Anti-cheating detection model construction method and anti-cheating detection method

Abstract

The present application relates to machine learning technology of artificial intelligence, and provides an anti-cheating detection model construction method and an anti-cheating detection method. The anti-cheating detection model construction method includes: obtaining real training data with labels, and the real training data is obtained by data cleaning the sample training set with labels through the trained anomaly detection model; training the initial anti-cheating detection model according to the real training data to obtain the anti-cheating detection model to be adjusted; obtaining a sample test set with labels, and adjusting the anti-cheating detection model to be adjusted based on the model interpretation according to the sample test set to obtain the trained anti-cheating detection model. The present method can obtain an anti-cheating detection model that can realize accurate anti-cheating detection, so that accurate anti-cheating detection can be realized by using the anti-cheating detection model.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to an anti-cheating detection model construction method and an anti-cheating detection method. Background Art

[0002] With the development of computer technology, anti-cheating detection technology has emerged. Anti-cheating detection technology refers to the detection of cheating behaviors in various fields. For example, it can specifically refer to the detection of cheating behaviors such as credit card fraud, insurance fraud, etc. in the financial field. For another example, it can specifically refer to the detection of cheating behaviors in the gaming field.

[0003] In traditional technology, the method used for anti-cheating detection is to obtain black and white sample data carrying labels, use the black and white sample data to train an anti-cheating detection model to obtain a trained anti-cheating detection model, and perform anti-cheating detection according to the anti-cheating detection model.

[0004] However, traditional methods have the problem of low anti-cheating detection accuracy due to excessive noise data in black and white sample data. Summary of the invention

[0005] Based on this, it is necessary to provide an anti-cheating detection model construction method, an anti-cheating detection method, an apparatus, a computer device and a storage medium that can improve the accuracy of anti-cheating detection in response to the above technical problems.

[0006] A method for constructing an anti-cheating detection model, the method comprising:

[0007] Obtaining real training data with labels. The real training data is obtained by cleaning the sample training set with labels using the trained anomaly detection model.

[0008] The initial anti-cheating detection model is trained according to the real training data to obtain the anti-cheating detection model to be adjusted;

[0009] A sample test set with labels is obtained, and the anti-cheating detection model to be adjusted is adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

[0010] An anti-cheating detection method, the method comprising:

[0011] Obtain the data to be tested;

[0012] The trained anti-cheating detection model is used to perform anti-cheating detection on the data to be detected to obtain cheating data. The trained anti-cheating detection model is constructed according to the anti-cheating detection model construction method.

[0013] An anti-cheating detection model construction device, the device comprising:

[0014] The training data acquisition module is used to obtain real training data with labels. The real training data is obtained by cleaning the sample training set with labels through the trained anomaly detection model.

[0015] A training module, used to train the initial anti-cheating detection model according to real training data to obtain the anti-cheating detection model to be adjusted;

[0016] The optimization module is used to obtain a sample test set with labels, and adjust the anti-cheating detection model to be adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

[0017] An anti-cheating detection device, the device comprising:

[0018] A module for acquiring data to be detected, used for acquiring data to be detected;

[0019] The detection module is used to perform anti-cheating detection on the data to be detected by using a trained anti-cheating detection model to obtain cheating data. The trained anti-cheating detection model is constructed according to the above-mentioned anti-cheating detection model construction method.

[0020] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0021] Obtaining real training data with labels. The real training data is obtained by cleaning the sample training set with labels using the trained anomaly detection model.

[0022] The initial anti-cheating detection model is trained according to the real training data to obtain the anti-cheating detection model to be adjusted;

[0023] A sample test set with labels is obtained, and the anti-cheating detection model to be adjusted is adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

[0024] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the following steps are implemented:

[0025] Obtain the data to be tested;

[0026] The trained anti-cheating detection model is used to perform anti-cheating detection on the data to be detected to obtain cheating data. The trained anti-cheating detection model is constructed according to the anti-cheating detection model construction method.

[0027] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0028] Obtaining real training data with labels. The real training data is obtained by cleaning the sample training set with labels using the trained anomaly detection model.

[0029] The initial anti-cheating detection model is trained according to the real training data to obtain the anti-cheating detection model to be adjusted;

[0030] A sample test set with labels is obtained, and the anti-cheating detection model to be adjusted is adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

[0031] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the following steps:

[0032] Obtain the data to be tested;

[0033] The trained anti-cheating detection model is used to perform anti-cheating detection on the data to be detected to obtain cheating data. The trained anti-cheating detection model is constructed according to the anti-cheating detection model construction method.

[0034] The above anti-cheating detection model construction method can obtain clean real training data after data cleaning by obtaining real training data with labels, and then use the real training data to train the initial anti-cheating detection model to obtain the anti-cheating detection model to be adjusted, and finally obtain the sample test set with labels, and adjust the anti-cheating detection model to be adjusted based on the model explanation according to the sample test set, so as to optimize the anti-cheating detection model to be adjusted, and obtain an anti-cheating detection model that can realize accurate anti-cheating detection, so as to realize accurate anti-cheating detection by using the anti-cheating detection model that can realize accurate anti-cheating detection. The above anti-cheating detection method can realize accurate anti-cheating detection by using the anti-cheating detection model that can realize accurate anti-cheating detection to perform anti-cheating detection on the data to be detected. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Figure 1 A schematic diagram of a process for building an anti-cheating detection model in an embodiment;

[0036] Figure 2 A schematic diagram of a method for building an anti-cheating detection model in an embodiment;

[0037] Figure 3 A schematic diagram of a method for building an anti-cheating detection model in another embodiment;

[0038] Figure 4A schematic diagram of a method for building an anti-cheating detection model in yet another embodiment;

[0039] Figure 5 A schematic diagram of a method for building an anti-cheating detection model in yet another embodiment;

[0040] Figure 6 Schematic diagram of a flow chart of an anti-cheating detection method in one embodiment;

[0041] Figure 7 A diagram of an application scenario of an anti-cheating detection model construction method and an anti-cheating detection method in an embodiment;

[0042] Figure 8 A structural block diagram of an anti-cheating detection model building device in one embodiment;

[0043] Fig. 9 is a structural block diagram of an anti-cheating detection device in one embodiment;

[0044] Fig.10 FIG. 4 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0045] The solution provided in the embodiment of the present application involves the machine learning and other technologies of artificial intelligence. Artificial intelligence is the theory, method, technology and application system of using digital computers or machines controlled by digital computers to simulate, extend and expand human intelligence, perceive the environment, acquire knowledge and use knowledge to obtain the best results. In other words, artificial intelligence is a comprehensive technology of computer science, which attempts to understand the essence of intelligence and produce a new intelligent machine that can respond in a similar way to human intelligence. Artificial intelligence is to study the design principles and implementation methods of various intelligent machines so that the machines have the functions of perception, reasoning and decision-making. Machine learning is a multi-field interdisciplinary subject involving probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and other disciplines. It specializes in how computers simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their own performance. Machine learning is the core of artificial intelligence and the fundamental way to make computers intelligent. Its applications are spread across all fields of artificial intelligence. Machine learning and deep learning usually include artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and teaching learning.

[0046] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0047] In one embodiment, Figure 1As shown, a method for building an anti-cheating detection model is provided. This embodiment uses the method applied to a server as an example for illustration. It is understandable that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0048] Step 102, obtaining real training data carrying labels, wherein the real training data is obtained by performing data cleaning on a sample training set carrying labels using a trained anomaly detection model.

[0049] Among them, the real training data refers to the real training samples that have been filtered through noise, that is, the non-real training samples in the sample training set have been filtered out by the trained anomaly detection model. The trained anomaly detection model refers to a model used to perform data cleaning on the sample training set with noise. For example, the trained anomaly detection model can specifically refer to an unsupervised anomaly detection model based on a generative adversarial network. For example, the anomaly detection model in this embodiment can specifically refer to a multi-model-based anomaly detection (Mo_Gaal) model based on a generative adversarial network.

[0050] Among them, the sample training set refers to the sample data used for training, and the sample data refers to the offline data that has been determined to be cheating data, including black sample data and white sample data. The black sample data refers to the offline data that has been determined to be cheating data, and the white sample data refers to the offline data that has been determined to be non-cheating data. The label is used to characterize the type of sample data. For example, the label is used to characterize whether the sample data is specifically black sample data or white sample data. Specifically, according to the different application fields of the anti-cheating detection method in this application, when building an anti-cheating detection model, the sample data required to be obtained are different. For example, in the field of insurance fraud, the sample data includes characteristic data such as the user's premium, reference years, and accident conditions. In the field of game fraud, the sample data includes characteristic data such as average damage per minute, player login time, game duration, travel trajectory, skill release, etc. It should be noted that the sample data in this application can specifically refer to feature data that has been vectorized. When vectorizing, the numerical feature data can be used directly without processing, or the mean variance can be calculated. For discrete feature data, it needs to be encoded, and the encoding method can be one-hot (unique hot encoding) or embedding.

[0051] In the field of anti-cheating detection, black sample data is usually difficult to obtain, and there are often some misjudged sample points in the obtained black sample data (that is, white sample data is misjudged as black sample data). Similarly, there must be some undiscovered black sample data in the white sample data. Therefore, the sample training set is often a training sample containing noise. If such data is used directly for modeling and analysis, there is a high possibility that the anti-cheating detection model will be biased, resulting in low anti-cheating detection accuracy and reduced anti-cheating detection effect. Therefore, it is necessary to use an anomaly detection model to clean the data of the sample training set carrying labels before modeling.

[0052] Specifically, the server will first obtain a sample training set with labels, and use the trained anomaly detection model to distinguish each training sample in the sample training set, so that the trained anomaly detection model outputs a distinction result corresponding to each training sample, determines whether the training sample is a real training sample or a non-real training sample (i.e., noise), and screens out the training samples that are real training samples to obtain real training data with labels.

[0053] Step 104: Train the initial anti-cheating detection model according to the real training data to obtain the anti-cheating detection model to be adjusted.

[0054] The initial anti-cheating detection model refers to a classifier used for anti-cheating detection. For example, the initial anti-cheating detection model may be a Light Gradient Boosting Machine (Lightgbm). For another example, the initial anti-cheating detection model may be an isolation forest model. For another example, the initial anti-cheating detection model may be a random forest model. The initial anti-cheating detection model is not specifically limited in this embodiment.

[0055] Specifically, the server will perform supervised training on the initial anti-cheating detection model according to the labels carried by the real training data, and continuously update the model parameters of the initial anti-cheating detection model through back propagation to obtain the anti-cheating detection model to be adjusted.

[0056] Step 106: Obtain a sample test set with labels, and adjust the anti-cheating detection model to be adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

[0057] The sample test set includes sample data for testing the anti-cheating detection model obtained after training. Adjustment based on model explanation refers to using an explanatory model (such as a linear model, a decision tree, etc.) to locally approximate the prediction of the anti-cheating detection model to be adjusted based on the real training data, and by slightly perturbing the input, detecting what changes have occurred in the output of the anti-cheating detection model to be adjusted, and training an explanatory model at the point of interest (original input) according to this change, analyzing the misjudged sample data based on the explanatory model, determining the sample features that lead to the misjudgment, and adjusting the anti-cheating detection model to be adjusted according to the determined sample features that lead to the misjudgment, so that the sample features used by the anti-cheating detection model to be adjusted during detection are more reasonable, and the trained anti-cheating detection model is obtained. Among them, the misjudged sample data refers to the sample data that is incorrectly judged by the anti-cheating detection model to be adjusted. For example, adjustment based on model explanation can be implemented using the Local Interpretable Model-Agnostic Explanations (Lime).

[0058] Machine learning models, such as the anti-cheating detection model to be adjusted in this embodiment, are almost all black box models, which means that there are always problems with the interpretability of the model. As a result, when a machine learning model makes a misjudgment, our first reaction is to debug the parameters to improve the effect, rather than analyzing the root cause of the misjudgment. By making an in-depth analysis of the misjudgment of the anti-cheating detection model to be adjusted with the help of adjustments based on model explanation, the anti-cheating detection model to be adjusted can be optimized at the root.

[0059] Specifically, the server will input each test sample in the sample test set into the anti-cheating detection model to be adjusted, obtain the misjudged sample data that is incorrectly judged by the anti-cheating detection model to be adjusted, and perform local approximate simulation on the adjusted explanatory model used for model explanation based on the real training data to obtain the trained explanatory model, and then input the misjudged sample data into the trained explanatory model, output the misjudged sample analysis results for the misjudged sample data through the explanatory model, and adjust the anti-cheating detection model to be adjusted based on the misjudged sample analysis results.

[0060] Among them, the analysis results of the false positive samples are used to characterize the influence of each sample feature on the false positive result, including the contribution and correlation of each sample feature to the false positive result. The method of adjusting the anti-cheating detection model to be adjusted according to the analysis results of the false positive samples can be specifically: determining the sample features that have a great influence on the false positive according to the analysis results of the false positive samples, reducing the weight of the sample features that have a great influence on the false positive or deleting the sample features that have a great influence on the false positive to reduce the probability of false positive. Deleting the sample features that have a great influence on the false positive means that the sample features that have a great influence on the false positive are no longer used as the judgment basis for anti-cheating detection. The above anti-cheating detection model construction method can obtain clean real training data after data cleaning by obtaining real training data with labels, and then use the real training data to train the initial anti-cheating detection model to obtain the anti-cheating detection model to be adjusted. Finally, a sample test set with labels is obtained, and the anti-cheating detection model to be adjusted is adjusted based on the model interpretation according to the sample test set to optimize the anti-cheating detection model to be adjusted, so as to obtain an anti-cheating detection model that can realize accurate anti-cheating detection, thereby realizing accurate anti-cheating detection by using the anti-cheating detection model.

[0061] In one embodiment, obtaining real training data with labels includes:

[0062] Get a sample training set with labels;

[0063] The discriminator layer in the trained anomaly detection model discriminates each training sample in the sample training set to obtain a discrimination result corresponding to each training sample;

[0064] The training samples whose discrimination results are true training samples are screened out to obtain the true training data with labels.

[0065] Specifically, the server will first obtain a sample training set with labels. The sample training set can be pre-stored in a preset database, and the server can directly obtain it from the preset database. After obtaining the sample training set, the server will discriminate each training sample in the sample training set through the discriminator layer in the trained anomaly detection model. The discriminator layer will output the first probability that the training sample belongs to the real training sample and the second probability that it belongs to the non-real training sample. By comparing the first probability and the second probability, the discrimination result corresponding to the training sample can be determined. When the first probability is greater than the second probability, the discrimination result of the training sample can be obtained as a real training sample. When the first probability is less than the second probability, the discrimination result of the training sample can be obtained as a non-real training sample. After obtaining the discrimination results corresponding to each training sample, the server will further screen out the training samples whose discrimination results are real training samples to obtain real training data with labels.

[0066] For example, Figure 2 The server discriminates the black samples and white samples in the training set through the discriminator layer in the multi-model-generative adversarial network-based anomaly detection (Mo_Gaal) model, and can output the first probability that the black samples and the white samples belong to the real training samples and the second probability that they belong to the non-real training samples. By comparing the first probability and the second probability, the discrimination results corresponding to the black samples and the white samples can be obtained, and the black samples and the white samples whose discrimination results are the real training samples are screened out to obtain the cleaned black samples and the white samples, and the cleaned black samples and the white samples are used as the final training set.

[0067] In this embodiment, by using the discriminator layer in the anomaly detection model to discriminate each training sample in the sample training set, the training samples are purified, and clean real training data can be provided for anti-cheating detection model training while avoiding the dimensionality curse, so as to improve the accuracy and stability of anti-cheating detection.

[0068] In one embodiment, before discriminating each training sample in the sample training set by using the discriminator layer in the trained anomaly detection model to obtain a discrimination result corresponding to each training sample, the method further includes:

[0069] Obtain noise data and real sample data;

[0070] Input the noise data into the generator layer in the initial anomaly detection model to obtain non-real sample data corresponding to the noise data;

[0071] The discriminator layer in the initial anomaly detection model is trained according to the non-real sample data and the real sample data to obtain a trained anomaly detection model.

[0072] Among them, noise data refers to random numbers that interfere with normal data. For example, noise data can specifically be a normally distributed random number. Real sample data refers to historical data that has been determined to be cheating data. The generator layer is used to use noise data to generate non-real sample data similar to real sample data. The discriminator layer is used to effectively estimate the probability that the data comes from the real sample data or the generator layer.

[0073] Specifically, the server will randomly obtain noise data and real sample data, and input the noise data into the generator layer in the initial anomaly detection model, so that the generator layer generates non-real sample data similar to the real sample data based on the noise data, and then perform supervised training on the discriminator layer in the initial anomaly detection model based on the non-real sample data and the real sample data. The non-real sample data obtained by the generator layer and the parameters of the discriminator layer are continuously optimized through back propagation to obtain a trained anomaly detection model. The trained anomaly detection model can use the trained discriminator layer for data cleaning.

[0074] Further, for example, the initial anomaly detection model in this embodiment can specifically refer to the Mo_Gaal model, which is an integrated model of a single model - anomaly detection based on a generative adversarial network (So_Gaal) model. In order to solve the information missing problem caused by the curse of dimensionality, the generative adversarial learning framework is applied to outlier detection. The So_Gaal model actually performs an active learning process, and the training process can be expressed by the following formula:

[0075]

[0076] Among them, D refers to the discriminator, G refers to the generator, data refers to the real sample data, and z refers to the noise. The formula is to get the discriminator D and the generator G. The discriminator D should maximize the expression on the right side, and G should minimize the expression on the right side. It is a game training process. Figure 3 As shown in the figure, the So_Gaal model contains two deep neural networks, the generator (used to iteratively generate non-real sample data similar to the real sample data (in Figure 3 In the figure, the real sample data is represented by two connected small circles, and the non-real sample data is represented by a single small circle), and the discriminator (used to effectively estimate the probability that the data comes from the real sample data or the generator). In the early stages of model training, the generator may not be able to generate a sufficient amount of non-real sample data. This makes the discriminator use a rough boundary (such as Figure 3 The arc in the boundary judgment (shown in the figure) separates the non-real sample data generated by the generator from the real sample data. However, after several iterations, the generator gradually understands the generation mechanism and synthesizes more and more non-real sample data, which appear inside the real sample data or close to the real sample data (such as Figure 3 The closed curve that surrounds multiple real sample data in the boundary judgment can more accurately distinguish between real sample data and non-real sample data compared to the simple arc in the early stage of training). Among them, the generator and the discriminator in this embodiment are both deep neural networks using fully connected layers, the output dimension of the generator is the dimension of the feature data, and the output dimension of the discriminator is 1 or 2 (binary classification), wherein the specific number of hidden layers and the number of neuron nodes need to be customized according to specific business needs, and the loss function is the binary cross entropy (the loss of the generator also comes from the discriminator).

[0077] The model training results show that the generator can accurately characterize the potential data distribution including non-real sample data, and can increase the diversity of data and reduce the probability of discriminator overfitting while ensuring that the generated data is consistent with the original data distribution. The generator effectively improves the accuracy of the discriminator by generating non-real sample data, which is actually an active learning process. Compared with existing anomaly detection methods based on active learning, the So_Gaal model can directly generate valuable data points. In addition, due to the powerful learning ability of the generative adversarial learning framework, the generator can capture the deep representation of complex data structures without making any assumptions about the generation mechanism, which is more likely to provide consistent good results.

[0078] Furthermore, the Mo_Gaal model is a model integration of the So_Gaal model, and the training process can be expressed by the following formula:

[0079]

[0080]

[0081] The parameters of the training process of the So_Gaal model are the same as above. D in the formula refers to the discriminator, G refers to the generator, and z refers to the noise. Figure 4 As shown in the figure, the Mo_Gaal model contains K generators and discriminators. According to their similar outputs D(x), the noise data is divided into K parts. Similar output refers to the inverse process of spatial smooth transition (samples with similar outputs are more likely to be similar to each other in the sample space, and the data of each subset is also likely to be similar to each other). i Similar values, the target value D(G i (Z)) changes from 1 to T i This integrated approach can enhance the robustness of the model, so that cleaner real training data can be obtained through the training and prediction of the Mo_Gaal model.

[0082] In this embodiment, by using the generator layer in the initial anomaly detection model to generate non-real sample data based on noise data, the diversity of the data can be increased, and then the discriminator layer in the initial anomaly detection model is trained based on the non-real sample data and the real sample data. The probability of overfitting of the discriminator can be reduced and the accuracy of the discriminator can be improved, thereby obtaining an anomaly detection model that can achieve accurate data cleaning, while avoiding the "dimensionality disaster" and improving the stability of detection.

[0083] In one embodiment, the anti-cheating detection model to be adjusted is adjusted based on the model explanation according to the sample test set, and the trained anti-cheating detection model is obtained, including:

[0084] Input each test sample in the sample test set into the anti-cheating detection model to be adjusted, and obtain misjudged sample data that is misjudged by the anti-cheating detection model to be adjusted;

[0085] The preset explanatory model is trained according to the real training data to obtain the trained explanatory model, and the misjudged sample data is input into the trained explanatory model to obtain the misjudged sample analysis result;

[0086] The anti-cheating detection model to be adjusted is adjusted according to the analysis results of the misjudged samples to obtain a trained anti-cheating detection model.

[0087] The misjudged sample data that is misjudged by the anti-cheating detection model to be adjusted refers to the test samples whose judgment results are different from the labels. The misjudged sample analysis results are used to characterize the influence of each sample feature on the misjudged result, including the contribution and correlation of each sample feature to the misjudged result.

[0088] Specifically, the server inputs each test sample in the sample test set into the anti-cheating detection model to be adjusted, so that the anti-cheating detection model to be adjusted can input the prediction result corresponding to the test sample, and by comparing the prediction result with the label carried by the test sample, it can determine the misjudged sample data that is incorrectly judged by the anti-cheating detection model to be adjusted, and then trains the preset explanatory model according to the real training data to obtain a trained explanatory model that is similar to the anti-cheating detection model to be adjusted. By inputting the misjudged sample data into the trained explanatory model, the machine learning explanatory model can analyze the misjudged sample data to obtain the misjudged sample analysis results. Finally, the server can adjust the anti-cheating detection model to be adjusted according to the misjudged sample analysis results to obtain the trained anti-cheating detection model.

[0089] Furthermore, the contribution and correlation of each sample feature to the misjudged sample data are listed in the misjudged sample analysis results. The server can determine which sample features are likely to cause misjudgments through the misjudged sample analysis results, and then adjust the anti-cheating detection model to be adjusted according to the sample features that are likely to cause misjudgments to obtain a trained anti-cheating detection model. The adjustment method may specifically be to delete or correct the sample features, etc., which is not specifically limited in this embodiment.

[0090] For example, the anti-cheating detection model to be adjusted in this embodiment may be a tree model Lightgbm, and the machine learning explanation model may be a Lime model, such as Figure 5The server shown first trains the Lightgbm model with the cleaned training set to obtain the Lightgbm model to be adjusted, then inputs the test set into the Lightgbm model to be adjusted to obtain the misjudged sample data that is incorrectly judged by the anti-cheating detection model to be adjusted, trains the Lime model according to the cleaned training set to obtain the trained Lime model, inputs the misjudged sample data into the trained Lime model to obtain the misjudged sample analysis results, adjusts the Lightgbm model to be adjusted according to the misjudged sample analysis results to obtain the trained Lightgbm model, thereby realizing the use of the Lime model to explain the misjudgment results of the misjudged sample data, and adjusts the Lightbm model to be adjusted according to the obtained misjudgment sample analysis results, thereby optimizing the model characteristics from the root.

[0091] In this embodiment, during the model optimization stage, unlike traditional parameter debugging, a preset explanatory model is innovatively used to analyze the misjudgment results of the test set, and the model features of the anti-cheating detection model to be adjusted are optimized from the root, so that an anti-cheating detection model that can achieve accurate detection can be obtained.

[0092] In one embodiment, Figure 6 As shown, an anti-cheating detection method is provided. This embodiment uses the method applied to a server as an example for illustration. It can be understood that the method can also be applied to a terminal, and can also be applied to a system including a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0093] Step 602, obtaining data to be detected.

[0094] The data to be detected refers to data to be detected to see if it is cheating data.

[0095] Specifically, the server will directly obtain the data to be detected from the external network. The data to be detected here can specifically refer to feature data that has been vectorized or feature data that has not been vectorized. If it is feature data that has not been vectorized, feature calculation needs to be performed on it first to convert it into vectorized feature data.

[0096] Step 604: Perform anti-cheating detection on the data to be detected by using the trained anti-cheating detection model to obtain cheating data. The trained anti-cheating detection model is constructed according to the above anti-cheating detection model construction method.

[0097] The cheating data refers to the data to be detected that is detected as being related to cheating.

[0098] Specifically, the server will input the data to be detected into the trained anti-cheating detection model, obtain the discrimination result corresponding to the data to be detected, and determine the cheating data according to the discrimination result.

[0099] The above anti-cheating detection method can achieve accurate anti-cheating detection by performing anti-cheating detection on the data to be detected using an anti-cheating detection model that can achieve accurate anti-cheating detection.

[0100] In one embodiment, the trained anti-cheating detection model is used to perform anti-cheating detection on the data to be detected, and the obtained cheating data includes:

[0101] Use the trained anti-cheating detection model to perform anti-cheating detection on the data to be detected to obtain suspected cheating data;

[0102] Perform anomaly detection on suspected cheating data to obtain cheating data.

[0103] Among them, suspected cheating data refers to the data to be detected that is detected as cheating data by the trained anti-cheating detection model.

[0104] Specifically, the server will perform anti-cheating detection on the data to be detected through the trained anti-cheating detection model to obtain suspected cheating data. After obtaining the suspected cheating data, the server will further perform anomaly detection on the suspected cheating data to obtain cheating data. In this way, the data can be further filtered to make the obtained cheating data more reliable, further reducing the risk of misjudgment. Furthermore, the method of performing anomaly detection on the suspected cheating data to obtain the cheating data can be: the server performs anomaly detection on the suspected cheating data according to a preset suspected cheating data anomaly detection model to obtain the cheating data. For example, the preset suspected cheating data anomaly detection model can specifically be a preset isolation forest model.

[0105] Among them, the isolation forest model can isolate outliers. In the isolation forest, outliers are defined as outliers that are easily isolated, that is, points that are sparsely distributed and far away from dense groups. In the feature space, sparsely distributed areas indicate that the probability of an event occurring in that area is very low, so the data falling in these areas can be considered abnormal. The isolation forest algorithm is an unsupervised anomaly detection method suitable for continuous data, that is, no labeled samples are required for training, but the features need to be continuous. The idea of ​​constructing an isolation forest is to recursively randomly split the data set until all sample points are isolated. Under this random splitting strategy, outliers usually have shorter paths.

[0106] In this embodiment, the trained anti-cheating detection model is used to perform anti-cheating detection on the data to be detected to obtain suspected cheating data, and abnormality detection is performed on the suspected cheating data to obtain cheating data, which can further filter the data to make the obtained cheating data more reliable, further reducing the risk of misjudgment.

[0107] In one embodiment, abnormality detection is performed on suspected cheating data, and the cheating data obtained includes:

[0108] Input the suspected cheating data into the preset isolation forest model to obtain the isolation forest path length corresponding to the suspected cheating data;

[0109] According to the length of the isolation forest path, cheating data is obtained;

[0110] The preset isolation forest model is obtained by: acquiring historical anti-cheating detection data; and constructing the preset isolation forest model according to the historical anti-cheating detection data and a preset isolation forest algorithm.

[0111] Among them, historical anti-cheating detection data refers to historical data that has been determined to be cheating data.

[0112] Specifically, the server can obtain the isolation forest path length corresponding to the suspected cheating data by inputting the suspected cheating data into the preset isolation forest model, and then obtain the abnormal score corresponding to the suspected cheating data according to the isolation forest path length and the preset abnormal score calculation formula, and finally obtain the cheating data by comparing the abnormal score with the preset abnormal score threshold. Among them, the preset abnormal score calculation formula and the abnormal score threshold can be set as needed, and this embodiment is not specifically limited here. The preset isolation forest model is obtained in the following way: the server first obtains historical anti-cheating detection data, and randomly divides the historical anti-cheating detection data according to the historical anti-cheating detection data and the preset isolation forest algorithm, and obtains multiple binary trees corresponding to the historical anti-cheating detection data, and constructs an isolation forest model with multiple binary trees.

[0113] For example, assuming that it is necessary to perform anomaly detection on suspected cheating data in period T, the server will first obtain the historical anti-cheating detection data in period T-1 for training, and then randomly split the historical anti-cheating detection data in period T-1 according to the preset isolation forest algorithm to build an isolation forest model. Then, based on the isolation forest model, anomaly detection is performed on the suspected cheating data to obtain the cheating data.

[0114] In this embodiment, the suspected cheating data is input into a preset isolation forest model to obtain the isolation forest path length corresponding to the suspected cheating data, and the cheating data is obtained according to the isolation forest path length, so that the cheating data can be determined.

[0115] The present application also provides an application scenario, which applies the above-mentioned anti-cheating detection model construction method and anti-cheating detection method. Specifically, Figure 7 As shown, the anti-cheating detection model construction method and the application of the anti-cheating detection method in the application scenario are as follows:

[0116] The server first obtains training data (including sample training sets and sample test sets with labels), extracts and cleans labels for the sample training sets in the training data to obtain real training data with labels (i.e., cleans the sample training sets through the trained anomaly detection model to obtain real training data with labels), performs model training pre-evaluation based on the real training data with labels to obtain a trained anti-cheating detection model (i.e., trains the initial anti-cheating detection model based on the real training data to obtain an anti-cheating detection model to be adjusted, and adjusts the anti-cheating detection model to be adjusted based on the sample test set based on model explanation to obtain the trained anti-cheating detection model), deploys the trained anti-cheating detection model online, obtains real-time external network data, performs feature calculation on the real-time external network data to obtain data to be detected, uses the deployed anti-cheating detection model to perform anti-cheating detection on the data to be detected to obtain black samples (i.e., suspected cheating data), performs anomaly detection on the black samples to obtain cheating data, and pushes penalties based on the cheating data.

[0117] It should be understood that, although the steps in each flow chart involved in the above-described embodiment are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a portion of the steps in each flow chart involved in the above-described embodiment may include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily carried out in sequence, but can be executed in turn or alternately with other steps or at least a portion of the steps or stages in other steps.

[0118] In one embodiment, Figure 8 As shown, an anti-cheating detection model construction device is provided. The device can adopt a software module or a hardware module, or a combination of the two to become a part of a computer device. The device specifically includes: a training data acquisition module 802, a training module 804 and an optimization module 806, wherein:

[0119] The training data acquisition module 802 is used to acquire real training data with labels, where the real training data is obtained by performing data cleaning on a sample training set with labels using a trained anomaly detection model;

[0120] A training module 804 is used to train the initial anti-cheating detection model according to real training data to obtain an anti-cheating detection model to be adjusted;

[0121] The optimization module 806 is used to obtain a sample test set with labels, and adjust the anti-cheating detection model to be adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

[0122] The anti-cheating detection model construction device can obtain clean real training data after data cleaning by obtaining real training data with labels, and then use the real training data to train the initial anti-cheating detection model to obtain the anti-cheating detection model to be adjusted. Finally, a sample test set with labels is obtained, and the anti-cheating detection model to be adjusted is adjusted based on the model interpretation according to the sample test set to optimize the anti-cheating detection model to be adjusted, so as to obtain an anti-cheating detection model that can realize accurate anti-cheating detection, thereby realizing accurate anti-cheating detection by using the anti-cheating detection model.

[0123] In one embodiment, the training data acquisition module is also used to obtain a sample training set that carries labels, and to discriminate each training sample in the sample training set through the discriminator layer in the trained anomaly detection model to obtain a discrimination result corresponding to each training sample, and to screen out training samples whose discrimination results are real training samples to obtain real training data that carries labels.

[0124] In one embodiment, the anti-cheating detection model building device also includes an anomaly detection model building module, which is used to obtain noise data and real sample data, input the noise data into the generator layer in the initial anomaly detection model, obtain non-real sample data corresponding to the noise data, and train the discriminator layer in the initial anomaly detection model according to the non-real sample data and the real sample data to obtain a trained anomaly detection model.

[0125] In one embodiment, the optimization module is further used to input each test sample in the sample test set into the anti-cheating detection model to be adjusted, obtain misjudged sample data that is incorrectly judged by the anti-cheating detection model to be adjusted, train a preset explanatory model according to the real training data to obtain a trained explanatory model, input the misjudged sample data into the trained explanatory model to obtain misjudged sample analysis results, adjust the anti-cheating detection model to be adjusted according to the misjudged sample analysis results, and obtain a trained anti-cheating detection model.

[0126] In one embodiment, Fig. 9As shown, an anti-cheating detection device is provided. The device can adopt a software module or a hardware module, or a combination of the two to become a part of a computer device. The device specifically includes: a data acquisition module 902 and a detection module 904, wherein:

[0127] The data acquisition module 902 is used to acquire the data to be detected;

[0128] The detection module 904 is used to perform anti-cheating detection on the data to be detected by using the trained anti-cheating detection model to obtain cheating data. The trained anti-cheating detection model is constructed according to the above anti-cheating detection model construction method.

[0129] The anti-cheating detection device can realize accurate anti-cheating detection by performing anti-cheating detection on the data to be detected using an anti-cheating detection model that can realize accurate anti-cheating detection.

[0130] In one embodiment, the detection module is further used to perform anti-cheating detection on the data to be detected by using a trained anti-cheating detection model to obtain suspected cheating data, and perform anomaly detection on the suspected cheating data to obtain cheating data.

[0131] In one embodiment, the detection module is further used to input the suspected cheating data into a preset isolation forest model to obtain the isolation forest path length corresponding to the suspected cheating data, and obtain the cheating data based on the isolation forest path length, wherein the preset isolation forest model is obtained by: obtaining historical anti-cheating detection data; and constructing a preset isolation forest model based on the historical anti-cheating detection data and a preset isolation forest algorithm.

[0132] For the specific limitations of the anti-cheating detection model construction device and the anti-cheating detection device, please refer to the limitations of the anti-cheating detection model construction method and the anti-cheating detection method above, which will not be repeated here. The above-mentioned anti-cheating detection model construction device and each module in the anti-cheating detection device can be implemented in whole or in part by software, hardware and a combination thereof. The above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory of the computer device in the form of software, so that the processor can call and execute the operations corresponding to the above modules.

[0133] In one embodiment, a computer device is provided. The computer device may be a server, and its internal structure diagram may be as follows: Fig.10As shown. The computer device includes a processor 1002, a memory and a network interface 1004 connected via a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium 1006 and an internal memory 1008. The non-volatile storage medium stores an operating system 1010, a computer program 1012 and a database 1014. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store sample data carrying tags, etc. The network interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, an anti-cheating detection model construction method and an anti-cheating detection method are implemented.

[0134] Those skilled in the art will understand that Fig.10 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0135] In one embodiment, a computer device is further provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above method embodiments when executing the computer program.

[0136] In one embodiment, a computer-readable storage medium is provided, storing a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0137] In one embodiment, a computer program product or computer program is provided, the computer program product or computer program includes computer instructions, the computer instructions are stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in the above-mentioned method embodiments.

[0138] Those of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to memory, storage, database or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory or optical memory, etc. Volatile memory can include random access memory (RAM) or external cache memory. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM).

[0139] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0140] The above-mentioned embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the invention patent. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the patent of the present application shall be subject to the attached claims.

Claims

1. A method for constructing an anti-cheating detection model, characterized in that: The method comprises: Get a sample training set with labels; Using the discriminator layer in the trained anomaly detection model to discriminate each training sample in the sample training set, and obtain a discrimination result corresponding to each training sample; Filter out the training samples whose discrimination results are real training samples to obtain real training data with labels; Training the initial anti-cheating detection model according to the real training data to obtain the anti-cheating detection model to be adjusted; A sample test set carrying labels is obtained, and the anti-cheating detection model to be adjusted is adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

2. The method according to claim 1, characterized in that: Before the discriminator layer in the trained anomaly detection model discriminates each training sample in the sample training set to obtain a discrimination result corresponding to each training sample, the method further includes: Obtain noise data and real sample data; Inputting the noise data into a generator layer in an initial anomaly detection model to obtain non-real sample data corresponding to the noise data; The discriminator layer in the initial anomaly detection model is trained according to the non-real sample data and the real sample data to obtain a trained anomaly detection model.

3. The method according to claim 1, characterized in that The step of adjusting the anti-cheating detection model to be adjusted based on the model explanation according to the sample test set to obtain the trained anti-cheating detection model includes: Inputting each test sample in the sample test set into the anti-cheating detection model to be adjusted to obtain misjudged sample data that is misjudged by the anti-cheating detection model to be adjusted; Training a preset explanatory model according to the real training data to obtain a trained explanatory model, and inputting the misjudged sample data into the trained explanatory model to obtain a misjudged sample analysis result; The anti-cheating detection model to be adjusted is adjusted according to the misjudged sample analysis result to obtain a trained anti-cheating detection model.

4. An anti-cheating detection method, characterized in that: include: Obtain the data to be tested; Anti-cheating detection is performed on the data to be detected by using a trained anti-cheating detection model to obtain cheating data, wherein the trained anti-cheating detection model is constructed according to the method according to any one of claims 1 to 3.

5. The method according to claim 4, characterized in that The anti-cheating detection is performed on the data to be detected by using the trained anti-cheating detection model to obtain cheating data including: Performing anti-cheating detection on the data to be detected by using a trained anti-cheating detection model to obtain suspected cheating data; Anomaly detection is performed on the suspected cheating data to obtain cheating data.

6. The method according to claim 5, characterized in that The performing abnormality detection on the suspected cheating data to obtain the cheating data includes: Inputting the suspected cheating data into a preset isolation forest model to obtain an isolation forest path length corresponding to the suspected cheating data; Obtain cheating data according to the isolation forest path length; The preset isolation forest model is obtained by: acquiring historical anti-cheating detection data; and constructing the preset isolation forest model according to the historical anti-cheating detection data and a preset isolation forest algorithm.

7. An anti-cheating detection model construction device, characterized in that: The device comprises: The training data acquisition module is used to obtain a sample training set with labels, discriminate each training sample in the sample training set through the discriminator layer in the trained anomaly detection model, obtain the discrimination result corresponding to each training sample, screen out the training samples whose discrimination results are real training samples, and obtain the real training data with labels; A training module, used to train the initial anti-cheating detection model according to the real training data to obtain the anti-cheating detection model to be adjusted; The optimization module is used to obtain a sample test set carrying labels, and adjust the anti-cheating detection model to be adjusted based on the model explanation according to the sample test set to obtain a trained anti-cheating detection model.

8. The device according to claim 7, characterized in that The device also includes: The anomaly detection model building module is used to obtain noise data and real sample data, input the noise data into the generator layer in the initial anomaly detection model, obtain non-real sample data corresponding to the noise data, and train the discriminator layer in the initial anomaly detection model according to the non-real sample data and the real sample data to obtain a trained anomaly detection model.

9. The device according to claim 7, characterized in that The optimization module is further used to input each test sample in the sample test set into the anti-cheating detection model to be adjusted, obtain misjudged sample data that is incorrectly judged by the anti-cheating detection model to be adjusted, train a preset explanatory model according to the real training data to obtain a trained explanatory model, and input the misjudged sample data into the trained explanatory model to obtain a misjudged sample analysis result, adjust the anti-cheating detection model to be adjusted according to the misjudged sample analysis result, and obtain a trained anti-cheating detection model.

10. An anti-cheating detection device, characterized in that: The device comprises: A module for acquiring data to be detected, used for acquiring data to be detected; A detection module, configured to perform anti-cheating detection on the data to be detected by using a trained anti-cheating detection model to obtain cheating data, wherein the trained anti-cheating detection model is constructed according to the method according to any one of claims 1 to 3.

11. The device according to claim 10, characterized in that The detection module is further used to perform anti-cheating detection on the data to be detected through the trained anti-cheating detection model to obtain suspected cheating data, and perform anomaly detection on the suspected cheating data to obtain cheating data.

12. The device according to claim 11, characterized in that The detection module is also used to input the suspected cheating data into a preset isolation forest model to obtain the isolation forest path length corresponding to the suspected cheating data, and obtain the cheating data based on the isolation forest path length, wherein the preset isolation forest model is obtained by: obtaining historical anti-cheating detection data; and constructing a preset isolation forest model based on the historical anti-cheating detection data and a preset isolation forest algorithm.

13. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

14. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images