Method, apparatus and electronic device for detecting acceleration cheats in a game

Abstract

The present invention provides a method, device and electronic device for detecting acceleration cheats in a game, which relates to the technical field of games. This method processes the heartbeat data in the game center to obtain a heartbeat matrix corresponding to the game character for detecting acceleration cheats in the game, without the need to collect existing acceleration cheats for detection, improving the detection timeliness rate. Then, according to the heartbeat matrix and a pre-trained detection model, the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat is determined, solving the technical problems of low performance and poor system stability in acceleration cheat detection in the prior art, and achieving the technical effects of having little impact on game operation and high detection accuracy.

Description

Technical Field

[0001] The present invention relates to the technical field of games, and in particular, to a method, device, and electronic device for detecting acceleration cheats in games. Background Art

[0002] Game cheats are cheating programs that obtain benefits by deceiving or modifying games. There are various types of game cheats. In competitive games, acceleration cheats are the key focus of game cheat detectors. An acceleration cheat is a type of cheat that can increase the movement speed, attack speed, etc. of game characters. The existence of acceleration cheats seriously damages the gaming experience of normal players and reduces the fairness and playability of the game.

[0003] In some games that are very sensitive to calculation latency, most data is usually sent to the client side, and the client side completes the calculation and notifies the server of the result. However, the results calculated by the client side are relatively easy to be tampered with by cheats. Therefore, the commonly used cheat detection methods are usually based on the client side.

[0004] Usually, the characteristics of the cheat process recorded by the game client can be used, or the game client can continuously scan the process list in the current operating system to determine whether the process name in the process list is in the blacklist, so as to check whether cheats are used. On the other hand, the game client can also actively use the HOOK mechanism to intervene in the key window operating system application programming interface (Windows API, WinAPI) and enable anti-debugging to prevent cheats from HOOKing these WinAPIs to implement related functions.

[0005] However, since the characteristics of the cheat process will change with the update of the cheat, and a large number of process names need to be stored in the blacklist, it is bound to cause problems of low cheat detection efficiency and reliability. And due to the complexity of Windows system versions, the active HOOK solution is prone to system crashes when the system is updated, affecting the user experience. Summary of the Invention

[0006] The purpose of the present invention is to provide a method, device, and electronic device for detecting acceleration cheats in games, so as to alleviate the technical problems of low performance and poor system stability in existing acceleration cheat detection.

[0007] To achieve the above purpose, the technical solutions adopted in the embodiments of the present invention are as follows:

[0008] In the first aspect, an embodiment of the present invention provides a method for detecting acceleration cheats in games, and the method includes:

[0009] Obtain second heartbeat data, where the second heartbeat data is generated based on the first heartbeat data sent from the client to the server. The second heartbeat data includes a heartbeat number, a sending time interval parameter for the client to send the first heartbeat data, a receiving time parameter for the server to receive the first heartbeat data, and a network status parameter between the client and the server;

[0010] Select multiple time periods, and perform aggregation processing on the second heartbeat data corresponding to each time period among the multiple time periods to obtain a heartbeat sequence corresponding to each time period;

[0011] For the heartbeat sequence corresponding to each time period, obtain a heartbeat matrix corresponding to the same game character from the heartbeat sequence. Each row of data in the heartbeat matrix is the network status parameter, sending time interval parameter, and receiving time parameter corresponding to each heartbeat data included in the heartbeat sequence;

[0012] According to the heartbeat matrix and a pre-trained detection model, determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat.

[0013] In one implementation, after obtaining the second heartbeat data, it further includes: storing the obtained second heartbeat data in a first message queue;

[0014] Before selecting multiple time periods and performing aggregation processing on the second heartbeat data corresponding to each time period among the multiple time periods, it further includes: obtaining the second heartbeat data corresponding to each time period from the first message queue.

[0015] In one implementation, the method further includes:

[0016] In response to the reported information sent by the user, add the user information included in the reported information to a preset suspected list;

[0017] Before storing the obtained second heartbeat data in the first message queue, the method further includes:

[0018] Determine that there is a game character identifier corresponding to the second heartbeat data in the suspected list, or determine that the second heartbeat data is abnormal.

[0019] In one implementation, there is a partially overlapping time period between each subsequent time period and the previous time period among the multiple time periods.

[0020] In one implementation, after obtaining the heartbeat sequence corresponding to each time period, the method further includes:

[0021] Store the heartbeat sequence corresponding to each time period in a second message queue;

[0022] Before obtaining the heartbeat matrix corresponding to the same game character from the above heartbeat sequences for each time period corresponding heartbeat sequence, the above method further includes:

[0023] Obtain the heartbeat sequence corresponding to each time period from the above second message queue.

[0024] In one implementation, the above determining the probability that the game character corresponding to the above heartbeat matrix uses an acceleration hack according to the above heartbeat matrix and the pre-trained detection model includes:

[0025] Determine the largest consecutive number in the number sequence of heartbeat numbers in the heartbeat matrix corresponding to each time period as the target number;

[0026] Screen the rows corresponding to the above target number from the heartbeat matrix corresponding to the above time period to obtain an effective heartbeat matrix;

[0027] Determine the probability that the game character corresponding to the above heartbeat matrix uses an acceleration hack according to the above effective heartbeat matrix and the pre-trained detection model.

[0028] In one implementation, the above determining the probability that the game character corresponding to the above heartbeat matrix uses an acceleration hack according to the above effective heartbeat matrix and the pre-trained detection model includes:

[0029] Perform a difference operation on each row of data in the column corresponding to the above reception time parameter in the above effective heartbeat matrix with the data in the previous row to obtain a reception time interval parameter;

[0030] And update the column corresponding to the above reception time parameter in the above effective heartbeat matrix according to the above reception time interval parameter to obtain a first heartbeat difference matrix;

[0031] Perform a difference operation on each row of data in each column of the above first heartbeat difference matrix with the data in the previous row to obtain an intermediate matrix;

[0032] Insert the above intermediate matrix into the above first heartbeat difference matrix to obtain a target matrix;

[0033] Determine the probability that the game character corresponding to the above heartbeat matrix uses an acceleration hack according to the above target matrix and the pre-trained detection model.

[0034] In one implementation, the above determining the probability that the game character corresponding to the above target matrix uses an acceleration hack according to the above target matrix and the pre-trained detection model includes:

[0035] Perform a normalization process on the above target matrix to obtain a normalized target matrix;

[0036] Extract multiple groups of data with the same number of rows from the above normalization target matrix, and obtain multiple detection matrices from the above multiple groups of data with the same number of rows;

[0037] According to each of the above detection matrices and a pre-trained detection model, determine the initial probability that the game character corresponding to the above heartbeat matrix uses an acceleration cheat;

[0038] According to the initial probability corresponding to each of the above detection matrices, obtain the probability that the game character corresponding to the above heartbeat matrix uses an acceleration cheat.

[0039] In one implementation manner, according to the above heartbeat matrix and a pre-trained detection model, determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the heartbeat matrix and the pre-trained detection model includes:

[0040] Use a sequence network to process the above heartbeat matrix to generate a heartbeat sequence encoding;

[0041] Input the above heartbeat sequence encoding into the pre-trained detection model to determine the probability that the game character corresponding to the above heartbeat matrix uses an acceleration cheat;

[0042] Wherein, the above detection model includes a fully connected network and a Sigmoid network; the above sequence network includes any one of a one-dimensional convolutional network, a recurrent neural network, and a Self-Attention network.

[0043] In one implementation manner, inputting the above heartbeat sequence encoding into the pre-trained detection model to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat includes: inputting multiple above heartbeat matrices corresponding to the same game character into the above pre-trained detection model to generate initial probabilities that the game character corresponding to each of the multiple above heartbeat matrices uses an acceleration cheat;

[0044] The above method further includes: selecting the maximum value among the initial probabilities that the game character corresponding to each of the multiple above heartbeat matrices uses an acceleration cheat as the probability that the game character uses an acceleration cheat.

[0045] In one implementation manner, the above method further includes: determining whether the probability that the game character uses an acceleration cheat is greater than a cheating threshold;

[0046] If the above probability is greater than the above cheating threshold, determine that the game character uses an acceleration cheat, and impose a penalty on the game character that uses the acceleration cheat.

[0047] In one implementation manner, it further includes: using the above heartbeat data and the above probability of the game character as sample data of the detection model;

[0048] Among them, the probability greater than the above cheating threshold and the corresponding heartbeat data are used as positive samples in the sample data; the probability not greater than the above cheating threshold and the corresponding heartbeat data are used as negative samples in the sample data.

[0049] In one implementation, it further includes: pre-training the above detection model to obtain the pre-trained detection model;

[0050] Among them, the sample data for model training includes positive samples and negative samples;

[0051] The above positive samples include the heartbeat data set when the game character uses the acceleration cheat; the above negative samples include the heartbeat data set when the game character does not use the acceleration cheat.

[0052] In a second aspect, an embodiment of the present invention provides a device for detecting acceleration cheats in a game. The device includes: a heartbeat data acquisition module, configured to acquire second heartbeat data, where the second heartbeat data is generated based on the first heartbeat data sent from the client to the server, and the second heartbeat data includes a heartbeat number, a sending time interval parameter for the client to send the first heartbeat data, a receiving time parameter for the server to receive the first heartbeat data, and a network status parameter between the client and the server;

[0053] An aggregation processing module, configured to select multiple time periods, and perform aggregation processing on the second heartbeat data corresponding to each of the multiple time periods to obtain a heartbeat sequence corresponding to each of the time periods;

[0054] A heartbeat matrix acquisition module, configured to, for the heartbeat sequence corresponding to each time period, obtain a heartbeat matrix corresponding to the same game character from the heartbeat sequence, where each row of data in the heartbeat matrix is the network status parameter, the sending time interval parameter, and the receiving time parameter corresponding to each heartbeat data included in the heartbeat sequence;

[0055] A probability determination module, configured to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the heartbeat matrix and the pre-trained detection model.

[0056] In a third aspect, an embodiment of the present invention provides an electronic device, including a memory and a processor. A computer program that can run on the processor is stored in the memory, and when the processor executes the computer program, the steps of the method described in any item of the first aspect are implemented.

[0057] Fourthly, an embodiment of the present invention provides a computer-readable storage medium storing machine-executable instructions. When the computer-executable instructions are called and run by a processor, the computer-executable instructions cause the processor to run the method according to any one of the first aspect above.

[0058] The present invention provides a method, an apparatus and an electronic device for detecting acceleration cheats in a game. By processing the heartbeat data in the game center, a heartbeat matrix corresponding to the game character is obtained to detect acceleration cheats in the game, without the need to collect existing acceleration cheats for detection, improving the detection timeliness rate. Then, according to the heartbeat matrix and a pre-trained detection model, the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat is determined, solving the technical problems of low performance and poor system stability in acceleration cheat detection in the prior art, and achieving the technical effects of having little impact on game operation and high detection accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following will briefly introduce the drawings required for use in the description of the specific embodiments or the prior art. Obviously, the drawings in the following description are some embodiments of the present invention. For those of ordinary skill in the art, other drawings can be obtained based on these drawings without creative efforts.

[0060] Figure 1 It is a schematic flowchart of a method for detecting acceleration cheats in a game provided by an embodiment of the present invention;

[0061] Figure 2 It is a schematic flowchart of another method for detecting acceleration cheats in a game provided by an embodiment of the present invention;

[0062] Figure 3 It is a schematic structural diagram of an apparatus for detecting acceleration cheats in a game provided by an embodiment of the present invention;

[0063] Figure 4 It is a schematic structural diagram of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0064] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the drawings in the embodiments of the present invention. Obviously, the described embodiments are some but not all of the embodiments of the present invention. Usually, the components of the embodiments of the present invention described and illustrated in the drawings here can be arranged and designed in various different configurations.

[0065] Accordingly, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the present invention. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the scope of protection of the present invention.

[0066] It should be noted that like reference numerals and letters denote like items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings.

[0067] In some games that are very sensitive to computing latency, most data is usually offloaded to the client, which completes the calculation and notifies the server of the result. However, the results calculated by the client are relatively easy to be tampered with by cheats. Therefore, the commonly used cheat detection methods are usually based on the client. Cheat detection can generally be carried out in the following ways:

[0068] Method 1: Based on process inspection, the game client records various characteristics of cheat processes and the signature codes generated by memory code segments. When a process with the same characteristics is found during the game operation, it is detected as a cheat and blocked.

[0069] Method 2: Based on client file inspection, the game client continuously scans game files and system files to check if these files have been modified. When unknown program files such as Dynamic Link Libraries (DLLs) are found, they are also uploaded to the server for analysis of possible dangerous behaviors to decide whether to pursue and block.

[0070] Method 3: WinAPI protection. The game client will actively intervene in key WinAPIs using the HOOK mechanism and enable anti-debugging to prevent cheats from HOOKing these WinAPIs to implement related functions.

[0071] Regarding Method 1 and Method 2, since the characteristics of cheat processes change with the update of cheats and a large number of process names need to be stored in the blacklist, it is bound to cause problems of low cheat detection efficiency and reliability. Regarding Method 3, due to the complexity of Windows system versions, the active HOOK solution is prone to system crashes during system updates, affecting the user experience. For a long time, the traditional client-based detection solutions, even though continuously upgraded in the struggle with cheat makers to strive for comprehensiveness, can only raise the threshold of cheat making and cannot fundamentally change the current situation of the still rampant cheats. And even if only one cheat player appears in a game, it will have a great impact on everyone's gaming experience.

[0072] Based on this, embodiments of the present invention provide a method, device, and electronic device for detecting acceleration cheats in a game to alleviate the technical problems of low performance and poor system stability in detecting acceleration cheats in the prior art.

[0073] To facilitate the understanding of this embodiment, first, a method for detecting acceleration cheats in a game disclosed in the embodiments of the present invention will be introduced in detail. Refer to Figure 1 the flowchart of a method for detecting acceleration cheats in a game shown in the figure. This method mainly includes the following steps S110 to step S130:

[0074] S110: Obtain second heartbeat data, which is generated based on the first heartbeat data sent from the client to the server; the second heartbeat data includes a heartbeat number, a transmission time interval parameter for the client to send the first heartbeat data, a reception time parameter for the server to receive the first heartbeat data, and a network status parameter between the client and the server;

[0075] Among them, the role of heartbeat data is to confirm whether both parties in the interconnection are in an online state, or whether the communication link between the two parties in the interconnection is disconnected. In the method provided in this embodiment, the two parties in the interconnection can be a game client and a game server. At the beginning of each game, the game client actively loads a script. Whenever the game client communicates with the game server, the script inserts initial heartbeat data into the communication data, and the initial heartbeat data is sent to the game server together with the communication data.

[0076] In one embodiment, the initial heartbeat data includes player information, a heartbeat number, and an initial time parameter. Among them, the initial time parameter usually includes a transmission interval and a network delay.

[0077] As a specific example, the player information may include a character ID, a server ID, a game session ID, etc., as an identifier to distinguish different players. The heartbeat number represents the number of the heartbeat data of each character in each game. For example, the number of the first heartbeat data is 1, the number of the second heartbeat data is 2, and so on.

[0078] The transmission interval in the time parameter is the difference between the transmission time of the current heartbeat data and the transmission time of the previous heartbeat data. Here, the heartbeat data is the data sent from the game client to the game server, that is, the heartbeat data of the same character ID.

[0079] Network latency is an indicator used to measure the network condition. The Round-Trip Time (RTT), as an important performance indicator in computer networks, represents the total latency experienced from the time when the data is sent from the sender until the sender receives the acknowledgment from the receiver (the receiver sends the acknowledgment immediately after receiving the data). Here, the network latency SRTT is obtained after smoothing the round-trip latency RTT. The calculation formula is: SRTT = (α * SRTT) + ((1 - α) * RTT), where α is the smoothing parameter, and generally takes a value of 0.125.

[0080] In one embodiment, the second heartbeat data is generated by the game server based on the server time when receiving the first heartbeat data after receiving the first heartbeat data. That is to say, each piece of second heartbeat data includes a heartbeat number, a sending time interval parameter for the client to send the first heartbeat data, a receiving time parameter for the server to receive the first heartbeat data, and a network status parameter between the client and the server.

[0081] Among them, the receiving time parameter for the server to receive the first heartbeat data can be the server receiving time, which is generally the time elapsed from the start of the game to receiving this heartbeat data, that is, the time between the start time point 1 of the game and the time point 2 when the heartbeat data is received, with the unit of seconds. For example: The game starts at 00:01:00; The game server receives a piece of first heartbeat data at 00:01:03, then the receiving time is 3s; The game server receives another piece of first heartbeat data at 00:01:04, then the receiving time is 4s.

[0082] After the above steps, several pieces of second heartbeat data of the same player information can be generated.

[0083] S120: Select multiple time periods, and perform aggregation processing on the second heartbeat data corresponding to each time period in the multiple time periods to obtain a heartbeat sequence corresponding to each time period;

[0084] Among them, there is a partially overlapping time period between each subsequent time period and the previous time period in the multiple time periods.

[0085] In one embodiment, after obtaining the second heartbeat data, the obtained second heartbeat data is stored in the first message queue.

[0086] Among them, the heartbeat sequence is aggregated from the filtered second heartbeat data. That is to say, before generating the heartbeat sequence, the generated several pieces of second heartbeat data can be filtered first. As a specific example, the filtering method includes: responding to the reported information sent by the user, adding the user information included in the reported information to the preset suspected list; then determining the game character identifier corresponding to the second heartbeat data in the suspected list, or determining that the second heartbeat data is abnormal.

[0087] Among them, the external plug-in reporting information may include the information of the reported player, and the player information may include the player's game character, number of battle matches, battle room, game server, etc.

[0088] Generally, when a player discovers that another player may be suspected of using an external plug-in in the game, the player can report the other player through the reporting button in the game. After the game server receives the reporting information, the information of the reported player is added to the suspected list. When a player is reported more than a certain number of times, the player is added to the key suspected list. If a player in the key suspected list is not reported within a certain period of time, the player will be transferred to the suspected list; if a player in the suspected list is not reported within a certain period of time, the player will be removed from the list.

[0089] If the first player information in the second heartbeat data does not exist in the key suspected list, the second heartbeat data is preliminarily screened. If it is determined that the frequency of the game client sending the initial heartbeat data is inconsistent with the frequency of the server receiving the initial heartbeat data, the second heartbeat data is added to the first message queue. After the above screening, several second heartbeat data in the first message queue can be aggregated into multiple heartbeat sequences according to the order of the heartbeat numbers at a first time interval.

[0090] Among them, the selection of the first time interval needs to meet certain conditions. Regarding each first time interval as a time period, it is necessary to meet the condition that the currently selected time period overlaps with the previous time period. For example: if the previous time period is 10:00:00 - 10:02:00, then the current new time period is 10:01:00 - 10:03:00. This overlap between time periods is a necessary condition for constructing the subsequent detection matrix. Assuming that the time period selection has an overlap, and the selected time periods are a, 10:00:00 - 10:02:00, b, 10:01:00 - 10:03:00, c, 10:02:00 - 10:04:00, then the data in the middle t rows of the b time period can form a detection data.

[0091] In one embodiment, after obtaining the heartbeat sequence corresponding to each time period, the heartbeat sequence corresponding to each time period is stored in the second message queue. For the heartbeat sequence corresponding to each time period, before obtaining the heartbeat matrix corresponding to the same game character from the heartbeat sequence, the heartbeat sequence corresponding to each time period is obtained from the second message queue.

[0092] Among them, the message queue is a caching mechanism. After the game client generates the initial heartbeat data, it adds the data to the first message queue. The game client can then generate the next initial heartbeat data without waiting for when this data will be processed.

[0093] As a specific example, this step includes: obtaining second heartbeat data from the first message queue, performing a windowing operation to generate a heartbeat sequence, and writing it into the "second message queue".

[0094] Among them, the windowing operation may include: Step 1, select a time period, aggregate the second heartbeat data within the time period to generate a heartbeat sequence. When aggregating, it is necessary to sort according to the order of the heartbeat numbers. An example of aggregating three pieces of second heartbeat data: "Role ID: role1, Server ID: server1, Session ID: room1, Heartbeat numbers: [1, 2, 3], Transmission intervals: [0.5, 0.51, 0.52], Srtt: [0.4, 0.3, 0.2], Server reception times: [1, 2, 3]"; Step 2, select a new time period, aggregate the second heartbeat data within the time period to generate a heartbeat sequence. The new time period will have an overlapping part with the previous time period. For example, the previous time period is 10:00:00 - 10:02:00, and the new time period is 10:01:00 - 10:03:00. Step 3, repeat the above Step 2.

[0095] S130: For the heartbeat sequence corresponding to each time period, obtain the heartbeat matrix corresponding to the same game role from the heartbeat sequence;

[0096] Among them, each row of data in the heartbeat matrix is the network status parameter, transmission time interval parameter, and reception time parameter corresponding to each heartbeat data included in the heartbeat sequence.

[0097] S140: According to the heartbeat matrix and the pre-trained detection model, determine the probability that the game role corresponding to the heartbeat matrix uses an acceleration cheat.

[0098] In one embodiment, the above-mentioned determining the probability that the game role corresponding to the heartbeat matrix uses an acceleration cheat according to the heartbeat matrix and the pre-trained detection model includes:

[0099] S41: Determine the largest consecutive number in the heartbeat number sequence in the heartbeat matrix corresponding to each time period as the target number;

[0100] S42: Screen the rows corresponding to the target number from the heartbeat matrix corresponding to the time period to obtain an effective heartbeat matrix;

[0101] S43: According to the effective heartbeat matrix and the pre-trained detection model, determine the probability that the game role corresponding to the heartbeat matrix uses an acceleration cheat.

[0102] Among them, determining the probability that the game role corresponding to the heartbeat matrix uses an acceleration cheat according to the effective heartbeat matrix and the pre-trained detection model may include:

[0103] S431: Perform a difference operation on each row of data in the column corresponding to the reception time parameter in the valid heartbeat matrix with the previous row of data to obtain the reception time interval parameter;

[0104] S432: And update the column corresponding to the reception time parameter in the valid heartbeat matrix according to the reception time interval parameter to obtain the first heartbeat difference matrix;

[0105] S433: Perform a difference operation on each row of data in each column of the first heartbeat difference matrix with the previous row of data to obtain an intermediate matrix;

[0106] S434: Insert the intermediate matrix into the first heartbeat difference matrix to obtain the target matrix;

[0107] S435: Determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the target matrix and the pre-trained detection model.

[0108] Further, determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the target matrix and the pre-trained detection model includes: performing a normalization process on the target matrix to obtain a normalized target matrix; extracting multiple groups of data with the same number of rows from the normalized target matrix, and obtaining multiple detection matrices from the multiple groups of data with the same number of rows; determining the initial probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to each detection matrix and the pre-trained detection model; obtaining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the initial probability corresponding to each detection matrix.

[0109] As a specific example, read a heartbeat sequence from the "second message queue", and extract the character ID, server ID, room ID, heartbeat number sequence, and heartbeat matrix therefrom. The heartbeat matrix is a matrix of size [N, 3], where "N" is the sequence length, representing that the heartbeat sequence contains N heartbeat data; "3" represents that there are three columns of data, namely srtt, sending interval, and server reception time, in the matrix. At the same time, srtt is the first column, the sending interval is the second column, and the server reception time is the third column.

[0110] Check the heartbeat number sequence, and extract the largest continuous number sequence therefrom. For example, 1, 2, 3, 5, 6, 7, 8, 10, the largest continuous number sequence is 5, 6, 7, 8. Extract the rows corresponding to the largest continuous number sequence from the heartbeat matrix to form a valid heartbeat matrix.

[0111] Perform a first - order difference operation on the valid heartbeat matrix to generate a first - order difference heartbeat matrix; the first - order difference heartbeat matrix includes: network delay, first transmission interval, and server reception interval; perform a second - order difference operation on the first - order difference heartbeat matrix to generate a second - order difference heartbeat matrix; the second - order difference heartbeat matrix includes: network delay, first transmission interval, server reception interval, network delay parameter, first transmission interval parameter, server reception interval parameter.

[0112] Convert the valid heartbeat matrix into a first - order difference heartbeat matrix. Take the difference of the third column (server reception time) in the valid heartbeat matrix (i.e., the current row - the previous row), and replace the original third column. The size of the matrix after the difference is [N - 1, 3]. The column obtained through the difference operation is the reception interval.

[0113] The steps of generating a heartbeat detection matrix according to the heartbeat sequence further include: performing a normalization operation on the second - order difference heartbeat matrix to generate a normalized heartbeat matrix; among them, the normalization coefficients used for the normalization operation include a mean coefficient and a variance coefficient; extract the data of the first number of rows and the second number of rows of the normalized heartbeat matrix to form a heartbeat detection matrix.

[0114] Convert the first - order difference heartbeat matrix into a second - order difference heartbeat matrix. Take the difference of each column in the first - order difference heartbeat matrix (i.e., the current row - the previous row), and insert the new three columns into the matrix. The size of the matrix after the difference is [N - 2, 6]. Through this difference operation, the changing trends of Srtt, transmission interval, and reception interval can be obtained.

[0115] Convert the second - order difference heartbeat matrix into a normalized matrix. Obtain the normalization coefficients a1, b1, a2, b2, a3, b3, a4, b4, a5, b5, a6, b6. For each data in the first column of the heartbeat difference matrix, perform the following operation: x1’=(x1 - a1) / b1. For each data in the second column of the heartbeat difference matrix, perform the following operation: x2’=(x2 - a2) / b2. For each data in the third column of the heartbeat difference matrix, perform the following operation: x3’=(x3 - a3) / b3. For each data in the fourth column of the heartbeat difference matrix, perform the following operation: x4’=(x4 - a4) / b4. For each data in the fifth column of the heartbeat difference matrix, perform the following operation: x5’=(x5 - a5) / b5. For each data in the sixth column of the heartbeat difference matrix, perform the following operation: x6’=(x6 - a6) / b6.

[0116] Among them, a1 and b1 are the mean and variance of the data in the first column of the second - order difference heartbeat matrix in the historical data. The same applies to other data.

[0117] Then the normalization matrix is transformed into a heartbeat detection matrix. Take the data of rows 1 to t to obtain detection matrix 0, take the data of rows t+1 to 2*t to obtain detection matrix 1. Take the data of rows i*t+1 to (i+1)*t to obtain the model input matrix i, that is, detection matrix i, where i can take values 0, 1, 2, 3, 4....n-1, that is, a normalization matrix can be transformed into several (n) heartbeat detection matrices. n is the result of dividing the length of the normalization matrix by t, that is, only take the quotient.

[0118] In one embodiment, before the step of determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the heartbeat matrix and the pre-trained detection model, the detection model can be pre-trained; wherein, the sample data for model training includes positive samples and negative samples; the positive samples are the heartbeat data sets when the game characters using acceleration cheats are playing games; the negative samples are the heartbeat data sets when the game characters not using acceleration cheats are playing games.

[0119] In one embodiment, the sequence network can be used to process the heartbeat matrix to generate a heartbeat sequence encoding; then the heartbeat sequence encoding is input into the pre-trained detection model to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat.

[0120] Among them, the detection model includes a fully connected network and a Sigmoid network; the sequence network includes any one of a one-dimensional convolutional network, a recurrent neural network, and a Self-Attention network.

[0121] As a specific example, the above-mentioned inputting the heartbeat sequence encoding into the pre-trained detection model to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat can include: inputting multiple heartbeat matrices corresponding to the same game character into the pre-trained detection model to generate the initial probabilities that the game characters corresponding to the multiple heartbeat matrices use acceleration cheats respectively.

[0122] Refer to Figure 2 As shown, the above method can also include:

[0123] S210: Select the maximum value among the initial probabilities that the game characters corresponding to the multiple heartbeat matrices use acceleration cheats as the probability that the game character uses an acceleration cheat;

[0124] S220: Determine whether the probability that the game character uses an acceleration cheat is greater than the cheating threshold; if the probability is greater than the cheating threshold, determine that the game character uses an acceleration cheat and impose a penalty on the game character using the acceleration cheat.

[0125] For the data determined to be cheats, record the character-related data into the MySQL database, including: character ID, server ID, room ID, and detection time. At the same time, send this data to the game server to impose penalty measures on the character. Also record the heartbeat data (stored in the form of a detection matrix) and the final suspicion degree to the data center. The role of this part of the data: expand the positive samples for offline iteration of the model or for later verification.

[0126] For those not determined to be cheats, provide two ways to save the heartbeat data (stored in the form of a detection matrix) and the final suspicion degree to the data center: save with a certain probability or save for a certain time limit and automatically delete when expired. The role of this part of the data: expand the negative samples for offline iteration of the model; when it is found that there are cheats that have been missed in the ban, the corresponding heartbeat data can be obtained from here and added to the positive samples.

[0127] In one embodiment, the method may further include another implementation:

[0128] Use the heartbeat data of the game character and the probability of using an acceleration cheat as sample data for the detection model;

[0129] Among them, the probability greater than the cheat threshold and the corresponding heartbeat data are used as positive samples in the sample data; the probability not greater than the cheat threshold and the corresponding heartbeat data are used as negative samples in the sample data.

[0130] And the above sample data can be used to perform offline training on the detection model.

[0131] Among them, the sample data of the detection model can be obtained through the following three ways: 1. Discover cheating players through other detection schemes and query their corresponding heartbeat data as positive samples. 2. Collect cheats, manually activate the cheats, collect the heartbeat data, and query their corresponding heartbeat data as positive samples. 3. Randomly query the heartbeat data and remove the data in 1 and 2 from it as negative samples.

[0132] In addition, in a specific implementation, the method for detecting acceleration cheats in the game can also perform data query, query multiple information such as character ID, server ID, room ID, detection time, etc., and the corresponding heartbeat data through the query interface. Data query can be used to verify later whether the data is a missed ban or a misban; or when constructing the training set of the detection model, obtain historical heartbeat data through the interface.

[0133] The present invention provides a method for detecting acceleration cheats in a game. By processing the heartbeat data in the game center, a heartbeat matrix corresponding to the game character is obtained to detect acceleration cheats in the game, without collecting existing acceleration cheats for detection, which improves the detection timeliness rate. Then, according to the heartbeat matrix and a pre-trained detection model, the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat is determined, solving the technical problems of low performance and poor system stability in the detection of acceleration cheats in the prior art, and achieving the technical effects of having little impact on the game operation and high detection accuracy.

[0134] The embodiment of the present application also provides a device for detecting acceleration cheats in a game. Refer to Figure 3 , the device includes:

[0135] A heartbeat data acquisition module 310, configured to acquire second heartbeat data, where the second heartbeat data is generated according to the first heartbeat data sent from the client to the server, and the second heartbeat data includes a heartbeat number, a sending time interval parameter of the client sending the first heartbeat data, a receiving time parameter of the server receiving the first heartbeat data, and a network state parameter between the client and the server;

[0136] An aggregation processing module 320, configured to select multiple time periods, and perform aggregation processing on the second heartbeat data corresponding to each time period among the multiple time periods to obtain a heartbeat sequence corresponding to each time period;

[0137] A heartbeat matrix acquisition module 330, configured to, for the heartbeat sequence corresponding to each time period, acquire a heartbeat matrix corresponding to the same game character from the heartbeat sequence, where each row of data in the heartbeat matrix is the network state parameter, the sending time interval parameter, and the receiving time parameter corresponding to each heartbeat data included in the heartbeat sequence;

[0138] A probability determination module 340, configured to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the heartbeat matrix and a pre-trained detection model.

[0139] Compared with the traditional solution, the method for detecting acceleration cheats in the game provided by the embodiment of the present application does not need to collect all acceleration cheats on the market, but judges through the communication data between the game client and the service area, with a wider coverage and a higher recall rate; and can automatically discover new acceleration cheats, and the subsequent manual iteration cost is low. Most importantly, the method provided by this embodiment does not perform detection based on the client, and hardly affects the game performance of players.

[0140] Such as Figure 4As shown in the figure, an electronic device 500 provided by an embodiment of the present application includes: a processor 501, a memory 502, and a bus. The memory 502 stores machine-readable instructions executable by the processor 501. When the electronic device runs, the processor 501 communicates with the memory 502 through the bus, and the processor 501 executes the machine-readable instructions to perform the steps of the method for detecting an acceleration cheat in the game as described above.

[0141] Specifically, the above-mentioned memory 502 and processor 501 can be general-purpose memory and processor, which are not specifically limited here. When the processor 501 runs the computer program stored in the memory 502, it can execute the method for detecting an acceleration cheat in the game as described above.

[0142] Corresponding to the method for detecting an acceleration cheat in the game as described above, an embodiment of the present application also provides a computer-readable storage medium. A computer program is stored on the computer-readable storage medium, and when the computer program is run by a processor, it executes the steps of the method for detecting an acceleration cheat in the game as described above.

[0143] The device for detecting an acceleration cheat in the game provided by an embodiment of the present application can be specific hardware on the device or software or firmware installed on the device, etc. The implementation principle and the technical effects produced by the device provided by an embodiment of the present application are the same as those of the foregoing method embodiment. For the sake of brief description, for the parts not mentioned in the device embodiment, reference can be made to the corresponding content in the foregoing method embodiment. Those skilled in the art can clearly understand that for the convenience and brevity of description, the specific working processes of the systems, devices, and units described above can all refer to the corresponding processes in the foregoing method embodiment, and will not be repeated here.

[0144] In the embodiments provided by the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of the units is only a logical function division, and there can be other division methods in actual implementation. For another example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the displayed or discussed mutual coupling or direct coupling or communication connection can be through some communication interfaces. The indirect coupling or communication connection of the devices or units can be in an electrical, mechanical, or other form.

[0145] The units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they can be located in one place, or they can be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0146] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, may exist separately as individual physical units, or two or more units may be integrated into one unit.

[0147] If the above-mentioned functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application, in essence, or the part that contributes to the prior art, or a part of this technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes: various media such as USB flash drives, mobile hard disks, read-only memories (ROM, Read-Only Memory), random access memories (RAM, Random Access Memory), magnetic disks, or optical discs that can store program codes.

[0148] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined and explained in subsequent drawings. In addition, the terms "first", "second", "third", etc. are only used for distinguishing descriptions and cannot be understood as indicating or implying relative importance.

[0149] Finally, it should be noted that: the above-mentioned embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that: they can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the scope of the technical solutions of the various embodiments of the present invention.

Claims

1. A method for detecting acceleration cheats in a game, characterized in that, it includes: Obtain second heartbeat data, where the second heartbeat data is generated based on the first heartbeat data sent from the client to the server, and the second heartbeat data includes a heartbeat number, a sending time interval parameter for the client to send the first heartbeat data, a receiving time parameter for the server to receive the first heartbeat data, and a network status parameter between the client and the server; Select multiple time periods, perform aggregation processing on the second heartbeat data corresponding to each time period in the multiple time periods to obtain a heartbeat sequence corresponding to each time period; For the heartbeat sequence corresponding to each time period, obtain a heartbeat matrix corresponding to the same game character from the heartbeat sequence, and each row of data in the heartbeat matrix is the network status parameter, sending time interval parameter, and receiving time parameter corresponding to each heartbeat data included in the heartbeat sequence; According to the heartbeat matrix and a pre-trained detection model, determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat; The step of determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the heartbeat matrix and a pre-trained detection model includes: determining the largest consecutive number in the heartbeat number sequence in the heartbeat matrix corresponding to each time period as the target number; screening the rows corresponding to the target number from the heartbeat matrix corresponding to the time period to obtain an effective heartbeat matrix; according to the effective heartbeat matrix and a pre-trained detection model, determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat; The step of determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the effective heartbeat matrix and a pre-trained detection model includes: performing a difference process on each row of data in the column corresponding to the receiving time parameter in the effective heartbeat matrix with the previous row of data to obtain a receiving time interval parameter; and updating the column corresponding to the receiving time parameter in the effective heartbeat matrix according to the receiving time interval parameter to obtain a first heartbeat difference matrix; performing a difference process on each row of data in each column of the first heartbeat difference matrix with the previous row of data to obtain an intermediate matrix; inserting the intermediate matrix into the first heartbeat difference matrix to obtain a target matrix; according to the target matrix and a pre-trained detection model, determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat; The step of determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the target matrix and a pre-trained detection model includes: performing a normalization process on the target matrix to obtain a normalized target matrix; extracting multiple groups of data with the same number of rows from the normalized target matrix, and obtaining multiple detection matrices from the multiple groups of data with the same number of rows; according to each detection matrix and a pre-trained detection model, determine the initial probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat; according to the initial probability corresponding to each detection matrix, obtain the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat.

2. The method according to claim 1, It is characterized in that After obtaining the second heartbeat data, it further includes: Storing the obtained second heartbeat data into the first message queue; Before selecting multiple time periods and performing aggregation processing on the second heartbeat data corresponding to each time period among the multiple time periods, it further includes: Obtaining the second heartbeat data corresponding to each time period from the first message queue.

3. The method according to claim 1, It is characterized in that The method further includes: In response to the reported information sent by the user, adding the user information included in the reported information to a preset suspected list; Before storing the obtained second heartbeat data into the first message queue, the method further includes: Determining that the game character identifier corresponding to the second heartbeat data exists in the suspected list, or determining that the second heartbeat data is abnormal.

4. The method according to claim 1, It is characterized in that There is a partially overlapping time period between each subsequent time period and the previous time period among the multiple time periods.

5. The method according to claim 1, It is characterized in that After obtaining the heartbeat sequence corresponding to each time period, the method further includes: Storing the heartbeat sequence corresponding to each time period into the second message queue; Before obtaining the heartbeat matrix corresponding to the same game character from the heartbeat sequence for each time period, the method further includes: Obtaining the heartbeat sequence corresponding to each time period from the second message queue.

6. The method according to claim 1, It is characterized in that Determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration hack according to the heartbeat matrix and a pre-trained detection model includes: Processing the heartbeat matrix by using a sequence network to generate a heartbeat sequence encoding; Inputting the heartbeat sequence encoding into the pre-trained detection model to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration hack; Wherein, the detection model includes a fully connected network and a Sigmoid network; the sequence network includes any one of a one-dimensional convolutional network, a recurrent neural network, and a Self-Attention network.

7. The method according to claim 6, It is characterized in that Inputting the heartbeat sequence encoding into the pre-trained detection model to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration hack includes: Inputting multiple heartbeat matrices corresponding to the same game character into the pre-trained detection model to generate initial probabilities that the game characters corresponding to the multiple heartbeat matrices use acceleration hacks respectively; The method further includes: Selecting the maximum value among the initial probabilities that the game characters corresponding to the multiple heartbeat matrices use acceleration hacks respectively as the probability that the game character uses an acceleration hack.

8. The method according to claim 7, It is characterized in that The method further includes: Judging whether the probability that the game character uses an acceleration hack is greater than the hacking threshold; If the probability is greater than the hacking threshold, determining that the game character uses an acceleration hack and imposing a penalty on the game character that uses the acceleration hack.

9. The method according to claim 8, It is characterized in that Further comprising: Using the heartbeat data and the probability of the game character as sample data for the detection model; Among them, the probability greater than the cheating threshold and the corresponding heartbeat data are used as positive samples in the sample data; The probability not greater than the cheating threshold and the corresponding heartbeat data are used as negative samples in the sample data.

10. The method according to claim 1, characterized in that further comprising: Pre-training the detection model in advance to obtain the pre-trained detection model; Among them, the sample data for model training includes positive samples and negative samples; The positive samples include the heartbeat data set when the game character uses the acceleration cheat; the negative samples include the heartbeat data set when the game character does not use the acceleration cheat.

11. An acceleration cheat detection device in a game, characterized in that comprising: A heartbeat data acquisition module, configured to acquire second heartbeat data, where the second heartbeat data is generated based on the first heartbeat data sent from the client to the server, and the second heartbeat data includes a heartbeat number, a sending time interval parameter for the client to send the first heartbeat data, a receiving time parameter for the server to receive the first heartbeat data, and a network status parameter between the client and the server; An aggregation processing module, configured to select multiple time periods, perform aggregation processing on the second heartbeat data corresponding to each time period in the multiple time periods, and obtain a heartbeat sequence corresponding to each time period; A heartbeat matrix acquisition module, configured to, for the heartbeat sequence corresponding to each time period, obtain a heartbeat matrix corresponding to the same game character from the heartbeat sequence, and each row of data in the heartbeat matrix is the network status parameter, the sending time interval parameter, and the receiving time parameter corresponding to each heartbeat data included in the heartbeat sequence; A probability determination module, configured to determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the heartbeat matrix and the pre-trained detection model; The probability determination module is further configured to: determine the largest consecutive number in the heartbeat number sequence in the heartbeat matrix corresponding to each time period as the target number; screen the rows corresponding to the target number from the heartbeat matrix corresponding to the time period to obtain an effective heartbeat matrix; and determine the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the effective heartbeat matrix and the pre-trained detection model; Among them, determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the effective heartbeat matrix and a pre-trained detection model includes: performing a difference operation on each row of data in the column corresponding to the reception time parameter in the effective heartbeat matrix with the data in the previous row to obtain a reception time interval parameter; and updating the column corresponding to the reception time parameter in the effective heartbeat matrix according to the reception time interval parameter to obtain a first heartbeat difference matrix; performing a difference operation on each row of data in each column of the first heartbeat difference matrix with the data in the previous row to obtain an intermediate matrix; inserting the intermediate matrix into the first heartbeat difference matrix to obtain a target matrix; determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the target matrix and the pre-trained detection model; Among them, determining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the target matrix and the pre-trained detection model includes: performing a normalization process on the target matrix to obtain a normalized target matrix; extracting multiple groups of data with the same number of rows from the normalized target matrix, and obtaining multiple detection matrices from the multiple groups of data with the same number of rows; determining the initial probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to each detection matrix and the pre-trained detection model; obtaining the probability that the game character corresponding to the heartbeat matrix uses an acceleration cheat according to the initial probability corresponding to each detection matrix.

12. An electronic device, including a memory and a processor, where a computer program that can run on the processor is stored in the memory, Characterized in that, When the processor executes the computer program, the steps of the method described in any one of claims 1 to 10 above are implemented.

13. A computer-readable storage medium, Characterized in that, The computer-readable storage medium stores machine-executable instructions, and when the computer-executable instructions are called and run by a processor, the computer-executable instructions cause the processor to run the method described in any one of claims 1 to 10.

Images