Methods and devices for detecting violations, storage media and electronic equipment

Abstract

This invention discloses a method, apparatus, storage medium, and electronic device for detecting violations. The method includes: receiving operation data uploaded by a target device, wherein the operation data includes: screen display data of the target device using a game application and data requests from the game application; if it is determined that there is abnormal operation data to be confirmed, performing anomaly identification on the abnormal operation data; and determining the anomaly based on the anomaly identification result according to a preset monitoring mechanism to determine whether the game application has engaged in violations. This invention solves the technical problem that the detection effect of violations in game applications in the prior art is not accurate and comprehensive enough.

Description

Technical Field

[0001] This invention relates to the field of visual algorithms, and more specifically, to a method and apparatus for detecting violations, a storage medium, and an electronic device. Background Technology

[0002] With the widespread adoption of the internet, the online gaming industry, as a pillar industry of the internet, has experienced rapid development. However, this rapid development has also been accompanied by the emergence of cheating software, which disrupts game balance, accelerates player churn, damages the interests of game developers, and negatively impacts the entire gaming industry. Existing cheating detection technologies, including player reporting, data monitoring, data packet encryption, client-side anomaly detection, and server-side anomaly detection, allow detection code to operate without being limited by the runtime environment. Furthermore, after modification, the code can effectively confuse analysts and monitors, essentially relying on altering the game data sent back to the server to deceive it and achieve cheating.

[0003] Furthermore, many novel external cheat mechanisms exist in related technologies, which improve accuracy and track characters by altering the mouse pointer, thus achieving cheating purposes. These mechanisms are very difficult for servers to detect.

[0004] To address the aforementioned issues, existing technologies for detecting violations in game applications are neither accurate nor comprehensive enough, and no effective solutions have yet been proposed. Summary of the Invention

[0005] This invention provides a method, apparatus, storage medium, and electronic device for detecting violations, in order to at least solve the problems of insufficient accuracy and comprehensiveness in the detection of violations in game applications in the prior art.

[0006] According to one aspect of the present invention, a method for detecting violations is provided, comprising: receiving operation data uploaded by a target device, wherein the operation data includes: screen display data of a target object using a game application and data requests of the game application; if it is determined that there is abnormal operation data to be confirmed in the operation data, performing anomaly identification on the abnormal operation data; and performing anomaly determination on the result of the anomaly identification according to a preset monitoring mechanism to determine whether the game application has violated regulations.

[0007] Optionally, if it is determined that there is abnormal operation data to be confirmed in the operation data, the abnormal operation data is subjected to anomaly identification, including: determining the data content of the abnormal operation data; if the data content is abnormal screen display data, performing a first anomaly identification on the abnormal operation data; and if the data content is an abnormal data request, performing a second anomaly identification on the abnormal operation data.

[0008] Optionally, when the data content is abnormal screen display data, a first anomaly identification is performed on the abnormal operation data, including: inputting the abnormal screen display data into a self-visual algorithm model for first anomaly identification to obtain pointer jitter data of the target device, wherein the self-visual algorithm model is trained by machine learning using multiple sets of data, and each set of data includes: target abnormal screen display data, and screen parameters and pointer parameters corresponding to the target abnormal screen display data; parsing the pointer jitter data to determine the screen parameters of the pointer on the display interface of the target device and the pointer parameters of the pointer on the display interface of the target device, wherein the pointer is an object that receives external operation instructions and displays on the target device.

[0009] Optionally, after parsing the pointer jitter data and determining the screen parameters and pointer parameters of the pointer on the target device's display interface, the above method further includes: associating and binding the screen parameters, the pointer parameters, and the abnormal screen display data to obtain a first abnormality identification result of the abnormal operation data; saving the first abnormality identification result in the database; and sending the first abnormality identification result to the corresponding preset monitoring mechanism.

[0010] Optionally, if the data content is an abnormal data request, a second anomaly identification is performed on the abnormal operation data, including: determining the real-time data stream corresponding to the game application that issued the abnormal data request, and determining the data value corresponding to the real-time data stream; if the data value is less than a preset threshold, determining that the abnormal operation data is cheating data, and obtaining a second anomaly identification result for the abnormal operation data; if the data value is greater than or equal to the preset threshold, determining that the abnormal operation data is normal transmission data.

[0011] Optionally, after determining that the abnormal operation data is normal transmission data when the data value is greater than or equal to a preset threshold, the above method further includes: parsing the abnormal data request to determine the account information currently logged in by the target device; and adding a pending confirmation identifier to the target device when the account information does not exist in a preset blacklist, wherein the pending confirmation identifier is used to indicate that the operation data of the target device should be re-acquired for secondary confirmation.

[0012] Optionally, an anomaly determination is made on the anomaly identification results according to a preset monitoring mechanism to determine whether the game application has violated regulations. This includes: if a first anomaly identification result exists and a second anomaly identification result also exists, determining that the game application on the target device has violated regulations and banning the currently logged-in account information of the game application; if a first anomaly identification result exists, detecting the device information of the target device and determining that the game application has violated regulations requiring secondary confirmation; if a second anomaly identification result exists, determining the historical records of the currently logged-in account information of the target device and determining that the game application has violated regulations requiring secondary confirmation.

[0013] According to another aspect of the present invention, a method and apparatus for detecting violations is also provided, comprising: a receiving module, further configured to receive operation data uploaded by a target device, wherein the operation data includes: screen display data of a game application used by the target object and data requests of the game application; an identification module, further configured to identify the abnormal operation data when it is determined that there is abnormal operation data to be confirmed in the operation data; and a judgment module, configured to make an anomaly judgment on the result of the anomaly identification according to a preset monitoring mechanism, so as to determine whether the game application has violated regulations.

[0014] Optionally, the above-mentioned identification module is further configured to determine the data content of the abnormal operation data; when the data content is abnormal screen display data, perform a first anomaly identification on the abnormal operation data; and when the data content is an abnormal data request, perform a second anomaly identification on the abnormal operation data.

[0015] Optionally, the aforementioned identification module is further configured to input the abnormal screen display data into a self-visual algorithm model for first anomaly identification to obtain pointer jitter data of the target device. The self-visual algorithm model is trained using multiple sets of data through machine learning. Each set of data includes: target abnormal screen display data, and screen parameters and pointer parameters corresponding to the target abnormal screen display data. The module also parses the pointer jitter data to determine the screen parameters and pointer parameters of the pointer on the target device's display interface. The pointer is an object that receives external operation commands and displays on the target device.

[0016] Optionally, the above-mentioned identification module further includes: a storage unit, used to associate and bind the screen parameters, the pointer parameters, and the abnormal screen display data to obtain a first abnormal identification result of the abnormal operation data; save the first abnormal identification result in the database, and send the first abnormal identification result to the corresponding preset monitoring mechanism.

[0017] Optionally, the aforementioned identification module is further configured to determine the real-time data stream corresponding to the game application that issued the abnormal data request, and determine the data value corresponding to the real-time data stream; if the data value is less than a preset threshold, determine that the abnormal operation data is cheating data, and obtain a second abnormal identification result of the abnormal operation data; if the data value is greater than or equal to the preset threshold, determine that the abnormal operation data is normal transmission data.

[0018] Optionally, the above identification module further includes: an identification unit, used to parse the abnormal data request and determine the account information currently logged in by the target device; if the account information does not exist in a preset blacklist, to add a pending confirmation identifier to the target device, wherein the pending confirmation identifier is used to indicate that the operation data of the target device be re-acquired for secondary confirmation.

[0019] Optionally, the aforementioned determination module is further configured to: determine that the game application on the target device has violated regulations when both a first anomaly identification result and a second anomaly identification result exist; and ban the currently logged-in account information of the game application; detect the device information of the target device when the first anomaly identification result exists; and determine that the game application has violated regulations requiring secondary confirmation when the second anomaly identification result exists.

[0020] According to another aspect of the present invention, a computer-readable storage medium is also provided, wherein a computer program is stored therein, wherein the computer program is configured to perform the method in any of the method embodiments at runtime.

[0021] According to another aspect of the present invention, an electronic device is also provided, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to perform the method in any of the above-described method embodiments through the computer program.

[0022] In this embodiment of the invention, operation data uploaded by the target device is received. This operation data includes: screen display data of the target object using a game application and data requests from the game application. If it is determined that there is abnormal operation data to be confirmed, the abnormal operation data is anomaly identified. An anomaly determination is made based on the result of the anomaly identification according to a preset monitoring mechanism to determine whether the game application has engaged in any violations. That is, when there are abnormalities in the operation data, the abnormal operation data is anomaly identified, and the result of the anomaly identification is determined through a preset monitoring mechanism. This achieves the goal of accurately identifying whether the game application has engaged in any violations, thereby improving the technical efficiency of detecting violations and solving the technical problem in the prior art where the detection effect of violations in game applications is not accurate or comprehensive enough. Attached Figure Description

[0023] The accompanying drawings, which are included to provide a further understanding of the invention and form part of this application, illustrate exemplary embodiments of the invention and, together with their description, serve to explain the invention and do not constitute an undue limitation thereof. In the drawings:

[0024] Figure 1 This is a hardware structure block diagram of a computer terminal for a method of detecting violations according to an embodiment of the present invention.

[0025] Figure 2 A flowchart of a method for detecting violations according to an embodiment of the present invention;

[0026] Figure 3 A schematic diagram illustrating the process of a visual algorithm for monitoring a player's game screen according to an optional embodiment of the present invention;

[0027] Figure 4 This is a game data flow diagram according to an optional embodiment of the present invention;

[0028] Figure 5 This is a schematic diagram of the structure of a violation detection device according to an embodiment of the present invention. Detailed Implementation

[0029] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0031] The methods and embodiments provided in this application can be executed on a computer terminal, mobile terminal, or similar computing device. Taking running on a computer terminal as an example, Figure 1 This is a hardware structure block diagram of a computer terminal for a method of detecting violations according to an embodiment of the present invention. Figure 1 As shown, computer terminal 10 may include one or more ( Figure 1 Only one is shown in the diagram. A processor 102 (which may include, but is not limited to, a microprocessor MCU or a programmable logic device FPGA, etc.) and a memory 104 for storing data are also shown. Optionally, the computer terminal may further include a transmission device 106 for communication functions and an input / output device 108. Those skilled in the art will understand that... Figure 1 The structure shown is for illustrative purposes only and does not limit the structure of the computer terminal described above. For example, computer terminal 10 may also include... Figure 1 The more or fewer components shown, or having the same Figure 1 Equivalent functions or ratios shown Figure 1 The functions shown have more different configurations.

[0032] The memory 104 can be used to store computer programs, such as application software programs and modules, like the computer program corresponding to the violation detection method in this embodiment of the invention. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, thereby implementing the above-described method. The memory 104 may include high-speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include memory remotely located relative to the processor 102, and these remote memories can be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof.

[0033] The transmission device 106 is used to receive or send data via a network. Specific examples of the network described above may include a wireless network provided by the communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network Interface Controller (NIC), which can connect to other network devices via a base station to communicate with the Internet. In another example, the transmission device 106 may be a Radio Frequency (RF) module, used for wireless communication with the Internet.

[0034] Alternatively, as an alternative implementation method, Figure 2 This is a flowchart of a method for detecting violations according to an embodiment of the present invention, such as... Figure 2 As shown, the method includes the following steps:

[0035] Step S202: Receive operation data uploaded by the target device, wherein the operation data includes: screen display data of the target object using the game application and data requests of the game application;

[0036] Step S204: If it is determined that there is abnormal operation data to be confirmed in the operation data, perform anomaly identification on the abnormal operation data.

[0037] Step S206: Based on a preset monitoring mechanism, perform anomaly determination on the results of the anomaly identification to determine whether the game application has any violations.

[0038] Through the above steps, operation data uploaded by the target device is received. This operation data includes: screen display data of the game application used by the target object and data requests from the game application. If it is determined that there is abnormal operation data to be confirmed, the abnormal operation data is anomaly identified. Anomaly determination is made based on the result of the anomaly identification according to a preset monitoring mechanism to determine whether the game application has engaged in any violations. In other words, when there are abnormal operation data, anomaly identification is performed on the abnormal operation data, and the result of the anomaly identification is determined through a preset monitoring mechanism. This achieves the goal of accurately identifying whether the game application has engaged in any violations, thereby improving the technical efficiency of violation detection and solving the technical problem in the prior art where the detection effect of violations in game applications is not accurate or comprehensive enough.

[0039] Optionally, if it is determined that there is abnormal operation data to be confirmed in the operation data, the abnormal operation data is subjected to anomaly identification, including: determining the data content of the abnormal operation data; if the data content is abnormal screen display data, performing a first anomaly identification on the abnormal operation data; and if the data content is an abnormal data request, performing a second anomaly identification on the abnormal operation data.

[0040] Optionally, when the data content is abnormal screen display data, a first anomaly identification is performed on the abnormal operation data, including: inputting the abnormal screen display data into a self-visual algorithm model for first anomaly identification to obtain pointer jitter data of the target device, wherein the self-visual algorithm model is trained by machine learning using multiple sets of data, and each set of data includes: target abnormal screen display data, and screen parameters and pointer parameters corresponding to the target abnormal screen display data; parsing the pointer jitter data to determine the screen parameters of the pointer on the display interface of the target device and the pointer parameters of the pointer on the display interface of the target device, wherein the pointer is an object that receives external operation instructions and displays on the target device.

[0041] Optionally, after parsing the pointer jitter data and determining the screen parameters and pointer parameters of the pointer on the target device's display interface, the above method further includes: associating and binding the screen parameters, the pointer parameters, and the abnormal screen display data to obtain a first abnormality identification result of the abnormal operation data; saving the first abnormality identification result in the database; and sending the first abnormality identification result to the corresponding preset monitoring mechanism.

[0042] Optionally, if the data content is an abnormal data request, a second anomaly identification is performed on the abnormal operation data, including: determining the real-time data stream corresponding to the game application that issued the abnormal data request, and determining the data value corresponding to the real-time data stream; if the data value is less than a preset threshold, determining that the abnormal operation data is cheating data, and obtaining a second anomaly identification result for the abnormal operation data; if the data value is greater than or equal to the preset threshold, determining that the abnormal operation data is normal transmission data.

[0043] Optionally, after determining that the abnormal operation data is normal transmission data when the data value is greater than or equal to a preset threshold, the above method further includes: parsing the abnormal data request to determine the account information currently logged in by the target device; and adding a pending confirmation identifier to the target device when the account information does not exist in a preset blacklist, wherein the pending confirmation identifier is used to indicate that the operation data of the target device should be re-acquired for secondary confirmation.

[0044] Optionally, an anomaly determination is made on the anomaly identification results according to a preset monitoring mechanism to determine whether the game application has violated regulations. This includes: if a first anomaly identification result exists and a second anomaly identification result also exists, determining that the game application on the target device has violated regulations and banning the currently logged-in account information of the game application; if a first anomaly identification result exists, detecting the device information of the target device and determining that the game application has violated regulations requiring secondary confirmation; if a second anomaly identification result exists, determining the historical records of the currently logged-in account information of the target device and determining that the game application has violated regulations requiring secondary confirmation.

[0045] To better understand the technical solutions of the embodiments and optional embodiments of the present invention, the flow of the above-mentioned method for detecting violations is explained below with reference to examples, but it is not intended to limit the technical solutions of the embodiments of the present invention.

[0046] An optional embodiment of the present invention proposes a game monitoring method based on a visual algorithm. The method monitors abnormal mouse pointer jitter in the game screen using a visual algorithm, obtains abnormal data caused by abnormal pointer jitter, and then monitors the player's game screen based on the visual algorithm to detect abnormal mouse pointer operations. The abnormal operations are then uploaded to the game developer for the implementation of anti-cheating mechanisms.

[0047] It should be noted that the purpose of using visual algorithms to detect the corresponding game screen is to improve the detection effect of the visual algorithms. In the early stage, a large number of images are used to feed the visual algorithms, so that the visual algorithms can clearly analyze the character features in the game screen; and the trained visual algorithms can monitor and analyze the game screen of the current user device in real time.

[0048] As an optional implementation, the above-mentioned game detection process using visual algorithms can be implemented through a plugin, which includes: a key information extraction module and a visual algorithm module for character recognition.

[0049] Optional, key information extraction module: used to extract abnormal pointer jitter data detected by visual algorithms. Abnormal data is uploaded to the server for game cheat detection and identification. The module extracts game footage, tracks the mouse pointer's trajectory on the screen, identifies abnormal pointer movement, and extracts suspected abnormal screen and pointer parameters, sending them to the target monitoring mechanism for detection and judgment.

[0050] Optional, a visual algorithm module for character recognition: based on visual algorithm mechanisms for object detection, image segmentation, and object tracking. This improves the tracking and recognition rate of game characters through prior image data annotation and data feeding.

[0051] Optional, Figure 3 This is a flowchart illustrating a visual algorithm for monitoring a player's game screen according to an optional embodiment of the present invention; it mainly explains how the visual algorithm monitors the game screen, specifically including the following steps:

[0052] Step S302: The user sends game data to the game server;

[0053] Step S304: The visual algorithm monitoring platform monitors the game page and extracts game data in real time.

[0054] Step S306: The visual algorithm monitoring platform detects abnormal mouse pointer behavior and sends the game data to the cheat platform for evaluation.

[0055] Step S308: The cheat evaluation platform analyzes the abnormal pointer jitter to determine if it belongs to a cheat and then identifies and bans the user.

[0056] Optional, Figure 4 This is a game data flow diagram according to an optional embodiment of the present invention; it mainly introduces the data flow and internal judgment logic.

[0057] After the user generates game operation information, the game screen is monitored and processed through a visual algorithm monitoring platform; game data requests are processed through the game server.

[0058] Optionally, the visual algorithm monitoring platform includes the following modules: data collection service 42, data cleaning 44, feature engineering 46, offline training and processing engine 48, and offline analysis data storage 50;

[0059] The visual algorithm monitoring platform monitors the game page and extracts game data in real time through data collection service 42. Duplicate data is filtered and removed through data cleaning 44. Then, the trained feature engineering 46 tracks the trajectory path of the mouse pointer on the screen interface. Screen parameters and pointer parameters are extracted for suspected abnormal pointer movement trajectories. The offline training processing engine 48 judges the screen parameters and pointer parameters to determine whether the suspected abnormal pointer movement trajectory is a real anomaly. The judgment result is saved in the offline analysis data 50. Combined with game data requests, the result is determined in the game server for comprehensive judgment, which greatly improves the detection of novel physical cheating methods.

[0060] Optionally, the game server may contain the following: game monitoring platform 52, Kafka distributed subscription message 54, real-time streaming computing 56, judgment engine 58, Redis cache blacklist 60, and account banning processing 62.

[0061] When the game monitoring platform 52 in the game server receives a game data request from a game operation, it initially determines whether the game data request is abnormal. If abnormal, it directly determines that the game operation corresponding to the game data request is a cheating operation, adds the user who performed the cheating operation to the Redis cache blacklist 60 for recording. To ensure the accuracy of the determination, it uses Kafka distributed subscription messages 54 to determine the real-time data stream of the game data request, and calculates the traffic size of the real-time data stream through real-time streaming computing 56. The traffic size is input into the determination engine 58 and compared with the standard traffic size. If it is determined that the real-time data stream traffic size is less than the standard traffic size, it determines that the game operation corresponding to the game data request is a cheating operation, and sends the result of the secondary determination to the Redis cache blacklist 60, adding the user to the blacklist.

[0062] Optionally, the aforementioned account blocking process 62 is used to directly block the account bound to the user who is currently performing game operations if the current user is already on the blacklist of users in the game server. If the current user is not on the blacklist of users in the game server, the process obtains the judgment result of the pointer movement trajectory corresponding to the current user's game operations. If the judgment result of the pointer movement trajectory is abnormal, the device used by the user to perform game operations is identified, and the IP address information is determined. If the device is also abnormal and the IP address information is abnormal, the user's bound account is ultimately banned.

[0063] Through the above embodiments, a game monitoring method based on visual algorithms enables game services to accurately monitor cheating mechanisms such as changing the mouse pointer to improve accuracy and character tracking. By setting up visual algorithm plugins to identify game cheats and monitoring players' game screens, the accuracy and efficiency of cheat identification will be greatly improved. The accuracy and efficiency of anti-cheat measures will be greatly improved with algorithm updates, making the application scenarios more extensive.

[0064] It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that the present invention is not limited to the described order of actions, because according to the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to the present invention.

[0065] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods according to the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0066] According to another aspect of the present invention, a detection apparatus for detecting violations in accordance with the above-described method for detecting violations is also provided. For example... Figure 5 As shown, the device includes:

[0067] The receiving module 502 is also used to receive operation data uploaded by the target device, wherein the operation data includes: screen display data of the target object using the game application and data requests of the game application;

[0068] The identification module 504 is also used to identify abnormal operation data when it is determined that there is abnormal operation data to be confirmed in the operation data.

[0069] The determination module 506 is used to determine whether the game application has any violations based on the result of the anomaly identification according to a preset monitoring mechanism.

[0070] Through the aforementioned modules, operation data uploaded by the target device is received. This operation data includes: screen display data of the game application used by the target object and data requests from the game application. If it is determined that there is abnormal operation data to be confirmed, the abnormal operation data is anomaly identified. Anomaly determination is made based on the result of the anomaly identification according to a preset monitoring mechanism to determine whether the game application has engaged in any violations. In other words, when abnormal operation data exists, anomaly identification is performed on the abnormal operation data, and the result of the anomaly identification is determined through a preset monitoring mechanism. This achieves the goal of accurately identifying whether the game application has engaged in any violations, thereby improving the technical efficiency of violation detection and solving the technical problem in the prior art where the detection effect of violations in game applications is not accurate or comprehensive enough.

[0071] Optionally, the above-mentioned identification module is further configured to determine the data content of the abnormal operation data; when the data content is abnormal screen display data, perform a first anomaly identification on the abnormal operation data; and when the data content is an abnormal data request, perform a second anomaly identification on the abnormal operation data.

[0072] Optionally, the aforementioned identification module is further configured to input the abnormal screen display data into a self-visual algorithm model for first anomaly identification to obtain pointer jitter data of the target device. The self-visual algorithm model is trained using multiple sets of data through machine learning. Each set of data includes: target abnormal screen display data, and screen parameters and pointer parameters corresponding to the target abnormal screen display data. The module also parses the pointer jitter data to determine the screen parameters and pointer parameters of the pointer on the target device's display interface. The pointer is an object that receives external operation commands and displays on the target device.

[0073] Optionally, the above-mentioned identification module further includes: a storage unit, used to associate and bind the screen parameters, the pointer parameters, and the abnormal screen display data to obtain a first abnormal identification result of the abnormal operation data; save the first abnormal identification result in the database, and send the first abnormal identification result to the corresponding preset monitoring mechanism.

[0074] Optionally, the aforementioned identification module is further configured to determine the real-time data stream corresponding to the game application that issued the abnormal data request, and determine the data value corresponding to the real-time data stream; if the data value is less than a preset threshold, determine that the abnormal operation data is cheating data, and obtain a second abnormal identification result of the abnormal operation data; if the data value is greater than or equal to the preset threshold, determine that the abnormal operation data is normal transmission data.

[0075] Optionally, the above identification module further includes: an identification unit, used to parse the abnormal data request and determine the account information currently logged in by the target device; if the account information does not exist in a preset blacklist, to add a pending confirmation identifier to the target device, wherein the pending confirmation identifier is used to indicate that the operation data of the target device be re-acquired for secondary confirmation.

[0076] Optionally, the aforementioned determination module is further configured to: determine that the game application on the target device has violated regulations when both a first anomaly identification result and a second anomaly identification result exist; and ban the currently logged-in account information of the game application; detect the device information of the target device when the first anomaly identification result exists; and determine that the game application has violated regulations requiring secondary confirmation when the second anomaly identification result exists.

[0077] It should be noted that the above modules can be implemented by software or hardware. For the latter, they can be implemented in the following ways, but are not limited to: all the above modules are located in the same processor; or, the above modules are located in different processors in any combination.

[0078] Embodiments of the present invention also provide a storage medium storing a computer program, wherein the computer program is configured to execute the steps in any of the above method embodiments when running.

[0079] Optionally, in this embodiment, the storage medium may be configured to store a computer program for performing the following steps:

[0080] S1. Receive operation data uploaded by the target device, wherein the operation data includes: screen display data of the target object using the game application and data requests of the game application;

[0081] S2. If it is determined that there is abnormal operation data to be confirmed in the operation data, perform anomaly identification on the abnormal operation data.

[0082] S3. Based on the preset monitoring mechanism, perform anomaly determination on the results of the anomaly identification to determine whether the game application has any violations.

[0083] Optionally, in this embodiment, the storage medium may include, but is not limited to, various media capable of storing computer programs, such as USB flash drives, read-only memory (ROM), random access memory (RAM), portable hard drives, magnetic disks, or optical disks.

[0084] Optionally, specific examples in this embodiment can refer to the examples described in the above embodiments and optional implementations, and will not be repeated here.

[0085] Embodiments of the present invention also provide an electronic device, including a memory and a processor, wherein the memory stores a computer program and the processor is configured to run the computer program to perform the steps in any of the above method embodiments.

[0086] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor and the input / output device is connected to the processor.

[0087] Optionally, in this embodiment, the processor can be configured to perform the following steps via a computer program:

[0088] S1. Receive operation data uploaded by the target device, wherein the operation data includes: screen display data of the target object using the game application and data requests of the game application;

[0089] S2. If it is determined that there is abnormal operation data to be confirmed in the operation data, perform anomaly identification on the abnormal operation data.

[0090] S3. Based on the preset monitoring mechanism, perform anomaly determination on the results of the anomaly identification to determine whether the game application has any violations.

[0091] Optionally, in this embodiment, those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing the hardware related to the terminal device. The program can be stored in a computer-readable storage medium, which may include: flash drive, read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0092] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0093] If the integrated units in the above embodiments are implemented as software functional units and sold or used as independent products, they can be stored in the aforementioned computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention.

[0094] In the above embodiments of the present invention, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0095] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative; for example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, indirect coupling or communication connection between units or modules, and may be electrical or other forms.

[0096] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0097] Furthermore, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0098] The above description is only a preferred embodiment of the present invention. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for detecting violations, characterized in that, include: Receive operation data uploaded by the target device, wherein the operation data includes: screen display data of the target object using the game application and data requests of the game application; If it is determined that there is abnormal operation data that needs to be confirmed in the operation data, the abnormal operation data is identified as abnormal. The results of the anomaly identification are judged according to the preset monitoring mechanism to determine whether the game application has any violations. The process includes determining whether the game application has engaged in any violations by analyzing the anomaly identification results using a preset monitoring mechanism. If a first anomaly detection result exists and a second anomaly detection result exists simultaneously, it is determined that the game application on the target device has engaged in illegal activities, and the account information currently logged into the game application is banned. If a first anomaly is detected, the device information of the target device is checked, and it is determined that the game application has a violation that requires secondary confirmation. In the presence of a second anomaly detection result, determine the historical records of the currently logged-in account information of the target device, and determine that the game application has violations that require secondary confirmation; The first anomaly identification result is determined in the following way: Determine the screen parameters and pointer parameters of the pointer on the target device's display interface based on the pointer jitter data corresponding to the abnormal screen display data. By associating and binding the screen parameters, the pointer parameters, and the abnormal screen display data, a first abnormality identification result is obtained; The second anomaly identification result is determined in the following way: Determine the real-time data stream corresponding to the game application that issued the abnormal data request, and determine the data value corresponding to the real-time data stream; If the data value is less than a preset threshold, the abnormal operation data is determined to be cheating data, and a second abnormal identification result of the abnormal operation data is obtained.

2. The method according to claim 1, characterized in that, If it is determined that there is abnormal operation data that needs to be confirmed, the abnormal operation data is subjected to anomaly identification, including: Determine the data content of the abnormal operation data; In the case where the data content is abnormal screen display data, the abnormal operation data is subjected to a first anomaly identification; In the case where the data content is an abnormal data request, a second anomaly identification is performed on the abnormal operation data.

3. The method according to claim 1, characterized in that, Based on the pointer jitter data corresponding to the abnormal screen display data, determine the screen parameters and pointer parameters of the pointer on the target device's display interface, including: The abnormal screen display data is input into the self-visual algorithm model for the first abnormality identification to obtain the pointer jitter data of the target device. The self-visual algorithm model is trained by machine learning using multiple sets of data. Each set of data includes: the target abnormal screen display data, and the screen parameters and pointer parameters corresponding to the target abnormal screen display data. The pointer jitter data is analyzed to determine the screen parameters of the pointer on the target device's display interface and the pointer parameters of the pointer on the target device's display interface, wherein the pointer is an object that receives external operation instructions and displays on the target device.

4. The method according to claim 1, characterized in that, After associating and binding the screen parameters, the pointer parameters, and the abnormal screen display data to obtain the first abnormality identification result, the method further includes: The first anomaly identification result is saved in the database, and the first anomaly identification result is sent to the corresponding preset monitoring mechanism.

5. The method according to claim 1, characterized in that, After determining the real-time data stream corresponding to the game application that issued the abnormal data request, and determining the data value corresponding to the real-time data stream, the method further includes: If the data value is greater than or equal to a preset threshold, the abnormal operation data is determined to be normal transmission data.

6. The method according to claim 5, characterized in that, After determining that the abnormal operation data is normal transmission data when the data value is greater than or equal to a preset threshold, the method further includes: The abnormal data request is parsed to determine the account information currently logged into the target device; If the account information does not exist in the preset blacklist, a pending confirmation flag is added to the target device, wherein the pending confirmation flag is used to indicate that the operation data of the target device should be retrieved again for secondary confirmation.

7. A device for detecting violations, characterized in that, include: The receiving module is also used to receive operation data uploaded by the target device, wherein the operation data includes: screen display data of the target object using the game application and data requests of the game application; The identification module is also used to identify abnormal operation data when it is determined that there is abnormal operation data to be confirmed in the operation data. The judgment module is used to make an anomaly judgment on the result of the anomaly identification according to a preset monitoring mechanism, so as to determine whether the game application has any violations. The determination module is further configured to: determine that the game application on the target device has violated regulations when both a first anomaly identification result and a second anomaly identification result exist; and ban the currently logged-in account information of the game application; detect the device information of the target device when the first anomaly identification result exists; and determine that the game application has violated regulations requiring secondary confirmation when the second anomaly identification result exists. The first anomaly identification result is determined in the following way: Determine the screen parameters and pointer parameters of the pointer on the target device's display interface based on the pointer jitter data corresponding to the abnormal screen display data. By associating and binding the screen parameters, the pointer parameters, and the abnormal screen display data, a first abnormality identification result is obtained; The second anomaly identification result is determined in the following way: Determine the real-time data stream corresponding to the game application that issued the abnormal data request, and determine the data value corresponding to the real-time data stream; If the data value is less than a preset threshold, the abnormal operation data is determined to be cheating data, and a second abnormal identification result of the abnormal operation data is obtained.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a stored program, wherein the program, when executed, performs the method according to any one of claims 1 to 6.

9. An electronic device comprising a memory and a processor, characterized in that, The memory stores a computer program, and the processor is configured to execute the method described in any one of claims 1 to 6 through the computer program.

Images