Cheating behavior identification method and device, storage medium and electronic equipment

Abstract

The present disclosure relates to the technical field of computer, and discloses a cheating behavior identification method and device, a storage medium and an electronic device. The method comprises: establishing a full-duplex communication protocol Websocket connection with a target client; receiving first game operation information fed back by the target client within a first preset time period based on the Websocket connection, and calculating the untrustworthiness of the target client according to the first game operation information and corresponding second game operation information, wherein the first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information; in response to the untrustworthiness meeting a first preset identification condition, outputting a first identification result, wherein the first identification result is used to indicate that the user corresponding to the target client has cheating behavior. The present disclosure can improve the accuracy and real-time performance of detecting cheating behavior.

Description

Technical Field

[0001] The embodiments of this disclosure relate to the field of computer technology, and more specifically, the embodiments of this disclosure relate to cheating behavior identification methods, cheating behavior identification devices, computer-readable storage media, and electronic devices. Background Technology

[0002] This section is intended to provide background or context for the embodiments of this disclosure set forth in the claims, and the description herein is not acknowledged as prior art simply because it is included in this section.

[0003] With the development of computer and internet technology, users in many scenarios profit unfairly by tampering with client-side behavioral and time data. For example, some use third-party software to modify game data for user gain. This undermines game fairness and causes user churn, while also accelerating game pace and resource production, thus harming developers' interests.

[0004] In related technologies, cheating behavior is only detected after the user has already benefited, resulting in a lack of real-time detection. Recovering the cheating behavior through the system afterwards increases development and costs. Furthermore, the detection relies on historical operation data to detect current behavior, and the detection results are limited by the accuracy of the historical operation data. Summary of the Invention

[0005] In this context, embodiments of the present disclosure are intended to provide a cheating behavior identification method, a cheating behavior identification device, a computer-readable storage medium, and an electronic device.

[0006] According to a first aspect of the present disclosure, a method for identifying cheating behavior is provided, applied to a target service node in a service cluster, comprising: establishing a full-duplex WebSocket connection with a target client; receiving first game operation information fed back by the target client within a first preset time period based on the WebSocket connection, and calculating the unreliability of the target client based on the first game operation information and corresponding second game operation information, wherein the first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information; and outputting a first identification result in response to the unreliability meeting a first preset identification condition, wherein the first identification result is used to indicate that the user corresponding to the target client has cheating behavior.

[0007] In an exemplary embodiment of this disclosure, establishing a full-duplex WebSocket connection with a target client includes: receiving connection request information sent by the target client for establishing a WebSocket connection, the connection request information including at least protocol transmission information and user information corresponding to the target client, the protocol transmission information being resource information required to establish a WebSocket connection; determining, based on the protocol transmission information, whether the target client has already created a WebSocket connection; and if the target client has already created a WebSocket connection, stopping the current attempt to establish a WebSocket connection.

[0008] In an exemplary embodiment of this disclosure, the method further includes: if the target client has not created a Websocket connection, verifying the user information according to a preset user authentication rule; in response to the user information passing the verification of the user authentication rule, establishing a Websocket connection with the target client to interact with the target client based on the Websocket connection.

[0009] In an exemplary embodiment of this disclosure, determining whether the target client has created a WebSocket connection based on the protocol transmission information includes: obtaining the terminal application identifier in the protocol transmission information and querying whether there is a channel identifier for a WebSocket connection corresponding to the terminal application identifier; or querying whether there is a service node identifier corresponding to the terminal application identifier.

[0010] In an exemplary embodiment of this disclosure, after establishing a full-duplex WebSocket connection with the target client, the method further includes: establishing a mapping relationship with the target client, so that when the target client initiates another WebSocket connection, it can establish a WebSocket connection with the corresponding target service node according to the mapping relationship.

[0011] In an exemplary embodiment of this disclosure, the step of receiving first game operation information fed back by the target client within a first preset time period, and calculating the unreliability of the target client based on the first game operation information and the corresponding second game operation information, includes: receiving first game operation information of multiple dimensions fed back by the target client within the first preset time period, wherein the first game operation information of multiple dimensions is randomly collected by the target client within the first preset time period; calculating the corresponding unreliability for each dimension of the first game operation information based on the first game operation information and the corresponding second game operation information; and fusing the unreliability corresponding to the multiple dimensions to obtain the unreliability of the target client.

[0012] In an exemplary embodiment of this disclosure, the step of calculating the corresponding unreliability for each dimension of the first game operation information based on the first game operation information and the corresponding second game operation information includes: obtaining deviation data of the first game operation information relative to the second game operation information, and determining the corresponding unreliability based on the deviation data.

[0013] In an exemplary embodiment of this disclosure, the step of calculating the corresponding unreliability for each dimension of the first game operation information based on the first game operation information and the corresponding second game operation information includes: obtaining the first game operation information conforming to the target operation range specified by the second game operation information, wherein the second game operation information includes multiple preset operation ranges; and determining the corresponding unreliability based on the unreliability score corresponding to the target operation range.

[0014] In an exemplary embodiment of this disclosure, the step of fusing the unreliability corresponding to the multiple dimensions to obtain the unreliability of the target customer includes: fusing the unreliability corresponding to the multiple dimensions according to the unreliability corresponding to the multiple dimensions and the unreliability weights corresponding to the multiple dimensions; and using the fusing calculation result as the unreliability of the target customer.

[0015] In an exemplary embodiment of this disclosure, the step of responding to the unreliability meeting the first preset identification condition and outputting the first identification result includes: during the process of receiving the first game operation information, if there is an unreliability corresponding to the target dimension that meets the first preset identification condition, then outputting the first identification result.

[0016] In an exemplary embodiment of this disclosure, the step of fusing and calculating the unreliability corresponding to the multiple dimensions to obtain the unreliability of the target client includes: accumulating and calculating the unreliability corresponding to the multiple dimensions according to the order in which the first game operation information is received to obtain the cumulative unreliability; the step of outputting a first identification result in response to the unreliability meeting a first preset identification condition includes: outputting a first identification result in response to the cumulative unreliability meeting the first preset identification condition.

[0017] In an exemplary embodiment of this disclosure, the method further includes: collecting network status information of the target client within a second preset time period based on the Websocket connection, wherein the second preset time period is a preset interaction statistics time and is longer than the first preset time period; obtaining a first number of game operation requests sent by the target client within the second preset time period; and determining the untrustworthiness of the target client based on the network status information and the first number.

[0018] In an exemplary embodiment of this disclosure, the method further includes: in response to a game end operation, acquiring third game operation information of the target client throughout the game, and calculating the unreliability of the target client corresponding to the entire game based on the third game operation information and corresponding fourth game operation information, wherein the fourth game operation information is preset operation reference information and the fourth game operation information includes at least the second game operation information; in response to the unreliability corresponding to the entire game meeting a second preset identification condition, outputting a second identification result, wherein the second identification result is used to indicate that the user corresponding to the target client has cheated in the entire game.

[0019] In one exemplary embodiment of this disclosure, based on the Websocket connection, the target service node and the target client exchange information according to a preset message format, and mask information is added to the exchange information.

[0020] According to a second aspect of the present disclosure, a cheating behavior identification method is provided, applied to a target client, comprising: establishing a full-duplex WebSocket connection with a target service node in a service cluster; collecting first game operation information within a first preset time period, and feeding back the first game operation information to the target service node, so that the target service node calculates the unreliability of the target client based on the first game operation information and corresponding second game operation information, so as to determine whether the user corresponding to the target client has cheating behavior based on the unreliability, wherein the first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information.

[0021] In an exemplary embodiment of this disclosure, after establishing a full-duplex WebSocket connection with a target service node in the service cluster, the method further includes: establishing a mapping relationship between the target service node and the target service node, so that when a WebSocket connection is initiated again, a WebSocket connection can be established with the corresponding target service node according to the mapping relationship.

[0022] In an exemplary embodiment of this disclosure, the method further includes: obtaining the operation time difference between adjacent first game operation information; and stopping sending the game operation request corresponding to the adjacent first game operation information to the target service node in response to the operation time difference being less than a preset time threshold.

[0023] In one exemplary embodiment of this disclosure, based on the Websocket connection, the target client and the target service node exchange information according to a preset message format, and mask information is added to the exchange information.

[0024] According to a third aspect of the present disclosure, a cheating behavior identification device is provided. The device includes: a connection establishment module for establishing a full-duplex WebSocket connection between a target service node and a target client; an information processing module for receiving first game operation information fed back by the target client within a first preset time period based on the WebSocket connection, and calculating the unreliability of the target client based on the first game operation information and corresponding second game operation information, wherein the first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information; and a first identification module for outputting a first identification result in response to the unreliability meeting a first preset identification condition, wherein the first identification result is used to indicate that the user corresponding to the target client has cheating behavior.

[0025] According to a fourth aspect of the present disclosure, a cheating behavior identification device is provided. The device includes: a connection establishment module for establishing a full-duplex WebSocket connection with a target service node in a service cluster; and an identification module for collecting first game operation information within a first preset time period and feeding back the first game operation information to the target service node, so that the target service node calculates the unreliability of the target client based on the first game operation information and corresponding second game operation information, and determines whether the user corresponding to the target client has cheating behavior based on the unreliability, wherein the first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information.

[0026] According to a fifth aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored, wherein the computer program, when executed by a processor, implements any of the above-described cheating behavior identification methods.

[0027] According to a sixth aspect of the present disclosure, an electronic device is provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any of the above-described cheating behavior identification methods by executing the executable instructions.

[0028] According to the cheating behavior identification method of this disclosure, a Websocket connection is established between the target service node and the target client. Based on the Websocket connection, the first game operation information fed back by the target client within a first preset time period is received. Based on the first game operation information and the corresponding preset operation reference information, the untrustworthiness of the target client is calculated. In response to the untrustworthiness meeting the first preset identification condition, a first identification result is output to indicate that the user corresponding to the target client has cheating behavior.

[0029] On the one hand, the first preset time period is the time required for the target service node to respond to the target client's current game operation request. Based on the first game operation information within the first preset time period and preset operation reference information, the degree of unreliability is calculated to detect whether cheating behavior exists. The detection result can be obtained before the target service node responds to the current game operation request, preventing cheating behavior from occurring and making the detection of cheating behavior real-time. This avoids damage to users' interests caused by cheating behavior. Moreover, based on the real-time communication Websocket connection between the target service node and the target client, the target service node can collect information from the target client in real time, further improving the real-time performance of cheating behavior detection and enhancing game fairness. On the other hand, the cheating behavior identification method of this embodiment relies entirely on the current game operation behavior for the detection result, decoupling the detection result from the user's historical operation information. The detection result is not limited by the accuracy of historical operation information. Even if cheating data exists in the historical operation information, it will not affect the accuracy of the cheating behavior identification method based on this embodiment in detecting cheating behavior in the current game. Attached Figure Description

[0030] The above and other objects, features, and advantages of this disclosure will become readily apparent from the following detailed description of exemplary embodiments, taken in conjunction with the accompanying drawings. Several embodiments of this disclosure are illustrated in the drawings by way of example and not limitation, in which:

[0031] Figure 1 A flowchart of a cheating behavior identification method according to an embodiment of the present disclosure is shown;

[0032] Figure 2 A flowchart illustrating the identification of cheating behavior based on the number of Websocket connections according to an embodiment of this disclosure is shown;

[0033] Figure 3A flowchart is shown of an anti-cheating implementation method based on verifying user information according to an embodiment of the present disclosure;

[0034] Figure 4 A flowchart illustrating an implementation of calculating the untrustworthiness of a target client according to an embodiment of this disclosure is shown;

[0035] Figure 5 A flowchart illustrating the calculation of the unreliability corresponding to the first game operation information for each dimension according to an embodiment of the present disclosure is shown;

[0036] Figure 6 A flowchart illustrating an implementation of determining the untrustworthiness of a target client according to an embodiment of this disclosure is shown;

[0037] Figure 7 A flowchart illustrating an implementation of determining the untrustworthiness of a target client throughout a game, according to an embodiment of this disclosure, is shown.

[0038] Figure 8 A flowchart of another cheating behavior identification method according to an embodiment of the present disclosure is shown;

[0039] Figure 9 This illustrates yet another implementation of determining the untrustworthiness of a target client according to an embodiment of the present disclosure;

[0040] Figure 10 A schematic diagram of a cheating behavior identification device according to an embodiment of the present disclosure is shown;

[0041] Figure 11 A schematic diagram of another cheating behavior identification device according to an embodiment of the present disclosure is shown;

[0042] Figure 12 A schematic diagram of a storage medium according to an embodiment of the present disclosure is shown;

[0043] Figure 13 A schematic diagram of an electronic device according to an embodiment of the present disclosure is shown. Detailed Implementation

[0044] The principles and spirit of this disclosure will now be described with reference to several exemplary embodiments. It should be understood that these embodiments are given merely to enable those skilled in the art to better understand and implement this disclosure, and are not intended to limit the scope of this disclosure in any way. Rather, these embodiments are provided to make this disclosure more thorough and complete, and to fully convey the scope of this disclosure to those skilled in the art.

[0045] Those skilled in the art will recognize that embodiments of this disclosure can be implemented as a system, apparatus, device, method, or computer program product. Therefore, this disclosure can be specifically implemented in the following forms: entirely hardware, entirely software (including firmware, resident software, microcode, etc.), or a combination of hardware and software.

[0046] According to embodiments of this disclosure, a cheating behavior identification method, a cheating behavior identification device, a computer-readable storage medium, and an electronic device are provided.

[0047] In this document, any number of elements in the accompanying figures is for illustrative purposes and not for limitation, and any naming is for distinction only and has no limiting meaning.

[0048] The principles and spirit of this disclosure are explained in detail below with reference to several representative embodiments. Invention Overview

[0050] In related technologies, cheating detection methods first acquire user operation behavior data, and then detect whether the user is cheating based on the operation behavior data. However, before identifying cheating behavior, the user has usually already achieved their goal or gained an advantage through cheating. This disclosed embodiment, based on a WebSocket connection, collects first game operation information within the time period required to respond to the target client's current game operation request. It calculates the distrust level based on the first game operation information and preset operation reference information, and then outputs a first identification result indicating that the user has cheated when the distrust level meets a first preset identification condition. This allows for obtaining the detection result before the target service node responds to the current game operation request, promptly preventing cheating and providing real-time detection.

[0051] After introducing the basic principles of the present invention, various non-limiting embodiments of the present invention will be described in detail below.

[0052] Exemplary application scenarios

[0053] It should be noted that the following application scenarios are shown only to facilitate understanding of the spirit and principles of the present invention, and the embodiments of this disclosure are not limited in any way. On the contrary, the embodiments of this disclosure can be applied to any applicable scenario.

[0054] The cheating behavior identification method of this disclosure can be applied to a variety of application scenarios involving cheating behavior identification.

[0055] In one application scenario, online games may be involved. Typically, in this scenario, users perform game actions, and when the generated game action information meets pre-set game conditions, game rewards are issued to the user's corresponding account. To obtain these rewards, many users resort to cheating by modifying their game action information, for example, by using third-party auxiliary software to increase the click rate and thus the number of actions per unit time. The cheating behavior identification method of this disclosure, after establishing a WebSocket connection between the target service node and the target client, collects the first game action information of the target client and calculates its unreliability within a first preset time period after the user initiates the current game action request through the target client and before the target service node responds to the current game action request. This allows for the detection and prevention of cheating behavior before the target service node responds to the current game action request, thus preventing the fraudulent acquisition of game rewards.

[0056] It should be noted that other similar scenarios to the above-mentioned online game application scenarios are also applicable to the cheating behavior identification method of this disclosure, and will not be described one by one here.

[0057] Exemplary methods

[0058] The following section, in conjunction with the above application scenarios, provides reference... Figure 1 The exemplary embodiments according to this disclosure are described below.

[0059] like Figure 1 The flowchart shown is of a cheating behavior identification method according to an exemplary embodiment of this disclosure. This cheating behavior identification method is applied to a target service node in a service cluster and may include steps S110 to S130:

[0060] Step S110: Establish a full-duplex WebSocket connection with the target client.

[0061] In the exemplary embodiments of this disclosure, the service cluster is a cluster service comprising at least three nodes (which may be virtual nodes), and the target service node is the service node in the service cluster that establishes a WebSocket connection with the target client. In this embodiment, the target service node that establishes a WebSocket connection with each target client is fixed. WebSocket is a protocol for full-duplex communication over a single TCP (Transmission Control Protocol) connection, allowing the server to proactively push data to the client. In the WebSocket API (Application Programming Interface), the client and server only need to complete a handshake once to directly establish a persistent connection and perform bidirectional data transmission. WebSocket connections rely on the HTTP (Hypertext Transfer Protocol) protocol. For example, when establishing a WebSocket connection, resources such as host, port, protocol, and resource are transmitted using the HTTP protocol; that is, when establishing a WebSocket connection, it is necessary to switch from the HTTP protocol to the WebSocket protocol.

[0062] Target clients include, but are not limited to, application software programs installed on electronic devices, Web (World Wide Wid) applications, such as applications embedded in APP (Application) in the form of WebView, and application programs based on HTML (Hypertext Markup Language).

[0063] Through the exemplary implementation of this disclosure, a WebSocket connection is established between the target service node and the target client. Based on the WebSocket connection, the target client can report collected game operation information to the target server in real time, so that the target server can perform real-time detection and analysis of the game operation information to identify cheating behavior. Moreover, by using a WebSocket connection, the target client and the corresponding target service node only need to perform a handshake once, avoiding multiple repeated connection creations. This allows the target service node to quickly establish a connection when dealing with large-scale disconnection and reconnection, improving connection creation efficiency.

[0064] Step S120: Based on the Websocket connection, receive the first game operation information fed back by the target client within a first preset time period, and calculate the untrustworthiness of the target client based on the first game operation information and the corresponding second game operation information.

[0065] In an exemplary embodiment of this disclosure, the first preset time period is the time required for the target service node to respond to the target client's current game operation request. For example, after the target client sends the current game operation request to the target service node, in order to ensure smooth visuals for the user, the frame rate should be above 24 frames per second. Therefore, the response time of the target service node to the current game operation request can be within 16 milliseconds, and the first preset time period is determined to be 16 milliseconds. Alternatively, when establishing a connection for the first time (such as during a login service), more user data or interaction data is usually required, and the first preset time period can be 1 second. Of course, the corresponding first preset time period can also be determined based on the actual cheating behavior identification scenario, and this disclosure does not impose any special limitations on this.

[0066] It should be noted that before the target service node receives the first game operation information based on the Websocket connection, the target service node first receives the current game operation request. That is, after receiving the current game operation request and before responding to the current game operation request, the target service node obtains the first game operation information within the first preset time period.

[0067] The first game operation information refers to relevant information generated when a user plays the game using the target client. This includes, but is not limited to, basic user information, account information, game business qualification information (such as registration results, risk control screening results, process rules, and game status identifiers), UI (User Interface) rendering methods in the area, number of game operations, and game operation methods—all information reflecting the user's game behavior. This first game operation information can be collected in real-time by pre-setting tracking points on the target client and then fed back to the target service node. The target client can use a hash table to store the data, resulting in low time complexity and facilitating real-time verification by the target service node.

[0068] The second game operation information is preset operation reference information. Each first game operation information has a corresponding operation reference information. For example, if the first game operation information is the number of times the same touch object is clicked within a first preset time period, then the corresponding second game operation information can be different click count ranges. Alternatively, if the first game operation information is a user service qualification identifier obtained within a first preset time period, then the corresponding second game operation information can be a predetermined user service qualification identifier. The obtained user service qualification identifier is verified using the predetermined user service qualification identifier to determine whether the target client has game qualifications. Furthermore, if the first game operation information is a risk object identifier, and the second game operation information is various pre-set risk object identifiers, then based on the second game operation information and the first game operation information, it can be determined whether the target client is a marked risk client. This disclosure embodiment can combine cheating behavior identification scenarios or first game operation information to determine the second game operation information, which will not be described in detail here.

[0069] In an exemplary embodiment of this disclosure, the unreliability of the target client is calculated based on the first operation information and the corresponding second game operation information. The unreliability is used to characterize the probability that the user corresponding to the target client is cheating. The unreliability can be an unreliability score or unreliability probability characterizing the cheating behavior of the user corresponding to the target client; the unreliability can also be a probability level characterizing the cheating behavior of the target client user, such as target client A being level 1 and target client B being level 2, indicating that the probability of target client A and target client B cheating is different. In this embodiment of the disclosure, at least one of the unreliability score, unreliability probability, or unreliability level of the target client can be calculated based on the first game operation information and the second game operation information.

[0070] Optionally, the first operation information can be matched with the corresponding second operation information to obtain the score corresponding to the second operation information that matches the first operation information, and this score can be used as the untrustworthiness of the target client. Optionally, the deviation between the first operation information and the second operation information can also be calculated, and the score corresponding to the deviation can be used as the untrustworthiness of the target client, and so on.

[0071] Through the exemplary implementation of this disclosure, before the target service node responds to the target client's current game operation request, the untrustworthiness of the target client is calculated using the first game operation information and the second game operation information. Based on the untrustworthiness, a result response is made to determine whether the target client is cheating. Thus, when the user corresponding to the target client is cheating, the target service node is prevented from responding to the current game operation request, thereby preventing the cheating behavior from occurring.

[0072] Step S130: In response to the unreliability meeting the first preset identification condition, a first identification result is output, wherein the first identification result is used to indicate that the user corresponding to the target client has cheating behavior.

[0073] In an exemplary embodiment of this disclosure, the first preset identification condition is pre-set based on the actual cheating behavior identification scenario. When the unreliability level determined based on the first game operation information and the second game operation information meets the first preset condition, a first identification result is output to indicate that the user corresponding to the target client has cheated. Optionally, the first preset identification condition may be a preset threshold; when the score corresponding to the unreliability level meets the preset threshold, the first identification result is output. Optionally, the first preset identification condition may also be a preset unreliability level; when the unreliability level corresponding to the unreliability level meets the preset unreliability level, the first identification result is output.

[0074] The first identification result may include at least one negative feedback result such as the current game operation request being invalid, displaying a prompt warning message, reducing the subsequent game score, disconnecting the game link of the target client, or freezing the game account of the user corresponding to the target client. The first identification result of this disclosure embodiment includes, but is not limited to, the above results.

[0075] Through the exemplary implementation of this disclosure, when the unreliability meets the first preset identification condition, a first identification result is output to the target client. This can prevent cheating from occurring before it happens, or prompt the target client user to refrain from using cheating in subsequent game sessions. Thus, by warning or blocking, cheating is prevented from continuing. Since the first identification result is output before responding to the current service request, it has practical significance in preventing cheating and improving the fairness of the game. Moreover, it does not rely on any historical game operation information, and the detection result is not limited by the accuracy of historical operation information. Even if there is cheating data in the historical operation information, it will not affect the detection accuracy based on the current game.

[0076] In one exemplary embodiment of this disclosure, in order to prevent users from cheating by using multiple clients to participate in games simultaneously, such as by clicking a button to participate in a game, where the outcome of such games strongly depends on the frequency or total number of button clicks, users increase their chances of winning by using multiple clients to participate in the game simultaneously.

[0077] Based on this, the present disclosure also provides an implementation method for identifying cheating behavior based on the number of WebSocket connections. Establishing a full-duplex WebSocket connection with the target client may include steps S210 to S230:

[0078] Step S210: Receive connection request information sent by the target client for establishing a WebSocket connection.

[0079] In an exemplary embodiment of this disclosure, the connection request information includes at least protocol transmission information and user information corresponding to the target client. The protocol transmission information is resource information required to establish a WebSocket connection, including but not limited to resources such as host, port, protocol, and resource that depend on HTTP protocol transmission, as well as terminal application identifiers and service node identifiers used to identify the establishment of the WebSocket connection.

[0080] Step S220: Based on the protocol transmission information, determine whether the target client has already established a WebSocket connection.

[0081] In an exemplary embodiment of this disclosure, when establishing a WebSocket connection, it is necessary to switch from the HTTP protocol to the WebSocket protocol. Before switching protocols, the target client is first determined based on protocol transmission information to see if a WebSocket connection has already been established. This embodiment of the disclosure allows the target client to establish a unique WebSocket connection with the target service node. By determining whether a WebSocket connection has already been established, it prevents cheating behavior such as the target client using multiple clients to participate in the game by establishing multiple connections.

[0082] In some possible implementations, the terminal application identifier in the protocol transmission information can be obtained, and a query can be performed to determine if a channel identifier for a WebSocket connection corresponding to the terminal application identifier exists. Specifically, if the target client has already established a WebSocket connection with the current target service node or with another target service node, a unique channel identifier corresponding to that target client is saved. When the target client initiates another WebSocket connection attempt, the saved channel identifier is used to determine whether the target client has already established a WebSocket connection, thereby preventing the same target client from repeatedly establishing connections.

[0083] In some possible implementations, it is also possible to query whether a service node identifier corresponding to the terminal application identifier exists. When the target client has already established a WebSocket connection with the current target service node or with other target service nodes, in addition to storing the unique channel identifier corresponding to the target client, it can also store the service node identifier corresponding to the terminal application identifier. When the target client initiates another WebSocket connection, it queries whether a corresponding service node identifier exists through the target client's terminal application identifier to determine whether the target client has already established a WebSocket connection, thereby avoiding the same target client establishing connections repeatedly.

[0084] Through the exemplary implementation of this disclosure, before creating a WebSocket connection, it is first determined whether the target client has already created a WebSocket connection based on the transport protocol information. This is to prevent cheating behavior by the same target client in establishing multiple connections by verifying the number of WebSocket connections.

[0085] Step S230: If the target client has already established a WebSocket connection, then stop establishing the WebSocket connection this time.

[0086] In an exemplary embodiment of this disclosure, if it is determined from the protocol transmission information that the target client has already established a Websocket connection, the establishment of the current Websocket connection is stopped. That is, this embodiment of the disclosure only allows each target client to establish one Websocket connection to participate in the game, thus restricting the cheating method of users using multiple target clients to participate in the game.

[0087] In one exemplary embodiment of this disclosure, a method for preventing fraud based on verifying user information is also provided to improve the security of data transmission over a WebSocket connection. Establishing a full-duplex WebSocket connection with the target client may further include steps S310 to S320:

[0088] Step 310: If the target client has not created a WebSocket connection, verify the user information according to the preset user authentication rules.

[0089] In the exemplary embodiments of this disclosure, the preset user authentication rules are set according to the application scenario of the cheating behavior identification method, and are used to verify user information to determine whether the user is qualified to participate in the game. For example, the preset user authentication rules are user identity verification rules, and user information is verified according to the user identity verification rules to determine whether the currently logged-in user meets the game login procedures.

[0090] User information is verified by pre-defined user authentication rules, which means authenticating the currently logged-in user to further ensure the legitimacy of the identity information.

[0091] Step 320: In response to the user information being verified by the user authentication rules, establish a WebSocket connection with the target client to exchange information with the target client based on the WebSocket connection.

[0092] In an exemplary embodiment of this disclosure, after the user information is verified by the user authentication rules, a Websocket connection can be established between the target service node and the target client. This dual verification prevents users from using multiple clients to participate in the game, thus avoiding cheating.

[0093] In one exemplary embodiment, to handle large-scale concurrent client connections and reconnection after disconnection, a method for establishing a mapping relationship between the server and clients is also provided. After establishing a full-duplex WebSocket connection with the target client, a mapping relationship can be established with the target client, so that when the target client initiates another WebSocket connection, a WebSocket connection can be established with the corresponding target service node according to the mapping relationship.

[0094] For example, if target client C1 establishes a WebSocket connection with target service node S1, the connection established by target client C1 is guaranteed to be made to target service node S1. Target service node S1 is a resource created by target client C1 during the connection process and will not appear on other service nodes in the service cluster. When re-establishing a connection, target service node S1 can quickly reconnect to target client C1 using existing resources, improving resource utilization, optimizing server memory usage, and avoiding the duplication of WebSocket connections with other service nodes.

[0095] In some possible implementations, a consistent hashing algorithm can be used to ensure that the target service node establishing a connection with each target client is unique. The specific process may include: first, obtaining the hash value of the service node and configuring it to a value between 0 and 2. 32 The hash ring (circle) is then used to obtain the hash value of the key of the client's relevant data and map it onto the hash ring. Finally, starting from the position where the client's relevant data is mapped, a clockwise search is performed to establish a mapping relationship between the client and the first service node found, so as to ensure that the client's relevant data exists on the corresponding service node.

[0096] By establishing a mapping relationship with the target client, the target service node that establishes a connection with each target client is unique and fixed. When faced with a large number of concurrent client connections or disconnection and reconnection, a connection can be quickly established based on the mapping relationship. Since the relevant resources of the target client are only in the corresponding target service node, the memory usage of the server is optimized.

[0097] In an exemplary embodiment of this disclosure, a method for calculating the untrustworthiness of a target client is also provided. Receiving first game operation information fed back by the target client within a first preset time period, and calculating the untrustworthiness of the target client based on the first game operation information and corresponding second game operation information, may include steps S410 to S430:

[0098] Step S410: Within a first preset time period, receive first game operation information from multiple dimensions fed back by the target client, wherein the first game operation information from multiple dimensions is randomly collected by the target client within the first preset time period.

[0099] In the exemplary embodiments of this disclosure, the first game operation information is divided into multiple dimensions corresponding to different information types based on the information type of the first game operation information. For example, the basic information type may include user basic information, account information, etc.; the game operation information type may include the number of game operations, the game operation method, etc.; and the game business qualification information type may include registration results, risk control screening results, game status identifiers, etc. Of course, each type of information can also be treated as a separate information type, such as user basic information, account information, number of game operations, game operation method, registration results, risk control screening results, and game status identifiers, each treated as a separate information type. This disclosure does not impose any special limitations on the method of classifying information types.

[0100] During the first preset time period, the first game operation information of each dimension mentioned above is not collected simultaneously, but rather one or several are randomly collected from the target client each time. For example, one piece of first game operation information can be collected from the target client each time at the same time interval, such as collecting the operation frequency of the touch medium the first time, and collecting the game status indicator a second time after a certain interval, and so on.

[0101] By randomly collecting first-game operation information from different dimensions, it is not necessary to acquire a large amount of information at the same time, thus reducing memory usage. Moreover, compared to acquiring various information uniformly, random collection makes it more difficult to provide opportunities for cheating, increasing the difficulty of cheating.

[0102] Step S420: For the first game operation information of each dimension, calculate the corresponding unreliability based on the first game operation information and the corresponding second game operation information.

[0103] In an exemplary embodiment of this disclosure, the unreliability of each dimension can be calculated for the first game operation information of each dimension, so as to indicate the possibility of cheating behavior in each dimension.

[0104] In some possible implementations, deviation data of the first game operation information relative to the second game operation information can be obtained, and the corresponding degree of unreliability can be determined based on the deviation data.

[0105] For example, in a game scenario where clicking a button to participate in a game determines the outcome based on the frequency or total number of clicks. If the preset operation reference information (second game operation information) is 10 clicks per second or less, and the first game operation information is 15 clicks per second, then the deviation data is calculated as (15-10) / 10 = 0.5. The corresponding unreliability can be determined based on the deviation data of 0.5. For instance, a pre-defined correspondence between deviation data and unreliability can be established, as shown in Table 1. By looking up Table 1, the unreliability corresponding to a deviation data of 0.5 can be obtained as 0.6.

[0106] Table 1

[0107] Deviation data 0.1 0.3 0.5 0.7 Unreliability 0.1 0.4 0.6 0.8

[0108] It should be noted that Table 1 is merely an example. The embodiments of this disclosure can also characterize the correspondence between deviation data and unreliability in other ways, such as linear mapping, etc. This disclosure does not impose any special limitations on this.

[0109] In some possible implementations, the unreliability of the first game operation information for each dimension can also be calculated through the following steps S510 to S520:

[0110] Step S510: Obtain the target operation range specified by the first game operation information that conforms to the second game operation information, wherein the second game operation information includes multiple preset operation ranges.

[0111] Step S520: Determine the corresponding degree of unreliability based on the unreliability score corresponding to the target operation interval.

[0112] In the exemplary embodiments of this disclosure, the second game operation information includes multiple preset operation ranges. Referring again to the example of clicking a button to participate in the game, the multiple preset operation ranges can be as shown in Table 2. If the first game operation information is 15 operations per second, the corresponding unreliability is determined to be 0.9 by looking up the operation range in Table 2.

[0113] Table 2

[0114] Operating area [0,5) [5,7) [7,10) [10,20) Unreliability 0.1 0.3 0.6 0.9

[0115] It should be noted that Table 2 above is only an example, and the granularity of the interval division of the operation area can be adjusted according to the specific content of the second game operation information. This disclosure does not impose any special limitations on this.

[0116] In this exemplary implementation, the unreliability level corresponding to each first game operation information is calculated. Based on this unreliability level, each first game operation information can be judged. For example, if the unreliability level corresponding to a certain dimension of the first game operation information is higher than a preset threshold, it is determined that there is a high probability of cheating behavior in that dimension of the first game operation information. At the same time, the unreliability levels corresponding to at least two dimensions of the first game operation information can also be combined to judge whether the target client has cheating behavior.

[0117] Step S430: The unreliability scores corresponding to multiple dimensions are fused and calculated to obtain the unreliability score of the target client.

[0118] In an exemplary embodiment of this disclosure, during the process of acquiring the first game operation information through random sampling, the unreliability corresponding to multiple dimensions is fused and calculated to dynamically obtain the unreliability of the target client.

[0119] In some possible implementations, the untrustworthiness corresponding to multiple dimensions can be fused and calculated based on the untrustworthiness corresponding to multiple dimensions and the untrustworthiness weight corresponding to multiple dimensions, and the fused calculation result can be used as the untrustworthiness of the target client.

[0120] In this exemplary implementation, first game operation information is randomly collected each time, and the untrustworthiness of the target client is calculated in a dynamic and cumulative manner. The untrustworthiness of the target client is real-time and random, and does not need to rely on historical game data from multiple periods. Even without historical game data as a reference, cheating behavior can be detected.

[0121] In one exemplary embodiment, a method for outputting a first identification result based on the unreliability corresponding to the target dimension is also provided. In response to the unreliability meeting a first preset identification condition, outputting the first identification result may include:

[0122] During the process of receiving the first game operation information, if there is a target dimension whose unreliability meets the first preset identification condition, then the first identification result is output. That is to say, in this exemplary embodiment, the unreliability corresponding to each dimension is not accumulated, but rather, during the process of receiving the first game operation information, the unreliability corresponding to that dimension is calculated each time the first game operation information is received, and once there is an unreliability that meets the first preset identification condition, the first identification result is directly output.

[0123] Through this exemplary implementation, the unreliability of the first game operation information corresponding to each dimension is judged separately. Even if the unreliability of only one dimension meets the first preset identification condition, the first identification result is output. There is "zero tolerance" for operations with cheating behavior, which avoids cheating behavior in any way and has high accuracy in identifying cheating behavior.

[0124] In an exemplary embodiment of this disclosure, the unreliability of the target client can be obtained by fusing and calculating the unreliability corresponding to multiple dimensions. This can include: calculating the cumulative unreliability by accumulating the unreliability corresponding to multiple dimensions according to the order in which the first game operation information is received.

[0125] For example, based on the first game operation information collected in the first instance, the corresponding unreliability is calculated to be 0.1. Correspondingly, according to the order in which the first game operation information was collected, the corresponding unreliability is 0.3 and 0.4 respectively. Then, by accumulating, the unreliability of the target client is dynamically obtained as 0.8. When there is a fourth collection of first game operation information, the unreliability of the fourth collection of 0.1 is summed with the unreliability of the previous three collections, and this sum is used as the unreliability of the target client.

[0126] Based on this, in response to the unreliability meeting the first preset identification condition, outputting the first identification result may include: in response to the cumulative unreliability meeting the first preset identification condition, outputting the first identification result. That is, in this embodiment, the first identification result is output only when the cumulative unreliability obtained in real time meets the first preset identification condition. This first identification result integrates the unreliability corresponding to multiple dimensions, accurately reflecting the possibility of cheating behavior within a first preset time period.

[0127] In one exemplary embodiment, if the target service node has successfully responded to the current game operation request, another method for determining the untrustworthiness of the target client is also provided, which may include steps S610 to S630:

[0128] Step S610: Based on the WebSocket connection, collect the network status information of the target client within a second preset time period.

[0129] In an exemplary embodiment of this disclosure, the second preset time period is a preset interaction statistics time, which is longer than the first preset time period. Since the second preset time is longer than the time required for the target service node to respond to the target client's current game operation request, it means the target service node has already responded to the current game operation request. In this case, the number of game request operations sent by the target client is usually related to network conditions. Therefore, the network status information of the target client within the second preset time period, such as network speed and bandwidth, is obtained first, so that the received game operation requests can be analyzed based on the network status information subsequently.

[0130] Step S620: Obtain the first number of game operation requests sent by the target client within the second preset time period.

[0131] In an exemplary embodiment of this disclosure, a first number of game operation requests received within a second preset time period is obtained. For example, a bucket-based counting method is used, calculating the total number of interactions with the target client every second preset time period (counted as one bucket). The second preset time period (the size of the bucket) can be determined based on actual network conditions (such as network jitter), interface response time (RT), etc.

[0132] Step S630: Determine the untrustworthiness of the target client based on the network status information and the first quantity.

[0133] In an exemplary embodiment of this disclosure, the untrustworthiness of a target client can be determined based on network status information and a first quantity.

[0134] One approach is to pre-define the correspondence between network status information and the number of requests. Based on this correspondence, the target number corresponding to the current network status information is found, and the degree of unreliability is determined based on the deviation of the target number from the first number. Alternatively, a pre-definement correspondence between network status information and a range of request numbers can be established. Based on this correspondence, the target number range to which the current network status information belongs is found, and the unreliability of the target client is determined based on the unreliability corresponding to the target number range. Essentially, determining the target client through network status information and the first number is an assessment of whether the network conditions of the target client can ensure the successful sending of the first number of game operation requests. If not, cheating may be suspected.

[0135] Through this exemplary implementation, even if the target service node responds to the game operation request of the target client, it is still possible to further identify whether the user corresponding to the target client is cheating by considering the network conditions and the number of game operation requests issued by the target client.

[0136] In one exemplary embodiment of this disclosure, before distributing benefits to the account corresponding to the target client after the entire game ends, it is possible to identify whether the user has engaged in cheating based on the third-party game operation information of the target client throughout the game. This may include steps S710 to S720:

[0137] In step S710, in response to the game end operation, the third game operation information of the target client in the whole game is obtained, and the unreliability of the target client in the whole game is calculated based on the third game operation information and the corresponding fourth game operation information.

[0138] In the exemplary embodiments of this disclosure, the fourth game operation information is preset operation reference information, and the fourth game operation information includes at least the second game operation information. The third game operation information in the entire game is all the data generated by the target client in the game, including but not limited to user basic information, account information, game business qualification information (such as registration results, risk control screening results, process rules and game status identification information), UI (User Interface) rendering method in the area, number of game operations, game operation method, interaction duration between the target client and the target service node, device UA (User Agent) and resource loading information corresponding to the target client, total number of interactions and total user score in each game, ratio of participants to total requests, areas of change in request and data throughput, game registration rate and participation rate, expected number of participants and actual number of participants, and other relevant information that can reflect the game behavior in the entire game.

[0139] In this process, the unreliability of the target client in the entire game is calculated based on the third game operation information and the corresponding fourth game operation information. The calculation method is the same as that in steps S410 to S430 above, and will not be repeated here.

[0140] Step S720: In response to the fact that the unbelievability of the entire game meets the second preset identification condition, a second identification result is output. The second identification result is used to indicate that the user corresponding to the target client has cheated in the entire game.

[0141] In an exemplary embodiment of this disclosure, if the unreliability score corresponding to the entire game meets a second preset condition, a second identification result is output to indicate that the user corresponding to the target client has engaged in cheating behavior throughout the game. Optionally, the second preset identification condition may be a preset threshold; when the score corresponding to the unreliability score of the entire game meets the preset threshold, the second identification result is output. Optionally, the second preset identification condition may also be a preset unreliability level; when the unreliability level corresponding to the unreliability score of the entire game meets the preset unreliability level, the second identification result is output.

[0142] The second identification result may include at least one negative feedback result such as invalid game result, freezing the game account of the user corresponding to the target client, reducing the issuance of game benefits or refusing to issue game benefits. The second identification result of this disclosure embodiment includes, but is not limited to, the above results.

[0143] Through the exemplary implementation of this disclosure, after each game ends and before distributing game benefits, if the untrustworthiness of the entire game meets the second preset identification condition, it is possible to choose whether to distribute game benefits to the target client, thereby avoiding sending benefits to users who have cheated and improving the fairness of the game.

[0144] In an exemplary embodiment of this disclosure, in order to improve the security of data transmission based on WebSocket connection, the target service node and the target client exchange information according to a preset message format based on WebSocket connection, and mask information is added to the exchange information.

[0145] The preset message format can be the ProtoBuf binary message encoding protocol. This protocol is language-independent and platform-independent. Business data exchange between the target client and the target service node is based on the ProtoBuf protocol, further ensuring the security of data transmission. Furthermore, a mask, such as a random 32-bit mask, is added to the transmitted interactive information. Due to its unpredictability, it remains secure even with the presence of a third-party network proxy, further improving data transmission security and preventing unauthorized information tampering from affecting the accuracy of identifying cheating behavior.

[0146] In addition, when establishing a WebSocket connection between the target service node and the target client, TLS (Transport Layer Security) authentication can be performed to improve security and enhance the security of the WebSocket connection of the service cluster.

[0147] The following example uses a game scenario involving a high-frequency, repetitive, single operation. Figure 8 The cheating behavior identification method of the present disclosure will be described.

[0148] Step S810: The target client establishes a WebSocket connection with the target service node.

[0149] In step S820, when the target client sends a game operation request to the target service node while in the game, the target service node starts to randomly collect the target client's operation frequency, touch point location, touch point number, etc. within the first preset time period.

[0150] In step S830, the target service node calculates the unreliability based on the first game operation information and the corresponding second game operation information, and accumulates the unreliability corresponding to different dimensions collected randomly to obtain the cumulative unreliability.

[0151] Step S840: If, within the first preset time period, there is a situation where the accumulated unreliability meets the first preset identification condition, then output the first identification result indicating that the user corresponding to the target client has cheated.

[0152] Step S850: If the entire game ends, collect the target client's third game operation information throughout the entire game.

[0153] Step S860: Calculate the unreliability of the entire game based on the fourth game operation information corresponding to the third game operation information.

[0154] In step S870, if the unreliability of the entire game meets the second preset identification condition, then output the second identification result to indicate that the user corresponding to the target client has cheated.

[0155] In summary, the cheating behavior identification method of the exemplary embodiments of this disclosure uses a first preset time period, which is the time required for the target service node to respond to the current game operation request of the target client. Based on the first game operation information within the first preset time period and preset operation reference information, the method calculates the unreliability to detect whether cheating behavior exists. The detection result can be obtained before the target service node responds to the current game operation request, preventing cheating behavior from occurring and making the detection of cheating behavior real-time. This avoids damage to users' interests caused by cheating behavior. Furthermore, based on the real-time communication Websocket connection between the target service node and the target client, the target service node can collect information from the target client in real time, further improving the real-time performance of cheating behavior detection and enhancing game fairness. Moreover, the detection result depends entirely on the current game operation behavior, decoupling the detection result from the user's historical operation information. The detection result is not limited by the accuracy of historical operation information; even if cheating data exists in the historical operation information, it will not affect the detection accuracy of the cheating behavior identification method based on the embodiments of this disclosure.

[0156] like Figure 9 The flowchart shown is of a cheating behavior identification method according to an exemplary embodiment of the present disclosure. This cheating behavior identification method is applied to a target client and may include steps S910 to S920:

[0157] Step S910: Establish a full-duplex WebSocket connection with the target service node in the service cluster;

[0158] Step S920: Collect first game operation information within a first preset time period and feed the first game operation information back to the target service node. The target service node calculates the unreliability of the target client based on the first game operation information and the corresponding second game operation information, so as to determine whether the user corresponding to the target client has cheating behavior based on the unreliability. The first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information.

[0159] It should be noted that the other specific details of steps S910 to S920 have been described in detail in the above implementation of the cheating behavior identification method applied to the target service node, and will not be repeated here.

[0160] In an exemplary embodiment of this disclosure, after establishing a full-duplex WebSocket connection with a target service node in the service cluster, a mapping relationship can also be established between the target service node and the WebSocket connection, so that when a WebSocket connection is initiated again, a WebSocket connection between the corresponding target service node can be established according to the mapping relationship.

[0161] In an exemplary embodiment of this disclosure, a method for controlling the request frequency by the target client is also provided. Specifically, the process involves: obtaining the operation time difference between adjacent first game operation information; and, in response to the operation time difference being less than a preset time threshold, stopping the sending of game operation requests corresponding to adjacent first game operation information to the target service node.

[0162] The request frequency can be set according to the application scenario of the actual cheating behavior identification method. For example, in the scenario of sending a game operation request through a single button, if the time interval between two game operation requests (i.e., the operation time difference) is less than 100 milliseconds, it may be that a robot (software / script) is participating in the game or using multiple target clients to cheat. Therefore, the game operation request will be stopped from being sent to the target service node.

[0163] Through the exemplary implementation of this disclosure, the operation time difference between adjacent first game operation information is judged by the target client. This avoids the accuracy of the operation time difference obtained by the target service node being affected by network jitter during the transmission from the network node to the target service node. Priority judgment is performed before the game operation request is sent to the target service node. If the judgment result is that the user corresponding to the target client has cheating behavior, the game operation request is stopped from being sent to the target service node, thus avoiding the waste of network resources and service resources.

[0164] In an exemplary embodiment of this disclosure, based on a WebSocket connection, the target client and the target service node exchange information according to a preset message format, and mask information is added to the exchange information.

[0165] In the exemplary embodiments of this disclosure, the first preset time period is the time required for the target service node to respond to the current game operation request of the target client. Based on the first game operation information within the first preset time period and preset operation reference information, the degree of unreliability is calculated to detect whether cheating behavior exists. The detection result can be obtained before the target service node responds to the current game operation request, preventing cheating behavior from occurring and making the detection of cheating behavior real-time. This avoids damage to the user's interests caused by cheating behavior. Furthermore, based on the real-time communication Websocket connection between the target service node and the target client, the target client uploads information to the target service node in real time, further improving the real-time performance of cheating behavior detection and enhancing game fairness. On the other hand, the cheating behavior identification method of this disclosure embodiment relies entirely on the current game operation behavior for the detection result, decoupling the detection result from the user's historical operation information. The detection result is not limited by the accuracy of historical operation information; even if cheating data exists in the historical operation information, it will not affect the accuracy of the cheating behavior identification method based on this disclosure embodiment in detecting cheating behavior in the current game.

[0166] It should be noted that other specific details of the embodiments of this disclosure have been described in detail in the above-described embodiments of the cheating behavior identification method applied to the target service node, and will not be repeated here.

[0167] Exemplary device

[0168] After introducing the cheating behavior identification method according to exemplary embodiments of this disclosure, the following will refer to... Figure 10 The cheating behavior identification device according to an exemplary embodiment of the present disclosure will be described.

[0169] It should be noted that other specific details of the various functional modules of the cheating behavior identification device of this disclosure have been described in detail in the above-described implementation of the cheating behavior identification method, and will not be repeated here.

[0170] Figure 10 A cheating behavior identification device 1000 according to an exemplary embodiment of the present disclosure is shown. The device can be located at a target service node in a service cluster and includes:

[0171] Establish connection module 1010, used to establish a full-duplex WebSocket communication protocol connection between the target service node and the target client;

[0172] The information processing module 1020 is used to receive first game operation information fed back by the target client within a first preset time period based on the Websocket connection, and to calculate the untrustworthiness of the target client based on the first game operation information and the corresponding second game operation information. The first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information.

[0173] The first identification module 1030 is used to output a first identification result in response to the unreliability meeting the first preset identification condition. The first identification result is used to indicate that the user corresponding to the target client has cheating behavior.

[0174] In an exemplary embodiment of this disclosure, the connection establishment module 1010 includes: an information receiving unit, configured to receive connection request information for establishing a WebSocket connection sent by the target client, the connection request information including at least protocol transmission information and user information corresponding to the target client, the protocol transmission information being resource information required to establish a WebSocket connection; a judging unit, configured to judge whether the target client has already created a WebSocket connection based on the protocol transmission information; and a request processing unit, configured to stop the current WebSocket connection establishment if the target client has already created a WebSocket connection.

[0175] In an exemplary embodiment of this disclosure, the connection establishment module 1010 further includes: an authentication unit, configured to verify the user information according to a preset user authentication rule if the target client has not created a Websocket connection; and a connection establishment unit, configured to establish a Websocket connection with the target client in response to the user information passing the verification of the user authentication rule, so as to interact with the target client based on the Websocket connection.

[0176] In an exemplary embodiment of this disclosure, the determining unit is configured to: obtain the terminal application identifier in the protocol transmission information and query whether there is a channel identifier for a Websocket connection corresponding to the terminal application identifier; or query whether there is a service node identifier corresponding to the terminal application identifier.

[0177] In an exemplary embodiment of this disclosure, the apparatus 1000 further includes: a relationship establishment module, configured to establish a mapping relationship with the target client, so that when the target client initiates a WebSocket connection again, it can establish a WebSocket connection with the corresponding target service node according to the mapping relationship.

[0178] In an exemplary embodiment of this disclosure, the information processing module 1020 includes: a receiving unit, configured to receive first game operation information of multiple dimensions fed back by the target client within a first preset time period, wherein the first game operation information of multiple dimensions is randomly collected by the target client within the first preset time period; a calculation unit, configured to calculate the corresponding unreliability for each dimension of the first game operation information based on the first game operation information and the corresponding second game operation information; and a fusion unit, configured to fuse the unreliability corresponding to the multiple dimensions to obtain the unreliability of the target client.

[0179] In an exemplary embodiment of this disclosure, the calculation unit is configured to: acquire deviation data of the first game operation information relative to the second game operation information, and determine the corresponding unreliability based on the deviation data.

[0180] In an exemplary embodiment of this disclosure, the calculation unit is configured to: obtain the first game operation information that conforms to the target operation range specified by the second game operation information, wherein the second game operation information includes a plurality of preset operation ranges; and determine the corresponding unreliability score based on the unreliability score corresponding to the target operation range.

[0181] In an exemplary embodiment of this disclosure, the fusion unit includes: a fusion calculation unit, configured to perform fusion calculation on the unreliability corresponding to the multiple dimensions based on the unreliability corresponding to the multiple dimensions and the unreliability weights corresponding to the multiple dimensions; and a result determination unit, configured to use the fusion calculation result as the unreliability of the target client.

[0182] In an exemplary embodiment of this disclosure, the receiving unit receives first game operation information of multiple dimensions fed back by the target client in a sequential manner; the first identification module 1030 includes: a first identification unit, configured to output the first identification result if, during the process of receiving the first game operation information in the sequential manner, there is a target dimension whose unreliability meets the first preset identification condition.

[0183] In an exemplary embodiment of this disclosure, the fusion unit includes: an accumulation calculation subunit, configured to accumulate and calculate the unreliability corresponding to the multiple dimensions according to the order in which the first game operation information is received, to obtain the accumulated unreliability.

[0184] The first identification module further includes a second identification unit, used to output a first identification result in response to the cumulative unreliability meeting the first preset identification condition.

[0185] In an exemplary embodiment of this disclosure, the device 1000 further includes: an information collection module, configured to collect network status information of the target client within a second preset time period based on the Websocket connection, wherein the second preset time period is a preset interaction statistics time and is longer than the first preset time period; an acquisition module, configured to acquire a first number of game operation requests sent by the target client within the second preset time period; and an information determination module, configured to determine the untrustworthiness of the target client based on the network status information and the first number.

[0186] In an exemplary embodiment of this disclosure, the device 1000 further includes: an information integration and processing module, configured to, in response to a game end operation, acquire third game operation information of the target client in the entire game, and calculate the unreliability of the target client corresponding to the entire game based on the third game operation information and the corresponding fourth game operation information, wherein the fourth game operation information is preset operation reference information, and the fourth game operation information includes at least the second game operation information; and a second identification module, configured to, in response to the unreliability corresponding to the entire game meeting a second preset identification condition, output a second identification result, wherein the second identification result is used to indicate that the user corresponding to the target client has cheated in the entire game.

[0187] In one exemplary embodiment of this disclosure, the device 1000 further includes an information interaction module, used for information interaction between the target service node and the target client according to a preset message format based on the Websocket connection, and adding mask information to the interaction information.

[0188] The following is for reference. Figure 11 Another cheating behavior identification device 1100 according to an exemplary embodiment of the present disclosure will be described, which may be provided in the target client.

[0189] It should be noted that other specific details of the various functional modules of the cheating behavior identification device of this disclosure have been described in detail in the above-described implementation of the cheating behavior identification method, and will not be repeated here.

[0190] Figure 11 A cheating behavior identification device 1100 according to an exemplary embodiment of the present disclosure is shown, comprising:

[0191] A connection establishment module 1110 is used to establish a full-duplex WebSocket connection with a target service node in the service cluster; an identification module 1120 is used to collect first game operation information within a first preset time period and feed the first game operation information back to the target service node, so that the target service node calculates the untrustworthiness of the target client based on the first game operation information and the corresponding second game operation information, and determines whether the user corresponding to the target client has cheating behavior based on the untrustworthiness, wherein the first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information.

[0192] In an exemplary embodiment of this disclosure, the apparatus 1100 further includes: a relationship establishment module, configured to establish a mapping relationship with the target service node, so that when a Websocekt connection is initiated again, a Websocekt connection can be established with the corresponding target service node according to the mapping relationship.

[0193] In an exemplary embodiment of this disclosure, the device 1100 further includes: a time processing module, configured to obtain the operation time difference between adjacent first game operation information; and a request processing module, configured to stop sending the game operation request corresponding to the adjacent first game operation information to the target service node in response to the operation time difference being less than a preset time threshold.

[0194] In an exemplary embodiment of this disclosure, the device 1100 further includes: an information interaction module, used for information interaction between the target client and the target service node according to a preset message format based on the Websocket connection, and adding mask information to the interaction information.

[0195] It should be noted that although several modules or units of the cheating behavior detection device have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0196] Exemplary storage media

[0197] The storage medium of the exemplary embodiments of this disclosure will now be described.

[0198] In this exemplary embodiment, reference is made to Figure 12As shown, a program product 1200 for implementing the above-described method according to an exemplary embodiment of the present disclosure is described. This product may employ a portable compact disc read-only memory (CD-ROM) and include program code, and may run on a device such as a personal computer. However, the program product of the present disclosure is not limited thereto. In this document, a readable storage medium may be any tangible medium containing or storing a program that may be used by or in conjunction with an instruction execution system, apparatus, or device.

[0199] The program product 1200 can employ any combination of one or more readable media. The readable media can be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: electrical connections with one or more wires, portable disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0200] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0201] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RE, etc., or any suitable combination thereof.

[0202] Program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (FAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0203] Exemplary electronic devices

[0204] refer to Figure 13 An electronic device according to an exemplary embodiment of the present disclosure will be described.

[0205] Figure 13 The electronic device 1300 shown is merely an example and should not be construed as limiting the functionality and scope of use of the embodiments disclosed herein.

[0206] like Figure 13 As shown, the electronic device 1300 is presented in the form of a general-purpose computing device. The components of the electronic device 1300 may include, but are not limited to: at least one processing unit 1310, at least one storage unit 1320, a bus 1330 connecting different system components (including storage unit 1320 and processing unit 1310), and a display unit 1340.

[0207] The storage unit stores program code, which can be executed by the processing unit 1310 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 1310 can perform actions such as... Figure 1 The methods and steps shown are as follows.

[0208] Storage unit 1320 may include volatile storage units, such as random access memory (RAM) unit 1321 and / or cache memory unit 1322, and may further include read-only memory unit (ROM) unit 1323.

[0209] Storage unit 1320 may also include a program / utility 1324 having a set (at least one) program module 1325, such program module 1325 including but not limited to: operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0210] Bus 1330 may include a data bus, an address bus, and a control bus.

[0211] Electronic device 1300 can also communicate with one or more external devices 1400 (e.g., keyboard, pointing device, Bluetooth device, etc.) via input / output (I / O) interface 1350. Electronic device 1300 also includes a display unit 1340 connected to input / output (I / O) interface 1350 for display purposes. Furthermore, electronic device 1300 can communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 1360. As shown, network adapter 1360 communicates with other modules of electronic device 1300 via bus 1330. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0212] It should be noted that although several modules or sub-modules of the apparatus have been mentioned in the detailed description above, this division is merely exemplary and not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more units / modules described above can be embodied in one unit / module. Conversely, the features and functions of one unit / module described above can be further divided and embodied by multiple units / modules.

[0213] Furthermore, although the operations of the methods disclosed herein are described in a specific order in the accompanying drawings, this does not require or imply that these operations must be performed in that specific order, or that all of the operations shown must be performed to achieve the desired result. Additionally or alternatively, certain steps may be omitted, multiple steps may be combined into one step, and / or one step may be broken down into multiple steps.

[0214] While the spirit and principles of this disclosure have been described with reference to several specific embodiments, it should be understood that this disclosure is not limited to the disclosed specific embodiments, and the division of aspects does not imply that features in these aspects cannot be combined for benefit; such division is merely for convenience of expression. This disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A method for identifying cheating behavior, applied to a target service node in a service cluster, characterized in that, include: Establish a full-duplex WebSocket connection with the target client; wherein, the target service node for each target client to establish a WebSocket connection is unique and fixed; Based on the Websocket connection, the system receives first game operation information from the target client within a first preset time period, and calculates the untrustworthiness of the target client based on the first game operation information and the corresponding second game operation information. The first preset time period is the time required for the target service node to respond to the target client's current game operation request, and the second game operation information is preset operation reference information. In response to the unreliability meeting the first preset identification condition, a first identification result is output, which is used to indicate that the user corresponding to the target client has cheating behavior; The step of receiving first game operation information fed back by the target client within a first preset time period, and calculating the untrustworthiness of the target client based on the first game operation information and the corresponding second game operation information, includes: Within the first preset time period, the target client receives first game operation information in multiple dimensions, which is randomly collected by the target client within the first preset time period. For each dimension's first game operation information, the corresponding unreliability is calculated based on the first game operation information and the corresponding second game operation information. The unreliability of each dimension is used to indicate the existence of cheating behavior in each dimension. The unreliability of the target client is obtained by fusing and calculating the unreliability corresponding to the multiple dimensions.

2. The method according to claim 1, characterized in that, The establishment of a full-duplex WebSocket connection with the target client includes: Receive connection request information sent by the target client for establishing a WebSocket connection. The connection request information includes at least protocol transmission information and user information corresponding to the target client. The protocol transmission information is resource information required to establish a WebSocket connection. Based on the protocol transmission information, determine whether the target client has established a WebSocket connection; If the target client has already established a WebSocket connection, then stop establishing this WebSocket connection.

3. The method according to claim 2, characterized in that, The method further includes: If the target client does not establish a WebSocket connection, the user information is verified according to the preset user authentication rules; In response to the user information being verified by the user authentication rules, a WebSocket connection is established with the target client to exchange information with the target client based on the WebSocket connection.

4. The method according to claim 2, characterized in that, The step of determining whether the target client has established a WebSocket connection based on the protocol transmission information includes: Obtain the terminal application identifier from the protocol transmission information, and query whether there is a channel identifier for a WebSocket connection corresponding to the terminal application identifier; or Check if a service node identifier exists that corresponds to the terminal application identifier.

5. The method according to claim 1, characterized in that, After establishing a full-duplex WebSocket connection with the target client, the method further includes: A mapping relationship is established with the target client, so that when the target client initiates a WebSocket connection again, a WebSocket connection can be established with the corresponding target service node according to the mapping relationship.

6. The method according to claim 1, characterized in that, For each dimension of the first game operation information, the corresponding unreliability is calculated based on the first game operation information and the corresponding second game operation information, including: Obtain the deviation data of the first game operation information compared with the second game operation information, and determine the corresponding unreliability based on the deviation data.

7. The method according to claim 1, characterized in that, For each dimension of the first game operation information, the corresponding unreliability is calculated based on the first game operation information and the corresponding second game operation information, including: The first game operation information is obtained to match the target operation range specified by the second game operation information, wherein the second game operation information includes multiple preset operation ranges; The corresponding degree of unreliability is determined based on the unreliability score corresponding to the target operation interval.

8. The method according to any one of claims 1, 6, and 7, characterized in that, The step of fusing and calculating the unreliability corresponding to the multiple dimensions to obtain the unreliability of the target customer includes: The unreliability corresponding to the multiple dimensions and the unreliability weight corresponding to the multiple dimensions are fused and calculated. The fusion calculation result is used as the untrustworthiness of the target client.

9. The method according to any one of claims 1, 6, and 7, characterized in that, The response that the unbelievability meets the first preset identification condition, outputting the first identification result, includes: During the process of receiving the first game operation information, if there is a target dimension whose unreliability meets the first preset recognition condition, the first recognition result is output.

10. The method according to any one of claims 1, 6, and 7, characterized in that, The step of fusing and calculating the untrustworthiness corresponding to the multiple dimensions to obtain the untrustworthiness of the target client includes: Based on the order in which the first game operation information is received, the unreliability corresponding to the multiple dimensions is accumulated and calculated to obtain the cumulative unreliability. The response that the unbelievability meets the first preset identification condition, outputting the first identification result, includes: When the accumulated unreliability meets the first preset identification condition, the first identification result is output.

11. The method according to claim 1, characterized in that, The method further includes: Based on the WebSocket connection, network status information of the target client is collected within a second preset time period, where the second preset time period is a preset interaction statistics time, and the second preset time period is longer than the first preset time period. Obtain the first number of game operation requests sent by the target client within the second preset time period; The untrustworthiness of the target client is determined based on the network status information and the first quantity.

12. The method according to claim 1, characterized in that, The method further includes: In response to the game end operation, the third game operation information of the target client in the whole game is obtained, and the unreliability of the target client in the whole game is calculated based on the third game operation information and the corresponding fourth game operation information. The fourth game operation information is a preset operation reference information, and the fourth game operation information includes at least the second game operation information. In response to the fact that the unreliability corresponding to the entire game meets the second preset identification condition, a second identification result is output, which is used to indicate that the user corresponding to the target client has cheated in the entire game.

13. The method according to any one of claims 1 to 7, characterized in that, Based on the WebSocket connection, the target service node and the target client exchange information according to a preset message format, and mask information is added to the exchange information.

14. A method for identifying cheating behavior, applied to a target client, characterized in that, include: Establish a full-duplex WebSocket connection with the target service node in the service cluster; wherein, the target service node for each target client to establish a WebSocket connection is unique and fixed; First game operation information within a first preset time period is collected and fed back to the target service node. The target service node calculates the unreliability of the target client based on the first game operation information and the corresponding second game operation information, and determines whether the user corresponding to the target client has cheated based on the unreliability. The first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information. The step of collecting first game operation information within a first preset time period and feeding back the first game operation information to the target service node, so that the target service node calculates the untrustworthiness of the target client based on the first game operation information and the corresponding second game operation information, includes: Within the first preset time period, multiple dimensions of first game operation information are fed back to the target service node, so that the target service node calculates the corresponding unreliability for each dimension of the first game operation information based on the first game operation information and the corresponding second game operation information. The unreliability of each dimension is used to indicate the existence of cheating behavior in each dimension. The unreliability of the multiple dimensions is then fused to obtain the unreliability of the target client. The multiple dimensions of first game operation information are randomly collected by the target client within the first preset time period.

15. The method according to claim 14, characterized in that, After establishing a full-duplex WebSocket connection with the target service node in the service cluster, the method further includes: Establish a mapping relationship between the target service node and the target service node so that when a Websocekt connection is initiated again, a Websocekt connection can be established between the target service node and the target service node according to the mapping relationship.

16. The method according to claim 14, characterized in that, The method further includes: Obtain the operation time difference between adjacent first game operation information; In response to the operation time difference being less than a preset time threshold, the sending of game operation requests corresponding to the adjacent first game operation information to the target service node is stopped.

17. The method according to any one of claims 14-16, characterized in that, Based on the Websocket connection, the target client and the target service node exchange information according to a preset message format, and mask information is added to the exchange information.

18. A cheating behavior detection device, characterized in that, The device includes: The connection establishment module is used to establish a full-duplex WebSocket connection between the target service node and the target client; wherein, the target service node for each target client to establish a WebSocket connection is unique and fixed; The information processing module is used to receive first game operation information fed back by the target client within a first preset time period based on the Websocket connection, and to calculate the untrustworthiness of the target client based on the first game operation information and the corresponding second game operation information. The first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information. The first identification module is used to output a first identification result in response to the unreliability meeting the first preset identification condition. The first identification result is used to indicate that the user corresponding to the target client has cheating behavior. The information processing module includes: The receiving unit is configured to receive first game operation information of multiple dimensions fed back by the target client within the first preset time period, wherein the first game operation information of multiple dimensions is randomly collected by the target client within the first preset time period. The calculation unit is used to calculate the corresponding unreliability for each dimension of the first game operation information, based on the first game operation information and the corresponding second game operation information. The unreliability of each dimension is used to indicate the situation of cheating behavior in each dimension. The fusion unit is used to fuse and calculate the untrustworthiness corresponding to the multiple dimensions to obtain the untrustworthiness of the target client.

19. The apparatus according to claim 18, characterized in that, The connection establishment module includes: An information receiving unit is configured to receive connection request information for establishing a WebSocket connection sent by the target client. The connection request information includes at least protocol transmission information and user information corresponding to the target client. The protocol transmission information is resource information required to establish a WebSocket connection. The judgment unit is used to determine whether the target client has established a Websocket connection based on the protocol transmission information. The request processing unit is used to stop establishing the current WebSocket connection if the target client has already established a WebSocket connection.

20. The apparatus according to claim 19, characterized in that, The connection establishment module also includes: The authentication unit is used to verify the user information according to preset user authentication rules if the target client has not created a Websocket connection. A connection establishment unit is used to establish a WebSocket connection with the target client in response to the user information being verified by the user authentication rules, so as to exchange information with the target client based on the WebSocket connection.

21. The apparatus according to claim 19, characterized in that, The determination unit is configured as follows: Obtain the terminal application identifier from the protocol transmission information, and query whether there is a channel identifier for a Websocket connection corresponding to the terminal application identifier; or query whether there is a service node identifier corresponding to the terminal application identifier.

22. The apparatus according to claim 18, characterized in that, The device further includes: The relationship establishment module is used to establish a mapping relationship with the target client, so that when the target client initiates a WebSocket connection again, it can establish a WebSocket connection with the corresponding target service node according to the mapping relationship.

23. The apparatus according to claim 18, characterized in that, The computing unit is configured as follows: Obtain the deviation data of the first game operation information compared with the second game operation information, and determine the corresponding unreliability based on the deviation data.

24. The apparatus according to claim 18, characterized in that, The computing unit is configured as follows: The first game operation information is obtained to match the target operation range specified by the second game operation information, wherein the second game operation information includes multiple preset operation ranges; The corresponding degree of unreliability is determined based on the unreliability score corresponding to the target operation interval.

25. The apparatus according to any one of claims 18, 23, and 24, characterized in that, The fusion unit includes: The fusion calculation unit is used to perform fusion calculation on the unreliability corresponding to the multiple dimensions based on the unreliability corresponding to the multiple dimensions and the unreliability weight corresponding to the multiple dimensions. The result determination unit is used to determine the unreliability of the target client based on the fusion calculation result.

26. The apparatus according to any one of claims 18, 23, and 24, characterized in that, The first identification module includes: The first identification unit is used to output the first identification result if, during the process of receiving the first game operation information, there is a target dimension whose unreliability meets the first preset identification condition.

27. The apparatus according to any one of claims 18, 23, and 24, characterized in that, The fusion unit includes: The cumulative calculation subunit is used to accumulate and calculate the unreliability corresponding to the multiple dimensions according to the order in which the first game operation information is received, so as to obtain the cumulative unreliability. The first identification module further includes: The second identification unit is used to output the first identification result in response to the cumulative unreliability meeting the first preset identification condition.

28. The apparatus according to claim 18, characterized in that, The device further includes: The information collection module is used to collect network status information of the target client within a second preset time period based on the Websocket connection. The second preset time period is a preset interaction statistics time, which is longer than the first preset time period. The acquisition module is used to acquire the first number of game operation requests sent by the target client within the second preset time period; The information determination module is used to determine the untrustworthiness of the target client based on the network status information and the first quantity.

29. The apparatus according to claim 18, characterized in that, The device further includes: The information integration and processing module is used to respond to the game end operation, obtain the third game operation information of the target client in the whole game, and calculate the unreliability of the target client in the whole game based on the third game operation information and the corresponding fourth game operation information. The fourth game operation information is preset operation reference information, and the fourth game operation information includes at least the second game operation information. The second identification module is used to output a second identification result in response to the fact that the unreliability corresponding to the whole game meets the second preset identification condition. The second identification result is used to indicate that the user corresponding to the target client has cheated in the whole game.

30. The apparatus according to any one of claims 18 to 24, characterized in that, The device also includes an information interaction module, which is used to perform information interaction between the target service node and the target client according to a preset message format based on the Websocket connection, and to add mask information to the interaction information.

31. A cheating behavior detection device, characterized in that, The device includes: The connection establishment module is used to establish a full-duplex WebSocket connection with the target service node in the service cluster; wherein, the target service node for each target client to establish a WebSocket connection is unique and fixed; The identification module is used to collect first game operation information within a first preset time period and feed the first game operation information back to the target service node. The target service node calculates the unreliability of the target client based on the first game operation information and the corresponding second game operation information, so as to determine whether the user corresponding to the target client has cheating behavior based on the unreliability. The first preset time period is the time required for the target service node to respond to the current game operation request of the target client, and the second game operation information is preset operation reference information. The identification module is configured to perform: Within the first preset time period, multiple dimensions of first game operation information are fed back to the target service node, so that the target service node calculates the corresponding unreliability for each dimension of the first game operation information based on the first game operation information and the corresponding second game operation information. The unreliability of each dimension is used to indicate the existence of cheating behavior in each dimension. The unreliability of the multiple dimensions is then fused to obtain the unreliability of the target client. The multiple dimensions of first game operation information are randomly collected by the target client within the first preset time period.

32. The apparatus according to claim 31, characterized in that, The device further includes: The relationship establishment module is used to establish a mapping relationship with the target service node, so that when a Websocekt connection is initiated again, a Websocekt connection can be established with the corresponding target service node according to the mapping relationship.

33. The apparatus according to claim 31, characterized in that, The device further includes: A time processing module is used to obtain the operation time difference between adjacent first game operation information; The request processing module is used to stop sending the game operation request corresponding to the adjacent first game operation information to the target service node in response to the operation time difference being less than a preset time threshold.

34. The apparatus according to any one of claims 31 to 33, characterized in that, The device further includes: The information interaction module is used to enable the target client and the target service node to interact with each other according to a preset message format based on the Websocket connection, and to add mask information to the interaction information.

35. A storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the cheating behavior identification method according to any one of claims 1 to 13, or implements the cheating behavior identification method according to any one of claims 14 to 17.

36. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the cheating behavior identification method according to any one of claims 1 to 13 by executing the executable instructions, or to implement the cheating behavior identification method according to any one of claims 14 to 17.

Images