terminal device;

[0014] According to the mapping relationship between the preset standard operation events and the original interface operation events, converting the original interface operation events of the terminal device into standard operation events to obtain the interface operation events.

[0015] In one embodiment, the method further includes:

[0016] Characterizing the preset standard operation mode through a state machine, where the standard operation mode includes the timing relationship between multiple operation states and the standard operation events that can be input in each operation state.

[0017] In one embodiment, the operation state includes an initial state;

[0018] The matching of the first sequence with the standard operation mode according to the preset standard operation mode, and extracting the sequence of interface operation events corresponding to the standard operation mode from the first sequence as the second sequence includes:

[0019] In the initial state, inputting the interface operation events in the first sequence into the state machine in sequence, and determining whether the interface operation event input each time is a standard operation event that can be input in the current operation state according to the state machine. If not, discard the interface operation event input this time and return to the initial state;

[0020] Extracting the consecutive interface operation events before the discarded interface operation events from the first sequence to obtain the second sequence.

[0021] In one embodiment, the operation states include an initial state, a pressed state, a moved state, and a completed state.

[0022] In one embodiment, the detection engine includes a rule engine, a supervision engine, and an unsupervised engine. The judging whether there is a cheating program according to the standard operation data includes:

[0023] Judging whether there is a cheating program respectively according to the standard operation data through the rule engine, the supervision engine, and the unsupervised engine;

[0024] Obtaining multiple preliminary judgment results on whether there is a cheating program according to the rule engine, the supervision engine, and the unsupervised engine;

[0025] Determining whether there is a cheating program according to the preset policy and the multiple preliminary judgment results.

[0026] In one embodiment, the detection engine includes a rule engine. Judging whether there is a cheating program according to the standard operation data through the detection engine includes:

[0027] Judging the number of clicks corresponding to adjacent position points through the rule engine according to the standard operation data;

[0028] Determining whether there is a cheating program according to the number of clicks corresponding to the adjacent position points.

[0029] In one embodiment, the detection engine includes an unsupervised engine. Judging whether there is a cheating program according to the standard operation data through the detection engine includes:

[0030] Performing clustering processing on the standard operation data corresponding to multiple users through the unsupervised engine, finding out abnormal groups with the number of users less than the threshold, and determining that there is a cheating program in the abnormal groups.

[0031] In one embodiment, the detection engine includes a supervised engine. Judging whether there is a cheating program according to the standard operation data through the detection engine includes:

[0032] Using sample operation data containing marks of whether it is a cheating program to perform machine learning through the supervised engine to train a cheating recognition model;

[0033] Inputting the standard operation data into the cheating recognition model and determining whether there is a cheating program according to the output of the cheating recognition model.

[0034] In one embodiment, it further includes:

[0035] Displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph.

[0036] In one embodiment, displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph includes:

[0037] Displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph in a semi-transparent interactive interface.

[0038] In one embodiment, displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph includes:

[0039] According to the standard operation data, counting the number of repeated clicks at each operation position;

[0040] Displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph, and marking the operation positions where the number of repeated clicks is greater than the threshold in the static graph or the dynamic graph.

[0041] In one embodiment, displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph includes:

[0042] Highlighting the manipulation trajectory corresponding to the standard operation data for which it is determined that there is a cheating program in the static graph or the dynamic graph.

[0043] An embodiment of the present application further provides a cheating recognition device, and the device includes:

[0044] A data acquisition module, configured to acquire interface operation data of a terminal device, where the interface operation data includes a first sequence composed of a plurality of interface operation events and the operation position and timestamp corresponding to each interface operation event;

[0045] A pattern matching module, configured to match the first sequence with the preset standard operation pattern according to the preset standard operation pattern, and extract the sequence of interface operation events corresponding to the standard operation pattern from the first sequence as a second sequence;

[0046] A data extraction module, configured to obtain standard operation data according to the second sequence; the standard operation data includes the pattern identifier of the standard operation pattern corresponding to the second sequence, the operation position and timestamp corresponding to each interface operation event in the second sequence;

[0047] A data recognition module, configured to determine whether there is a cheating program according to the standard operation data through a detection engine.

[0048] An embodiment of the present application further provides an electronic device, and the electronic device includes:

[0049] A processor;

[0050] A memory for storing instructions executable by the processor;

[0051] Wherein, the processor is configured to execute the above-mentioned cheating recognition method.

[0052] An embodiment of the present application further provides a computer-readable storage medium, and the storage medium stores a computer program, and the computer program can be executed by a processor to complete the above-mentioned cheating recognition method.

[0053] The technical solution provided by the above embodiments of the present application extracts standard operation data from the interface operation data based on the standard operation pattern by acquiring the interface operation data, and then identifies the standard operation data through the detection engine, so as to determine whether there is an appearance program. Since the acquired is interface operation data rather than cheating program features, different system environments, game engines, and virtual environments can be compatible, without relying on manual extraction of cheating program features, improving the detection accuracy and reducing the labor cost. Description of the Drawings

[0054] To more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings required for use in the embodiments of the present application.

[0055] Figure 1 Schematic diagram of the application scenario of the external plug-in recognition method provided by an embodiment of the present application;

[0056] Figure 2 Schematic diagram of the structure of the electronic device provided by an embodiment of the present application;

[0057] Figure 3 Schematic diagram of the process flow of an external plug-in recognition method provided by an embodiment of the present application;

[0058] Figure 4 Schematic diagram of the acquisition process of the interface operation data provided by an embodiment of the present application;

[0059] Figure 5 Is Figure 3 Detailed flowchart corresponding to step S320 in the embodiment;

[0060] Figure 6 Schematic diagram of the principle of the state machine provided by an embodiment of the present application;

[0061] Figure 7 Schematic diagram of the processing flow of the detection engine provided by an embodiment of the present application;

[0062] Figure 8 Schematic diagram of the principles of three engines provided by an embodiment of the present application;

[0063] Figure 9 Is Figure 4 And Figure 7 Schematic diagram of the process flow of the complete external plug-in recognition method provided on the basis;

[0064] Figure 10 Schematic diagram of the visual display of the operation trajectory provided by an embodiment of the present application;

[0065] Figure 11 Schematic diagram of the game interaction interface provided by an embodiment of the present application;

[0066] Figure 12 Schematic diagram of the display of the number and position of repeated clicks provided by an embodiment of the present application;

[0067] Figure 13 Schematic diagram of the effect of highlighting abnormal data provided by an embodiment of the present application;

[0068] Figure 14 Block diagram of the device for external plug-in recognition provided by an embodiment of the present application. Detailed implementation manners

[0069] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings in the embodiments of the present application.

[0070] Similar reference numerals and letters denote similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. At the same time, in the description of the present application, the terms "first", "second", etc. are only used for differential description and cannot be construed as indicating or implying relative importance.

[0071] Figure 1 It is a schematic diagram of the application scenario of the external plug-in recognition method provided in the embodiment of the present application. As Figure 1 shown, the application scenario includes a game client 110 and a server 120. The game client 110 communicates with the server 120 through a wireless network. The game client 110 can be a smart phone, a tablet computer, a notebook computer, or a desktop computer running a game software application. The server 120 can be a game server, a direct transfer server, a private cloud, a public cloud, etc.

[0072] The game client 110 can collect interface operation data, send the interface operation data to the server 120, and the server 120 executes the method provided in the embodiment of the present application to determine whether there is an external plug-in program in the game client 110. According to needs, the game client 110 can also independently determine whether there is an external plug-in program based on the collected interface operation data.

[0073] Figure 2 It is a schematic structural diagram of an electronic device provided in the embodiment of the present application. This electronic device can be used as the above-mentioned game client 110 or server 120, and this electronic device 200 can be used to execute the external plug-in recognition method provided in the embodiment of the present application. As Figure 2 shown, the electronic device 200 includes: one or more processors 202, and one or more memories 204 that store instructions executable by the processor. Among them, the processor 202 is configured to execute the external plug-in recognition method provided in the following embodiments of the present application.

[0074] The processor 202 can be a device including a central processing unit (CPU), a graphics processing unit (GPU), or other forms of processing units with data processing capabilities and / or instruction execution capabilities. It can process the data of other components in the electronic device 200 and can also control other components in the electronic device 200 to perform desired functions.

[0075] The memory 204 may include one or more computer program products, and the computer program products may include various forms of computer-readable storage media, such as volatile memory and / or non-volatile memory. The volatile memory may include, for example, random access memory (RAM) and / or cache memory, etc. The non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, etc. One or more computer program instructions may be stored on the computer-readable storage media, and the processor 202 may run the program instructions to implement the external device recognition method described below. Various application programs and various data may also be stored in the computer-readable storage media, such as various data used and / or generated by the application programs, etc.

[0076] In one embodiment, Figure 2 The illustrated electronic device 200 may further include an input device 206, an output device 208, and a data acquisition device 210, and these components are interconnected through a bus system 212 and / or other forms of connection mechanisms (not shown). It should be noted that Figure 2 The components and structures of the illustrated electronic device 200 are merely exemplary and not restrictive. According to requirements, the electronic device 200 may also have other components and structures.

[0077] The input device 206 may be a device used by a user to input instructions, and may include one or more of a keyboard, a mouse, a microphone, and a touch screen, etc. The output device 208 may output various information (such as images or sounds) to the outside (for example, to the user), and may include one or more of a display, a speaker, etc. The data acquisition device 210 may acquire an image of an object and store the acquired image in the memory 204 for use by other components. Exemplarily, the data acquisition device 210 may be a camera.

[0078] In one embodiment, the various devices in the exemplary electronic device 100 for implementing the external device recognition method of the embodiments of the present application may be integrated or may be dispersed. For example, the processor 202, the memory 204, the input device 206, and the output device 208 may be integrated into one body, while the data acquisition device 210 is separately provided.

[0079] In one embodiment, the exemplary electronic device 200 for implementing the external device recognition method of the embodiments of the present application may be implemented as an intelligent device such as a computer, a server, a smart phone, etc.

[0080] Figure 3 It is a schematic flow chart of a method for recognizing external devices provided by an embodiment of the present application. As Figure 3 shown, the method includes: step S310 - step S340.

[0081] Step S310: Obtain the interface operation data of the terminal device. The interface operation data includes a first sequence composed of multiple interface operation events, as well as the operation position and timestamp corresponding to each interface operation event.

[0082] An interface operation event refers to a press event, a move event, a lift event, a cancel event, etc. triggered on the user interaction interface. A complete sliding action usually includes a press event, a move event, and a lift event in sequence. A series of interface operation events arranged in chronological order can be called a first sequence. Based on the different types of clients, the triggering objects of these events can be fingers, mice, or styluses, etc.

[0083] Among them, the operation position and timestamp corresponding to the interface operation event refer to the position coordinates where the interface operation event is triggered and the triggering time. For example, the position coordinates where the finger presses and the pressing time point, the position coordinates of multiple sampling points during the finger movement and the time point when moving to the sampling point, the position coordinates when the finger lifts and the lifting time point. In an embodiment, when there is multi-touch, the interface operation data may further include a manipulation identifier. One manipulation identifier corresponds to one finger, and the first sequence composed of multiple interface operation events in the interface operation data corresponds to the same manipulation identifier. Thus, different finger operations can be distinguished through the interface operation data with manipulation identifiers. For example, 0 can represent one finger, 1 can represent another finger, and 2 can represent the third finger. In the embodiments of the present application, the interface operation data corresponding to the manipulation identifier of one finger is taken as an example, and each other finger is implemented in the same way.

[0084] Step S320: Match the first sequence with the standard operation mode according to the preset standard operation mode, and extract the interface operation event sequence corresponding to the standard operation mode from the first sequence as the second sequence.

[0085] The standard operation mode refers to several interface operation events generated during standard operation. For example, the standard operation mode of a click is press and lift, and the corresponding standard operation mode in order is the press event and the lift event. The standard operation of a slide is press, move, and lift, and the corresponding standard operation mode in order is the press event, one or more move events, and the lift event. The standard operation can be defined according to the existing operation habits.

[0086] According to the preset standard operation mode, from the first sequence composed of consecutive multiple interface operation events, the interface operation event sequence corresponding to the standard operation mode can be extracted as the second sequence. For example, extracting consecutive press events and lift events constitutes a second sequence, and extracting consecutive press events, multiple move events, and lift events constitutes another second sequence. The second sequence can be considered as a number of consecutive interface operation events corresponding to the extracted standard operation mode.

[0087] Step S330: Obtain standard operation data according to the second sequence; the standard operation data includes the mode identifier of the standard operation mode corresponding to the second sequence, the operation position and timestamp corresponding to each interface operation event in the second sequence.

[0088] The mode identifier is used to distinguish different standard operation modes. For example, the mode identifier of the "press event action_down, lift event action_up" mode can be represented by 1, and the mode identifier of the "press event action_down, one or more move events action_move, lift event action_up" mode can be represented by 2.

[0089] The standard operation data is used to characterize the operation mode, operation position, and operation time of each complete operation. The form of the standard operation data can be as shown in the following table.

[0090]

[0091] Taking the first part of the list (i.e., the 2nd to 5th rows) as an example: This part as a whole represents a complete and legal touch behavior. 1 represents the category of this behavior (i.e., the mode identifier). That is, whether it is the "action_down, action_up" mode or the "action_down, one or more action_move, action_up" mode. Here, 1 represents the "action_down, action_up" mode. The subsequent data (the 3rd to 4th rows) represents the coordinate sequence and time sequence of this touch behavior, where each row is composed of a triple, respectively representing the screen x coordinate, screen y coordinate, and timestamp of the sampling point during the touch process. Therefore, the first part in the above list can be interpreted as that the player performed a click in the "action_down, action_up" mode. The click started (finger touched the screen) at the position (1014, 349) on the screen, with a timestamp of 1610426930088, and the click ended (finger left the screen) at the position (1122, 272) on the screen, with a timestamp of 1610426930238.

[0092] The second part of the above list (i.e., lines 6 to 12) can be interpreted as follows: The player performed a sliding behavior in the pattern of "action_down, one or more action_move, action_up". The sliding started (finger touching the screen) at the position (188, 226) on the screen, with a timestamp of 1610426930238. The first sampling point during the sliding was at the position (213, 356) on the screen, with a timestamp of 1610426930606. The second sampling point was at the position (204, 374) on the screen, with a timestamp of 1610426931055. The third sampling point was at the position (219, 377) on the screen, with a timestamp of 1610426931455. The sliding ended (finger leaving the screen) at the position (209, 390) on the screen, with a timestamp of 1610426931868. And so on, to obtain the standard operation data that can characterize the operation mode, operation position, and operation time of each complete action.

[0093] Step S340: According to the standard operation data, use the detection engine to determine whether there is a cheating program.

[0094] A cheating program refers to an auxiliary program that simulates human operations installed on the client side. For example, KeyMacro can automatically repeat clicks at regular intervals to simulate human key operations.

[0095] The detection engine can be regarded as a tool for judging whether there is a cheating program on the client side based on the standard operation data. For example, assuming that it is desired to identify and punish mouse macro players, the detection engine can be a model specifically for identifying mouse macros. Specifically, based on the standard operation data generated by mouse macro players, machine learning can be carried out to train a recognition model for mouse macro players. Then, the standard operation data to be recognized is input into this recognition model, and based on the output result of this recognition model, it can be determined whether it is a mouse macro player, that is, whether there is a cheating program.

[0096] The main technical solutions for anti-cheat in current popular mobile games are as follows: The anti-cheat team collects cheat programs related to the game to be protected. The anti-cheat team analyzes the collected cheat programs and extracts features such as process features that can be used to distinguish cheat programs. The anti-cheat team releases the collected features to the game client. When the game client starts, it detects whether there are cheat features in the environment. If so, it reports and interrupts the game. The main disadvantages of existing game anti-cheat solutions are mainly: It is necessary to optimize for different system environments (Android, iOS), game engines (Unity, Unreal, Cocos, etc.), and virtual environments (cloud real machines, cloud games, emulators, etc.), and collect different features in different ways, resulting in high compatibility costs; The collection of game cheat programs and the extraction of game cheat program features rely too much on manual labor, resulting in too high labor costs; Relying on manual collection of cheat programs and extraction of cheat program features is difficult to be comprehensive. This makes it difficult for the anti-cheat team to comprehensively protect mobile games and quickly respond to newly emerging cheats. The identification and detection of cheat programs based on cheat program features often fail due to the disguise of cheat programs.

[0097] The technical solution provided by the above embodiments of this application, by obtaining interface operation data, based on the standard operation mode, extracts standard operation data from the interface operation data, and then determines whether there is an appearance program by detecting the standard operation data through the detection engine. Since the obtained is interface operation data rather than cheat program features, it can be compatible with different system environments, game engines, and virtual environments, does not rely on manual extraction of cheat program features, improves the accuracy of detection, and reduces labor costs.

[0098] Taking mobile games as an example, as Figure 4 shown, the game client can have a set of general collection SDK. Through this SDK, screen touch data is collected from the game client, and after standardizing the screen touch data, it is uploaded to a private cloud, public cloud, game server, or direct transmission server for cheat identification. Without concerning about the environment where the game client is located (such as operating system, game engine, virtual environment, etc.). According to needs, before uploading, desensitization, encryption, and compression processing can also be performed.

[0099] In one embodiment, the standardization processing can also be completed on the server side. The server side can obtain the original interface operation events of the terminal device; according to the mapping relationship between the preset standard operation events and the original interface operation events, convert the original interface operation events of the terminal device into standard operation events to obtain the interface operation events.

[0100] It should be noted that the screen touch data collected from different channels has different formats. For example, in the Android system, raw interface operation events such as "action_down", "action_move", "action_up", etc. can be obtained. In the IOS system, raw interface operation events such as "UITouchPhaseBegan", "UITouchPhaseEnded", "UITouchPhaseMoved", etc. can be obtained. Under Unity, "Began", "Moved", "Ended", etc. are obtained as raw interface operation events. Therefore, these events can be mapped to standard operation events such as "action_down", "action_move", "action_up", "action_cancel", etc. that are cross-platform and universal (some events that occur with low frequency in human operations will be discarded or incorporated into other similar categories, etc.). The mapping relationship between the standard operation events and the raw operation events is shown in the following table, and the converted standard operation events can be used as interface operation events.

[0101]

[0102] In addition to a series of interface operation events, the interface operation data can also include the screen x and y coordinates, timestamp, and finger ID (used to distinguish different fingers) triggered by each event. According to needs, it can also include relevant fields such as games and scenes. The format of the interface operation data is shown in the following table.

[0103]

[0104]

[0105] The above embodiments realize the acquisition of cross-platform and multi-environment compatible interface operation data by converting the raw interface operation events into standard operation events, enabling the mobile game anti-cheat scheme based on the interface operation data to be compatible with more systems, engines, and other environments at low cost, and improving the portability and usability of the scheme.

[0106] In one embodiment, as Figure 5 shown, the above step S320 specifically includes the following steps S321 - step S323.

[0107] Step S321: Represent the preset standard operation mode through a state machine. The standard operation mode includes the timing relationship between multiple operation states and the standard operation events that can be input in each operation state. The operation states include an initial state, a pressed state, a moved state, and a completed state.

[0108] The standard operation mode refers to the change process of the operation state during a normal single operation and the interface operation events that occur in each operation state. The state machine can represent multiple different standard operation modes. The state machine can be as Figure 6 shown. The standard operation events that can be input in the initial state are the press event (down). The standard operation events that can be input in the pressed state are the move event (move), the lift event (up), and the cancel event (cancel). The standard operation events that can be input in the moving state are the move event (move), the lift event (up), and the cancel event (cancel). The completed state will automatically reset back to the initial state. As can be seen from Figure 6 , the standard operation modes can be, for example, the "action_down, action_up" mode or the "action_down, action_move (one or more), action_up" mode, etc.

[0109] Step S322: In the initial state, input the interface operation events in the first sequence into the state machine in sequence, and determine whether the interface operation event input each time is a standard operation event that can be input in the current operation state according to the state machine. If not, discard the interface operation event input this time and return to the initial state;

[0110] Start inputting the interface operation events in the sequence into the state machine from the "initial state". As Figure 6 shown, for example, in the "initial state", if the next input interface operation event is "action_down", it matches the standard operation event (down) in the initial state, and the state of the state machine transfers from the "initial state" to the "pressed state", indicating that the finger is pressed. In the "moving state", if the next (or consecutive multiple) interface operation events are "action_move", it matches the standard operation event (move) that can be input in the moving state, and the state of the state machine transfers from the "moving state" to the "moving state" (i.e., remains unchanged), indicating that the finger is still moving and has not left the screen. In any state, if the input interface operation event does not match the standard operation event in that state (such as in the case of data loss caused by network problems, etc.), the interface operation event will be discarded and return to the "initial state".

[0111] Step S323: Extract the consecutive interface operation events before the discarded interface operation event from the first sequence to obtain the second sequence.

[0112] Before extracting the discarded interface operation events, the matching consecutive interface operation events form a second sequence. The second sequence represents the consecutive interface operation events of a complete operation. Since there may be multiple actions such as clicks and swipes, multiple groups of second sequences can be extracted from the interface operation data. For example, the "action_down" event and the "action_up" event are a group of second sequences, and "action_down", five "action_move", and "action_up" are a group of second sequences.

[0113] To adapt to the situation where there may be overlapping multi-touch operations at the same time, there can also be multiple state machines. The state machines are different according to different finger IDs (that is, control identifiers). Each finger ID corresponds to a state machine respectively, standardizes an interface operation data, and extracts the interface operation event sequence.

[0114] In one embodiment, as Figure 7 shown, the data preprocessing part corresponds to the above-mentioned link of extracting standard operation data. The detection engine can include one or more engines, such as a rule engine, a supervision engine, and an unsupervised engine. The server can judge whether there is an external program according to the standard operation data through the rule engine, the supervision engine, and the unsupervised engine respectively. According to the multiple preliminary judgment results of whether there is an external program obtained by the rule engine, the supervision engine, and the unsupervised engine, and according to the preset strategy and the multiple preliminary judgment results, it is determined whether there is an external program. The final result is output to the game client.

[0115] The rule engine, the supervision engine, and the unsupervised engine. Each engine can include one or more recognition models. For example, 10 judgment results of whether there is an external program can be obtained through the three engines. The preset strategy can be, for example, that if more than 5 judgment results are considered to have an external program, it is considered that there is an external program in the client. According to the need for accuracy, the preset strategy can be 7 judgment results, 8 judgment results, etc.

[0116] Among them, the details of the three engines can be as Figure 8 shown. The rule (expert experience) engine integrates the expert experience of experts in the field of game security and can quickly implement the experience knowledge of external programs on the market into the detection service. The decision-making process of expert experience can be reproduced through simple rules, or through algorithms such as decision trees and ensemble learning (xgboost, GBDT) to reproduce expert experience, and the expert experience can be quickly deployed to the online detection service. For example, if there are repeated clicks at certain positions corresponding to some UIs and the click intervals are similar, combined with other information, such players may be judged as abnormal players using software such as key pressing wizards and simulated clicks.

[0117] The unsupervised engine is based on unsupervised learning technology and learns to discover potential patterns in data through unlabeled historical data, so as to achieve the automatic discovery of new abnormal patterns, the clustering and mining of abnormal groups. Specifically, it includes but is not limited to various deep learning algorithms. For example, mapping standard operation data into vectors in a high-dimensional hidden space, and then analyzing their spatial distribution based on these vectors to find abnormal groups, etc.

[0118] The supervised engine is based on supervised learning technology and learns how to discover abnormal samples in new data through labeled historical data, thus achieving high-precision detection of known abnormal patterns. Combining the misjudged samples feedback by customers and the new abnormal pattern samples discovered by the unsupervised engine, the automatic iteration framework of the supervised engine makes the automatic iteration of the supervised engine possible, effectively automatically counteracting the mutation of plug-ins and the emergence of new abnormal patterns. The supervised engine uses a supervised deep learning model, such as HAN (hierarchical attention network), etc., and sequence modeling and representation models, such as LSTM, Seq2Seq, Transformer, etc., to directly learn the mapping from standard operation data to the label of whether it is abnormal according to the existing labeled information.

[0119] In one embodiment, assuming that the detection engine includes a rule engine, the above step S340 may specifically include the following steps: judging the number of clicks corresponding to adjacent position points through the rule engine according to the standard operation data to determine whether there is a plug-in program.

[0120] The rule engine can set how far the distance is for adjacent position points and how many clicks are for multiple repeated clicks. Assuming that the mode identifier of the click operation is 1, if the mode identifiers of multiple consecutive operations in the standard operation data are all 1, and the distance between operation positions is less than the threshold, and the interval between timestamps is less than the threshold, then it can be considered that there is an abnormal operation situation and it is determined that there is a plug-in program.

[0121] In one embodiment, assuming that the detection engine includes an unsupervised engine, the above step S340 may specifically include the following steps: clustering the standard operation data corresponding to multiple users through the unsupervised engine, finding out abnormal groups with the number of users less than the threshold, and determining that there is a plug-in program in the abnormal groups.

[0122] Generally, the number of users with plug-ins is small. Therefore, clustering the standard operation data of a large number of users (for example, the k-means clustering algorithm can be used) can classify the standard operation data of users with plug-ins into one category and the standard operation data of users without plug-ins into one category. The category with fewer users can be considered as an abnormal group and there is a cheating program.

[0123] In one embodiment, assuming that the detection engine includes a supervision engine, the above step S340 may specifically include the following steps: using sample operation data including marks of whether it is a cheating program, performing machine learning through the supervision engine, and training to obtain a cheating recognition model; inputting the standard operation data into the cheating recognition model, and determining whether there is a cheating program according to the output of the cheating recognition model.

[0124] The sample operation data refers to the standard operation data corresponding to the client for which it is known whether there is a cheating program. For the sake of distinction, it is called sample operation data. The cheating recognition model has learned the characteristics of the standard operation data of the client with a cheating program. Therefore, when inputting the standard operation data to be recognized into the cheating recognition model, the output of the cheating recognition model is the recognition result of whether there is a cheating program. For example, the output can be a percentage. According to the set threshold, if it is greater than the threshold, it is considered that there is a cheating program.

[0125] In Figure 4 and Figure 7 on the basis of the corresponding embodiment, as Figure 9 shown, after summarizing the recognition results of multiple engines, they can be output to the data warehouse. According to different usage demands of customers, multiple output methods are supported, such as public cloud data warehouse, private cloud data warehouse, local data warehouse, etc.

[0126] In order to meet the needs such as the review before punishing abnormal players in operation, the server can also display the visual operation track through the anti-cheating platform. In one embodiment, the operation track corresponding to the standard operation data is displayed as a static graph or a dynamic graph.

[0127] The operation track refers to the path of clicking and sliding. Taking a mobile game controlled by finger touch as an example, it can be the touch track of the finger. If it is mouse-controlled, it is the track of the cursor movement during the period from pressing the mouse to lifting it.

[0128] "Static graph" is the most common way to visualize the operation track, as Figure 10 shown. By drawing the operation track (clicking, sliding) in a two-dimensional space, users can quickly understand the player's operation mode. Among them, for a click behavior, there are two sampling points (down, up), and the screen x and y coordinates of these two sampling points are the same. They can be regarded as a point and drawn in the two-dimensional space. For a sliding behavior, there are three or more sampling points (down, move (one or more), up), and the screen x and y coordinates of these sampling points are often different. Connecting the coordinates of these sampling points in the two-dimensional space in sequence can obtain a line, which is the track of this sliding behavior.

[0129] The "dynamic graph" adds temporal information on the basis of the "static graph". Since the standard operation data records the timestamp information of each sampling point, the operation trajectories of players can be sequentially displayed in the time dimension and finally presented in output forms such as GIF and video.

[0130] In another embodiment, the manipulation trajectory corresponding to the standard operation data may be displayed as a static graph or a dynamic graph in a semi-transparent interactive interface.

[0131] Based on the "static graph" or "dynamic graph", a semi-transparent game interactive interface (UI) is displayed so that the operation staff can quickly understand the underlying intention of the player's operation behavior, thereby better determining abnormal operation patterns. The schematic diagram of the game interactive interface (opaque) is as follows Figure 11 shown.

[0132] In other embodiments, the visualization evidence can also be presented in the following way: according to the standard operation data, the number of repeated clicks at each operation position is counted; the manipulation trajectory corresponding to the standard operation data is displayed as a static graph or a dynamic graph, and the operation positions where the number of repeated clicks is greater than a threshold and the corresponding number of repeated clicks are marked in the static graph or dynamic graph.

[0133] Assume that the mode identifier of the "click" standard operation mode is 1. If the mode identifiers are all 1 and the operation positions are close (for example, the distance is less than the threshold), it can be considered that repeated clicks have occurred at this operation position, and the number of repeated clicks can be counted. As Figure 12 shown, the operation positions where the number of repeated clicks is greater than the threshold (for example, coordinates 1115, 659) and the corresponding number of repeated clicks (for example, 17 times) can be marked in the static graph or dynamic graph.

[0134] Based on the "static graph" or "dynamic graph", the positions and numbers of precise repeated clicks are presented, enabling users to quickly capture abnormal patterns of precise repeated clicks. Here, the repeated clicks can have two dimensions. One is the sample dimension, that is, the repeated click situation in the data of a single person; the other dimension is the group dimension, such as the number of times the same point is repeatedly clicked among all players on the same server on the same day.

[0135] In other embodiments, the visualization evidence can also be presented in the following way: in the static graph or dynamic graph, the manipulation trajectory corresponding to the standard operation data determined to have cheating programs is highlighted.

[0136] The highlighted manipulation trajectory can be called the "interpretation result of the AI model". It shows which abnormal data the AI model in the detection engine is based on to determine that the entire sample is an abnormal sample, thereby allowing users to more quickly focus on the abnormal area of the abnormal sample. As Figure 13As shown, after the abnormal area of the abnormal sample is captured by the AI model algorithm, it is highlighted.

[0137] The technical solution provided by the above embodiments of the present application converts the original operation events into standardized events, making the deployment cost lower in different system environments (Android, IOS), game engines (Unity, Unreal, Cocos, etc.), and virtual environments (cloud real machines, cloud games, emulators, etc.). Compared with the prior art, since there is no need to collect the features of cheating programs, it can reduce the investment of manpower in the anti-cheat business, improve the reusability and migratability of the anti-cheat solution, reduce the access cost of each newly accessed game, and have a lower iteration cost when dealing with the mutation of cheats, making the final confrontation more effective.

[0138] The multi-engine collaborative anomaly detection based on deep learning greatly improves the accuracy and coverage of cheat detection. At the same time, it can automatically discover new abnormal patterns and mutated cheats, making the overall cheat detection solution more effective and less costly. The generation of multiple evidences based on the visualization of operation trajectories realizes faster review of abnormal players, reduces the review cost of game operation, and can also be used as evidence to assist game operation in dealing with player complaints.

[0139] The following is an embodiment of the device of the present application, which can be used to execute the above-mentioned embodiment of the cheat recognition method of the present application. For the details not disclosed in the embodiment of the device of the present application, please refer to the embodiment of the cheat recognition method of the present application.

[0140] Figure 14 It is a block diagram of a device for cheat recognition shown in an embodiment of the present application. As Figure 14 shown, the device includes: a data acquisition module 1410, a pattern matching module 1420, a data extraction module 1430, and a data recognition module 1440.

[0141] The data acquisition module 1410 is used to acquire the interface operation data of the terminal device. The interface operation data includes a first sequence composed of multiple interface operation events, as well as the operation position and timestamp corresponding to each interface operation event.

[0142] The pattern matching module 1420 is used to match the first sequence with the preset standard operation pattern according to the preset standard operation pattern, and extract the sequence of interface operation events corresponding to the standard operation pattern from the first sequence as the second sequence.

[0143] The data extraction module 1430 is used to obtain standard operation data according to the second sequence. The standard operation data includes the pattern identifier of the standard operation pattern corresponding to the second sequence, and the operation position and timestamp corresponding to each interface operation event in the second sequence.

[0144] A data recognition module 1440, configured to determine whether there is an external program according to the standard operation data through a detection engine.

[0145] For the implementation processes of the functions and effects of each module in the above device, please refer to the implementation processes of the corresponding steps in the above method for identifying external programs in detail, which will not be elaborated here.

[0146] In several embodiments provided in the present application, the disclosed device and method can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architectures, functions, and operations of the device, method, and computer program product according to multiple embodiments of the present application. In this regard, each block in the flowchart or block diagram may represent a module, a program segment, or a part of code, and the module, program segment, or part of code contains one or more executable instructions for implementing the specified logical function. In some alternative implementations, the functions marked in the blocks may occur in a different order than marked in the accompanying drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in the reverse order, depending on the functions involved. It should also be noted that each block in the block diagram and / or flowchart, as well as the combination of blocks in the block diagram and / or flowchart, can be implemented by a dedicated hardware-based system for performing the specified functions or actions, or can be implemented by a combination of dedicated hardware and computer instructions.

[0147] In addition, in each embodiment of the present application, the functional modules can be integrated together to form an independent part, or each module can exist alone, or two or more modules can be integrated to form an independent part.

[0148] If the function is implemented in the form of a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in each embodiment of the present application. The foregoing storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

Claims

1. A method for identifying cheats, characterized in that: The method includes: Obtaining interface operation data of a terminal device, where the interface operation data includes a first sequence composed of multiple interface operation events, as well as an operation position and a timestamp corresponding to each interface operation event; wherein, according to a mapping relationship between a preset standard operation event and an original interface operation event, the original interface operation event of the terminal device is converted into a standard operation event to obtain the interface operation event; Matching the first sequence with the preset standard operation mode according to the preset standard operation mode, and extracting an interface operation event sequence corresponding to the standard operation mode from the first sequence as a second sequence; Obtaining standard operation data according to the second sequence; the standard operation data includes a mode identifier of the standard operation mode corresponding to the second sequence, and an operation position and a timestamp corresponding to each interface operation event in the second sequence; Judging whether there is a cheating program according to the standard operation data through a detection engine.

2. The method according to claim 1, characterized in that, The interface operation data further includes a manipulation identifier, and multiple interface operation events in the first sequence correspond to the same manipulation identifier.

3. The method according to claim 1, characterized in that, The method further includes: Characterizing the preset standard operation mode through a state machine, where the standard operation mode includes a timing relationship between multiple operation states and standard operation events that can be input in each operation state.

4. The method according to claim 3, characterized in that, The operation state includes an initial state; The step of matching the first sequence with the preset standard operation mode according to the preset standard operation mode, and extracting an interface operation event sequence corresponding to the standard operation mode from the first sequence as a second sequence includes: In the initial state, sequentially inputting the interface operation events in the first sequence into the state machine, and determining whether the interface operation event input each time is a standard operation event that can be input in the current operation state according to the state machine. If not, discard the interface operation event input this time and return to the initial state; Extracting consecutive interface operation events before the discarded interface operation event from the first sequence to obtain the second sequence.

5. The method according to claim 3, characterized in that, The operation states include an initial state, a pressed state, a moved state, and a completed state.

6. The method according to claim 1, wherein The detection engine includes a rule engine, a supervision engine, and an unsupervised engine. The step of judging whether there is a cheating program according to the standard operation data through the detection engine includes: Judging whether there is a cheating program respectively through the rule engine, the supervision engine, and the unsupervised engine according to the standard operation data; Obtaining multiple preliminary judgment results on whether there is a cheating program obtained by the rule engine, the supervision engine, and the unsupervised engine; Determining whether there is a cheating program according to a preset strategy and the multiple preliminary judgment results.

7. The method according to claim 1, characterized in that The detection engine includes a rule engine. The step of judging whether there is a cheating program according to the standard operation data through the detection engine includes: Judging the number of click times corresponding to adjacent position points according to the standard operation data through the rule engine; Determining whether there is a cheating program according to the number of click times corresponding to the adjacent position points.

8. The method according to claim 1, characterized in that, The detection engine includes an unsupervised engine. Judging whether there is a cheating program according to the standard operation data through the detection engine includes: Performing clustering processing on the standard operation data corresponding to multiple users through the unsupervised engine, finding out abnormal groups with the number of users less than the threshold, and determining that there is a cheating program in the abnormal groups.

9. The method according to claim 1, wherein The detection engine includes a supervised engine. Judging whether there is a cheating program according to the standard operation data through the detection engine includes: Using sample operation data containing labels indicating whether it is a cheating program to perform machine learning through the supervised engine, and training to obtain a cheating recognition model; Inputting the standard operation data into the cheating recognition model, and determining whether there is a cheating program according to the output of the cheating recognition model.

10. The method according to claim 1, wherein The method further includes: Displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph.

11. The method according to claim 10, wherein The displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph includes: Displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph in a semi-transparent interaction interface.

12. The method according to claim 10, wherein The displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph includes: According to the standard operation data, counting the number of repeated clicks at each operation position; Displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph, and marking the operation positions where the number of repeated clicks is greater than the threshold in the static graph or the dynamic graph.

13. The method according to claim 10, wherein The displaying the manipulation trajectory corresponding to the standard operation data in a static graph or a dynamic graph includes: Highlighting the manipulation trajectory corresponding to the standard operation data where it is determined that there is a cheating program in a static graph or a dynamic graph.

14. An apparatus for identifying external devices, characterized in that, The device includes: A data acquisition module, configured to acquire interface operation data of a terminal device, where the interface operation data includes a first sequence composed of a plurality of interface operation events, and the operation position and timestamp corresponding to each interface operation event; wherein, according to a mapping relationship between a preset standard operation event and an original interface operation event, converting the original interface operation event of the terminal device into a standard operation event to obtain the interface operation event; A mode matching module, configured to match the first sequence with the standard operation mode according to a preset standard operation mode, and extract an interface operation event sequence corresponding to the standard operation mode from the first sequence as a second sequence; A data extraction module, configured to obtain standard operation data according to the second sequence; the standard operation data includes a mode identifier of the standard operation mode corresponding to the second sequence, and the operation position and timestamp corresponding to each interface operation event in the second sequence; A data recognition module, configured to judge whether there is a cheating program according to the standard operation data through a detection engine.

15. An electronic device, characterized in that, The electronic device includes: A processor; A memory for storing instructions executable by the processor; Wherein, the processor is configured to execute the method for cheating recognition according to any one of claims 1-13.

16. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, and the computer program can be executed by the processor to complete the method for cheating recognition according to any one of claims 1-13.

Images