Plug-in rule generation method, plug-in detection method, device and electronic equipment

Abstract

The application discloses an external plug-in rule generation method, an external plug-in detection method and device, electronic equipment and a computer readable storage medium. The method comprises the following steps: obtaining a trained external plug-in prediction model and first behavior data; using the external plug-in prediction model to predict the first behavior data, extracting each first behavior feature from the first behavior data, the first behavior feature being a behavior feature used to determine a target external plug-in user; screening target behavior features from each first behavior feature based on a preset screening condition, the preset screening condition comprising: the target behavior feature being semantic complete text data, and an external plug-in judgment accuracy rate of a feature group corresponding to at least one target behavior feature being greater than or equal to a preset threshold; and determining an external plug-in rule according to each target behavior feature. The scheme provided by the application can improve the probability of detecting external plug-in players, reduce the missed detection rate, improve the accuracy of external plug-in detection, and make it easier for people to understand the external plug-in judgment rule.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a method for generating cheat rules, a method for detecting cheats, an apparatus, an electronic device, and a computer-readable storage medium. Background Technology

[0002] Game cheats refer to players using automated scripts to enter the system kernel and continuously perform difficult or tedious tasks without rest, such as mass farming or automated task execution. Therefore, cheaters can easily defeat legitimate players, severely impacting game fairness and the gaming experience for normal players.

[0003] In related technologies, the game behavior of players can be analyzed by manually summarized cheat characteristics. When a player's game behavior is consistent with the manually summarized cheat characteristics, the player is determined to be a cheater.

[0004] However, due to the limited diversity of cheat characteristics summarized manually, the types of cheats that can be covered are limited, resulting in many cheaters going undetected, leading to a high false negative rate and poor accuracy in cheat detection. Summary of the Invention

[0005] This application provides a method for generating cheat rules, a method for detecting cheats, an apparatus, an electronic device, and a computer-readable storage medium, which can increase the probability of detecting cheaters, reduce the false negative rate, and improve the accuracy of cheat detection. The specific solution is as follows.

[0006] In a first aspect, embodiments of this application provide a method for generating cheat rules, the method comprising:

[0007] Obtain the trained cheat prediction model and the first behavioral data, which is: the behavioral data of historical cheat users;

[0008] The cheat prediction model is used to predict the first behavior data, and each first behavior feature is extracted from the first behavior data. The first behavior feature is the behavior feature used to determine the target cheat user.

[0009] At least one target behavior feature is selected from each of the first behavior features based on preset filtering conditions. The preset filtering conditions include: the target behavior feature is semantically complete text data, and the plug-in judgment accuracy of the feature group corresponding to the at least one target behavior feature is greater than or equal to a preset threshold.

[0010] The cheat rules are determined based on the behavioral characteristics of each target.

[0011] Optionally, the semantically complete text data is:

[0012] Text data containing a subject, predicate, and object; or,

[0013] Text data containing subject, linking verb, and predicate.

[0014] Optionally, the probability of a virtual user being the target cheat user can be predicted using the cheat prediction model.

[0015] The extraction of each first behavior feature from the first behavior data includes:

[0016] When it is detected that the cheat prediction model has increased the cheat probability corresponding to the first behavior data, the first behavior features that increase the cheat probability are extracted from the first behavior data.

[0017] Optionally, the step of selecting at least one target behavioral feature from the first behavioral features based on preset filtering conditions includes:

[0018] S1: Set i=1;

[0019] S2: Select the 1st to 1st semantically complete behavioral feature from the first behavioral features;

[0020] S3: Calculate the accuracy of the cheat detection for the second feature group composed of the first to i semantically complete behavioral features;

[0021] S4: When the accuracy rate of the second feature group in judging the cheat meets the accuracy condition, each feature in the second feature group is determined as the target behavior feature. The accuracy condition includes: the accuracy rate of the second feature group in judging the cheat is greater than or equal to a preset threshold.

[0022] S5: When the accuracy of the external plug-in judgment of the second feature group does not meet the accuracy condition, make i=i+1, and execute S2~S5 until each feature in the second feature group is determined as the target behavior feature.

[0023] Optionally, before determining each feature in the second feature group as a target behavior feature when the accuracy of the cheat detection of the second feature group meets the accuracy condition, the method further includes:

[0024] Calculate the accuracy of cheat detection for the first feature group, which consists of the 1st to i+1th semantically complete behavioral features;

[0025] The accuracy judgment condition also includes: the difference between the cheat detection accuracy of the first feature group and the cheat detection accuracy of the second feature group is less than a preset difference value.

[0026] Optionally, the calculation of the plug-in detection accuracy of the second feature group composed of the first to i semantically complete behavioral features includes:

[0027] Obtain test behavior data for each of the multiple virtual test users;

[0028] A first number of target behavior data are selected from each of the test behavior data, wherein the target behavior data is consistent with each behavior feature in the second feature group;

[0029] The prediction model is used to predict each of the target behavior data, and a second number of target behavior data of the target plug-in user is determined by the prediction result.

[0030] The ratio of the second quantity to the first quantity is determined as the accuracy of the cheat detection for the second feature group composed of the first to i second behavioral features.

[0031] Optionally, in the process of selecting at least one target behavior feature from the first behavior features, before calculating the accuracy of the cheat detection for the second feature group composed of the first to i semantically complete behavior features, the method further includes:

[0032] When the target accuracy can be found in the stored accuracy information, the target accuracy is determined as the plug-in judgment accuracy of the second feature group composed of the first to i semantically complete behavioral features. The accuracy information includes the plug-in judgment accuracy corresponding to each set feature group. The set feature group corresponding to the target accuracy is the same as the second feature group.

[0033] The calculation of the accuracy of cheat detection for the second feature group composed of the first to i semantically complete behavioral features includes:

[0034] When the target accuracy is not found in the accuracy information, calculate the plug-in judgment accuracy of the second feature group;

[0035] The method further includes:

[0036] The calculated accuracy of the second feature group in identifying cheats is updated in the accuracy information.

[0037] Optionally, extracting each first behavioral feature from the first behavioral data includes:

[0038] When the first row of data is continuous data, the first row of data is discretized to obtain multiple discrete data.

[0039] Each first behavioral feature is extracted from each of the discrete data.

[0040] Optionally, extracting each first behavioral feature from the first behavioral data includes:

[0041] When the cheat prediction model simultaneously predicts multiple sets of first behavior data, each first behavior feature is extracted from the multiple sets of first behavior data through multiple parallel processes.

[0042] Optionally, the accuracy information is stored in a shared variable, and the information in the shared variable is configured to be accessible to each of the processes.

[0043] Secondly, this application provides a method for detecting cheat software, the method comprising:

[0044] Obtain behavioral data corresponding to the virtual users to be predicted;

[0045] When a cheat rule that matches the behavioral data exists in the preset cheat rule library, the virtual user to be predicted is determined as the target cheat user; wherein, each cheat rule in the cheat rule library is generated by any of the cheat rule generation methods described in the first aspect.

[0046] Optionally, the method further includes:

[0047] When the target plug-in user is detected to have performed a preset operation, a verification code pop-up window is displayed, which displays the verification code information.

[0048] If the verification code entered by the user matches the displayed verification code information, the execution result corresponding to the preset operation is displayed.

[0049] Thirdly, this application also provides a plug-in rule generation device, the device comprising:

[0050] The data acquisition unit is used to acquire the trained cheat prediction model and the first behavior data, wherein the first behavior data is: the behavior data of historical cheat users;

[0051] The feature extraction unit is used to predict the first behavior data using the cheat prediction model and extract each first behavior feature from the first behavior data. The first behavior feature is the behavior feature used to determine the target cheat user.

[0052] The feature filtering unit is used to filter at least one target behavior feature from each of the first behavior features based on preset filtering conditions. The preset filtering conditions include: the target behavior feature is semantically complete text data, and the plug-in judgment accuracy of the feature group corresponding to the at least one target behavior feature is greater than or equal to a preset threshold.

[0053] The rule determination unit is used to determine the cheat rules based on the behavioral characteristics of each target.

[0054] Optionally, the semantically complete text data is:

[0055] Text data containing a subject, predicate, and object; or,

[0056] Text data containing subject, linking verb, and predicate.

[0057] Optionally, the probability of a virtual user being the target cheat user can be predicted using the cheat prediction model.

[0058] The feature extraction unit is specifically used for:

[0059] When it is detected that the cheat prediction model has increased the cheat probability corresponding to the first behavior data, the first behavior features that increase the cheat probability are extracted from the first behavior data.

[0060] Optionally, the feature filtering unit is specifically configured to filter at least one target behavior feature from the first behavior features through the following steps:

[0061] S1: Set i=1;

[0062] S2: Select the 1st to 1st semantically complete behavioral feature from the first behavioral features;

[0063] S3: Calculate the accuracy of the cheat detection for the second feature group composed of the first to i semantically complete behavioral features;

[0064] S4: When the accuracy rate of the second feature group in judging the cheat meets the accuracy condition, each feature in the second feature group is determined as the target behavior feature. The accuracy condition includes: the accuracy rate of the second feature group in judging the cheat is greater than or equal to a preset threshold.

[0065] S5: When the accuracy of the external plug-in judgment of the second feature group does not meet the accuracy condition, make i=i+1, and execute S2~S5 until each feature in the second feature group is determined as the target behavior feature.

[0066] Optionally, the feature filtering unit is further configured to:

[0067] Calculate the accuracy of cheat detection for the first feature group, which consists of the 1st to i+1th semantically complete behavioral features;

[0068] The accuracy judgment condition also includes: the difference between the cheat detection accuracy of the first feature group and the cheat detection accuracy of the second feature group is less than a preset difference value.

[0069] Optionally, the feature filtering unit is specifically used for:

[0070] Acquire test behavior data corresponding to multiple test virtual users respectively; filter out a first number of target behavior data from each of the test behavior data, wherein the target behavior data is consistent with each behavior feature in the second feature group; use the prediction model to predict each of the target behavior data, and determine a second number of target behavior data whose prediction result is the target cheat user; determine the ratio of the second number to the first number as the cheat detection accuracy of the second feature group composed of the first to i second behavior features.

[0071] Optionally, the feature filtering unit is further configured to:

[0072] When the target accuracy can be found in the stored accuracy information, the target accuracy is determined as the plug-in judgment accuracy of the second feature group composed of the first to i semantically complete behavioral features. The accuracy information includes the plug-in judgment accuracy corresponding to each set feature group. The set feature group corresponding to the target accuracy is the same as the second feature group.

[0073] The feature filtering unit is specifically used to calculate the cheat detection accuracy of the second feature group composed of the first to i semantically complete behavioral features through the following steps: when the target accuracy is not found in the accuracy information, calculate the cheat detection accuracy of the second feature group.

[0074] The device further includes:

[0075] The storage update unit is used to update the calculated accuracy of the second feature group in the accuracy information.

[0076] Optionally, the feature extraction unit is specifically used for:

[0077] When the first behavior data is continuous data, the first behavior data is discretized to obtain multiple discrete data; each first behavior feature is extracted from each of the discrete data.

[0078] Optionally, the feature extraction unit is specifically used for:

[0079] When the cheat prediction model simultaneously predicts multiple sets of first behavior data, each first behavior feature is extracted from the multiple sets of first behavior data through multiple parallel processes.

[0080] Optionally, the accuracy information is stored in a shared variable, and the information in the shared variable is configured to be accessible to each of the processes.

[0081] Fourthly, embodiments of this application provide an external detection device, the device comprising:

[0082] The acquisition unit is used to acquire behavioral data corresponding to the virtual user to be predicted.

[0083] The prediction unit is used to determine the virtual user to be predicted as the target cheat user when there is a cheat rule in the preset cheat rule library that is consistent with the behavior data; wherein, each cheat rule in the cheat rule library is generated by any of the cheat rule generation methods in the first aspect.

[0084] Optionally, the device further includes:

[0085] The verification unit is used to display a verification code pop-up window when the target plug-in user is detected to have performed a preset operation. The verification code pop-up window displays verification code information. In response to the user inputting a verification code that is the same as the displayed verification code information, the unit displays the execution result corresponding to the preset operation.

[0086] Optionally, the preset operations include at least one of the following: login operation, virtual item purchase operation, virtual property transfer operation, and download operation.

[0087] Fifthly, this application also provides an electronic device, comprising:

[0088] Processor; and

[0089] A memory for storing a data processing program, which, when the electronic device is powered on and runs by the processor, performs the method as described in either the first or second aspect.

[0090] Sixthly, embodiments of this application also provide a computer-readable storage medium storing a data processing program that is executed by a processor to perform the method described in either the first or second aspect.

[0091] Compared with the prior art, this application has the following advantages:

[0092] The cheat rule generation method provided in this application, since the first behavior data is the behavior data of historical cheat users, that is, the first behavior data corresponds to users who have been identified as cheat users, the prediction result of the cheat prediction model on the first behavior data is usually also the target cheat user. In this way, the electronic device can extract the first behavior features from the first behavior data on which the cheat prediction model identifies the user corresponding to the first behavior data as the target cheat user. These extracted first behavior features can represent the characteristics of the target cheat user. The embodiments of this application also filter at least one target behavior feature from each first behavior feature based on preset filtering conditions. Since the preset filtering conditions include the semantically complete target behavior feature, The text data, i.e., the semantics of each target behavior feature, is complete. Therefore, the selected target features are easier for people to understand. People can easily understand why a user is identified as a target cheat user through each target behavior feature. Since the preset filtering conditions also include that the cheat judgment accuracy of at least one feature group corresponding to the target behavior feature is greater than or equal to the preset threshold, the cheat rules obtained from each target behavior feature can well represent the rule characteristics of the target cheat user. When the cheat rule is used to detect the target cheat user, the virtual user that meets the cheat rule can be easily identified as the target cheat user. Moreover, the accuracy of the cheat rules obtained from each target behavior feature is also very high and easier for people to understand.

[0093] As can be seen, the cheat rules provided in this application are highly interpretable and easily understood. In other words, by using cheat rules for cheat detection, it is easy for people to understand why a virtual user is identified as a target cheat user, reducing the phenomenon of false positives and making the cheat detection results more convincing to users. As a result, the cheat rule generation method provided in this application has wider applicability and is easier for various application developers to adopt.

[0094] Furthermore, in this embodiment, since the cheat rules are obtained by parsing the prediction process of the cheat prediction model, when the cheat prediction model predicts a large number of target cheat users, it can parse out a large number of diverse cheat rules. Moreover, the obtained cheat rules can be automatically derived by the electronic device through parsing the prediction process of the cheat prediction model. Therefore, compared with the method of manual summarization, the solution provided by this application can efficiently and quickly derive a wide variety of cheat rules, thereby enabling the cheat rules to cover most cheat types, increasing the number of cheat players that can be detected, reducing the false negative rate, and improving the accuracy of cheat detection. Attached Figure Description

[0095] Figure 1This is a flowchart of an example of the plug-in rule generation method provided in the embodiments of this application;

[0096] Figure 2 This is a flowchart of an example of the plug-in detection method provided in the embodiments of this application;

[0097] Figure 3 This is a flowchart of the cheat rule generation and cheat detection process provided in the embodiments of this application;

[0098] Figure 4 This is a cheat detection accuracy table for cheat rules generated using the method provided in the embodiments of this application;

[0099] Figure 5 This is a comparison chart of the detection of cheats using the cheat detection method provided in this application and the manual detection method;

[0100] Figure 6 This is a graph showing the number of target cheat users detected using the cheat detection method provided in this application.

[0101] Figure 7 This is a structural block diagram of an example of the plug-in rule generation device provided in the embodiments of this application;

[0102] Figure 8 This is a structural block diagram of an example of an electronic device provided in an embodiment of this application. Detailed Implementation

[0103] Many specific details are set forth in the following description to provide a full understanding of this application. However, this application can be implemented in many other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of this application; therefore, this application is not limited to the specific embodiments disclosed below.

[0104] Game cheat detection is one of the most pressing issues for game publishers. One related technology is using artificial intelligence (AI) models to identify cheaters. Specifically, a player's game data is input into the AI ​​model, which then outputs a prediction of whether the player is using cheats. However, due to the black-box nature of AI models, game operators are often very cautious in applying the predictions to avoid misidentifying legitimate players as cheaters.

[0105] In related technologies, manually summarized cheat characteristics can be used to analyze player behavior. When a player's behavior matches the manually summarized cheat characteristics, the player is identified as using cheats. However, due to the limited diversity of manually summarized cheat characteristics and the limited types of cheats they can cover, many cheaters cannot be detected, resulting in a high false negative rate and poor accuracy in cheat detection.

[0106] For the reasons mentioned above, in order to increase the probability of detecting cheaters, reduce the false negative rate, improve the accuracy of cheat detection, and improve the interpretability of cheat detection, the first embodiment of this application provides a cheat rule generation method. This method is applied to an electronic device, which can be a server, a terminal device, or other electronic devices capable of data processing. The terminal device can include desktop computers, laptops, mobile phones, tablets, game consoles, vehicle terminals, etc., and this embodiment of the application does not specifically limit the type of device.

[0107] In this embodiment, the generated cheat rules are used to detect target cheat users. Specifically, the behavior data of virtual users is compared with the cheat rules, and when the behavior data of virtual users meets the cheat rules, the virtual user is determined to be a target cheat user.

[0108] In this embodiment of the application, the generated cheat rules can be used to detect target cheat users in game applications or target cheat users in other applications. This application does not specifically limit this.

[0109] like Figure 1 , Figure 3 As shown, the plug-in rule generation method provided in this application includes the following steps S110 to S140.

[0110] Step S110: Obtain the trained cheat prediction model and the first row of data.

[0111] The first set of data mentioned above is: historical data on the behavior of cheat users.

[0112] The aforementioned cheat prediction model is pre-trained. The training method for the aforementioned cheat prediction model may include the following steps S10 to S30.

[0113] Step S10: Obtain a cheat sample.

[0114] The aforementioned cheat sample includes cheat user characteristic data, which may include at least one of the following: cheat user's profession, level, gold coins carried, display window resolution, and number of items picked up, but is not limited to these. For example... Figure 3 As shown, the determination of external feature data can also be understood as the design process of external features.

[0115] The cheat samples in step S10 can be obtained from the historical behavior data of each user identified as a cheater. Specifically, the historical behavior data can be obtained from the logs of each user identified as a cheater, thus obtaining the cheat samples. Figure 3 As shown, this process can also be understood as the development process of add-on features.

[0116] In this embodiment of the application, the electronic device can use the distributed data engine Hive to parse the logs of users who have been identified as cheaters, obtain the profile information of the cheaters, and develop cheat feature data of the cheaters based on the profile information.

[0117] Optionally, the electronic device can uniformly combine various plug-in feature data into a plug-in feature table, and update the plug-in feature data in the plug-in feature table at preset time intervals. For example, a routine deployment tool can be used to deploy routines to the plug-in feature table, thereby realizing the updating of the plug-in feature table.

[0118] In the embodiments of this application, such as Figure 3 As shown, step S10 can also be understood as the process of constructing plug-in features.

[0119] In step S10, external samples can also be obtained in other ways, and this application does not specifically limit the methods.

[0120] Step S20: Obtain the model to be trained.

[0121] The model to be trained can be any one of the following: neural network model, logistic regression model, linear regression model, ensemble tree model, or other machine learning models.

[0122] Optionally, the model to be trained can be the ensemble tree model LightGBM. Since LightGBM is an efficient, accurate, and distributed gradient boosting tree, its computational accuracy and speed advantages are very obvious. Therefore, in this application, LightGBM can make the external prediction model predict faster and more accurately.

[0123] The parameters for the LightGBM model can be set as follows: 500 sub-model trees, a learning rate of 0.05, and a minimum child weight of 20 for each tree branch. Other parameter settings are also possible for the LightGBM model; this is merely an example, and those skilled in the art can adjust the settings according to their specific circumstances.

[0124] Step S30: Use the above-mentioned cheat samples to train the model to be trained, and obtain the trained cheat prediction model.

[0125] Before step S30, the plug-in feature data in the plug-in samples can be preprocessed. Preprocessing methods may include, but are not limited to, missing data imputation, conversion of string-type data with specific meanings to numeric-type data, discretization of continuous features, feature filtering, and conversion of Chinese feature names. Those skilled in the art can preprocess the plug-in feature data according to actual needs to obtain plug-in samples that meet the training format requirements.

[0126] This application only briefly describes the training process of the cheat prediction model. Those skilled in the art can train a cheat prediction model that meets the usage scenario according to actual needs. This application will not describe the specific prediction method of the model in detail.

[0127] The aforementioned historical cheat users refer to virtual users who have been identified as cheat users. During the operation of games or other applications, the applications typically use various methods to analyze virtual users for cheating, in order to promptly identify which virtual users are cheat users. For example, it can be determined whether a virtual user is cheating by checking whether the client corresponding to the virtual user is running a preset cheat process or cheat program, or by checking whether the user has correctly entered a verification code, etc., but it is not limited to these methods. The historical cheat users in this application embodiment are virtual users who have been identified as cheat users through these methods.

[0128] After a virtual user performs a certain action, corresponding behavioral data is generated for that virtual user, and this behavioral data can be recorded in the virtual user's corresponding behavioral log. For example, if a virtual user picks up 100 virtual items, behavioral data of picking up 100 virtual items will be generated for that virtual user. In this way, electronic devices can easily obtain the behavioral data of each virtual user, such as by obtaining the behavioral data from the virtual user's log, and thus can also easily obtain the behavioral data of the virtual user predicted by the cheat prediction model to be the target cheat user.

[0129] Step S120: Use the above-mentioned external prediction model to predict the first line data and extract each first line feature from the first line data.

[0130] The first behavioral characteristic mentioned above is the behavioral characteristic used by the cheat prediction model to determine the target cheat user.

[0131] In step S120, the first row of data can be input into the cheat prediction model, so that the cheat prediction model can perform prediction operations.

[0132] The first row data obtained in step S110 usually includes multiple first row data. Thus, when making predictions in step S120, the external prediction model can simultaneously predict multiple first row data, making the generation efficiency of external rules higher.

[0133] In the process of predicting the first set of behavioral data, the cheat prediction model typically identifies the virtual user corresponding to the first set of behavioral data as a target cheat user when it detects that the data contains features that meet certain requirements. For example, when the cheat detection model detects that the first set of behavioral data contains the following two behavioral features: continuous online time of more than 15 hours per day and continuous online time between 0:00 and 07:00, the cheat prediction model will identify the virtual user corresponding to the first set of behavioral data as a target cheat user. These two features are the behavioral characteristics upon which the cheat prediction model determines that the virtual user corresponding to the first set of behavioral data is a target cheat user.

[0134] Step S120 is the process of interpreting the prediction process of the cheat prediction model. By interpreting the cheat prediction model, it is easy to determine which features of the first line data the cheat prediction model uses to identify the virtual user corresponding to the first line data as the target cheat user.

[0135] In step S120, the Anchor algorithm can be used to extract the first row features from the first row of data. The Anchor algorithm is an interpretable AI technique capable of generating interpretable rules. The basic idea of ​​the Anchor algorithm is to minimize the impact of changes in features outside the generated interpretable rules on the prediction results of the cheat prediction model. Anchor continuously finds feature data in the sample space formed by the first row of data that causes the cheat prediction model to identify the first row of data as belonging to the target cheat user. Anchor can use the Kullback-Leibler Lower Upper Confidence Bound (KL-LUCB) algorithm to determine the aforementioned interpretable rules. The KL-LUCB algorithm is an algorithm that accurately determines target data in a perturbation space.

[0136] Those skilled in the art can easily use the Anchor algorithm to extract the first row features from the first row of data; the specific extraction process will not be elaborated here.

[0137] Step S130: Select at least one target behavior feature from each first behavior feature based on preset filtering conditions.

[0138] The above-mentioned preset filtering conditions include: the target behavior feature is semantically complete text data, and the accuracy of the plug-in judgment of the feature group corresponding to at least one of the above-mentioned target behavior features is greater than or equal to the preset threshold.

[0139] In this embodiment of the application, the first line of data is text data, therefore the first line feature extracted from the first line of data is also text data. The semantically complete text data can be: text data containing a subject, predicate, and object, or semantically complete text data can be: text data containing a subject, copula, and predicate nominative.

[0140] In this embodiment of the application, the semantic completeness of the first behavioral feature can be determined by identifying the subject-verb-object triplet of the first behavioral feature. When each element in the subject-verb-object triplet of the first behavioral feature is not empty, it is determined that the first behavioral feature contains a subject, a verb, and an object, or it is determined that the first behavioral feature contains a subject, a copula, and a predicate nominative, thereby determining that the first behavioral feature is semantically complete text data.

[0141] Specifically, entity recognition algorithms can be used to identify entity text in the first line of features. Then, associated text that has a subject-verb-object relationship with the entity text can be extracted from the first line of features. Based on the entity text and the corresponding associated text, subject-verb-object triples are generated. The entity recognition algorithm mentioned above can be a named entity recognition (NER) algorithm, or other algorithms that can identify text entities.

[0142] Step S130 can also determine whether the first behavioral feature is semantically complete text data in other ways. For example, it can identify whether the first behavioral feature is semantically complete text data through a text recognition model. The semantic recognition model is a pre-trained model used to identify whether the text has a subject, verb, and object. The specific training process can use common supervised training methods, which will not be elaborated here. This application does not specifically limit the way to determine whether the semantics are complete.

[0143] For example, for the feature "Most picked up that day = Special Mana Potion", its subject is "Most picked up that day", its copula is "=", and its predicate is "Special Mana Potion". Therefore, this feature is semantically complete text data. It can be predefined that the "=" in the text is one of the copulas.

[0144] The preset threshold can be any value between 0.7 and 0.95, for example, 0.7, 0.85, 0.95, etc., but is not limited to these. The larger the preset threshold, the higher the accuracy of the determined first behavioral feature in judging cheating.

[0145] In a specific example, step 130 can be performed by following steps a to d to calculate the plug-in judgment accuracy of at least one target behavior feature corresponding to the feature group.

[0146] Step a: Obtain the test behavior data corresponding to each of the multiple test virtual users.

[0147] The aforementioned test virtual users can be various virtual users corresponding to the application. Taking a game application as an example, the electronic device can randomly select multiple virtual users from the virtual users of the game application as test virtual users, and obtain the test behavior data corresponding to the test virtual users from the game logs of each test virtual user. The test virtual users are used to test the accuracy of the feature group's cheat detection.

[0148] Step b: Select the first number of target behavior data from each test behavior data, and the target behavior data is consistent with each behavior feature in the second feature group.

[0149] For example, if the feature group corresponding to at least one target behavior feature includes the following three behavior features: most picked-up item of the day = special mana potion, 13000.00 < gold coin outflow in face-to-face transactions in the last 7 days <= 30000.00, and -1.00 < number of tasks currently carried <= 0.00, then the electronic device can filter out the target behavior data that meets these three behavior features from the test behavior data, and calculate the number of target behavior data that meets these three behavior features. The calculated number is the first quantity.

[0150] Step c: Use the trained prediction model to predict each target behavior data, and determine the second quantity of target behavior data of the target plug-in user based on the prediction result.

[0151] In step c, the trained prediction model can be used to predict each target behavior data to obtain the prediction results for each target behavior data. The target behavior data whose prediction results are target cheat users are then selected, and the virtual users corresponding to the selected target behavior data are determined as target cheat users. The second number of determined target cheat users is then calculated.

[0152] Step d: Determine the ratio of the second quantity to the first quantity as the plug-in judgment accuracy of the feature group corresponding to at least one target behavior feature.

[0153] Alternatively, at least one feature group corresponding to a target behavioral feature can be used to predict the performance of multiple historical cheat users, and the cheat detection accuracy of the feature group corresponding to at least one target behavioral feature can be determined based on the prediction results. This application does not limit the specific method for determining the cheat detection accuracy.

[0154] Step S140: Determine the cheat rules based on the behavioral characteristics of each target.

[0155] Specifically, each target behavior feature can be determined as the aforementioned plug-in rule, or the behavior sequence formed by splicing and combining each target behavior feature can be determined as the plug-in rule. This application does not limit the way of determining the plug-in rule based on the first behavior feature.

[0156] For example, when the target behavior characteristics include: the sub-region ID with the most items picked up in the last 7 days = Lake Hilmier, the map ID with the most AFKs in the last 7 days = Maraudon, the inflow of mail trade items in the last 7 days <= 1.00, and the number of MOBs in the current day > 5.00, the electronic device can identify these four characteristics as cheat rules, or it can identify cheat rules from (the sub-region ID with the most items picked up in the last 7 days = Lake Hilmier) AND (the map ID with the most AFKs in the last 7 days = Maraudon) AND (the inflow of mail trade items in the last 7 days <= 1.00 AND the number of MOBs in the current day > 5.00).

[0157] Step S120 is... Figure 3 The process of interpreting the cheat rules in the game.

[0158] The cheat rule generation method provided in this application, since the first behavior data is the behavior data of historical cheat users, that is, the first behavior data corresponds to users who have been identified as cheat users, the prediction result of the cheat prediction model on the first behavior data is usually also the target cheat user. In this way, the electronic device can extract the first behavior features from the first behavior data on which the cheat prediction model identifies the user corresponding to the first behavior data as the target cheat user. These extracted first behavior features can represent the characteristics of the target cheat user. The embodiments of this application also filter at least one target behavior feature from each first behavior feature based on preset filtering conditions. Since the preset filtering conditions include the semantically complete target behavior feature, The text data, i.e., the semantics of each target behavior feature, is complete. Therefore, the selected target features are easier for people to understand. People can easily understand why a user is identified as a target cheat user through each target behavior feature. Since the preset filtering conditions also include that the cheat judgment accuracy of at least one feature group corresponding to the target behavior feature is greater than or equal to the preset threshold, the cheat rules obtained from each target behavior feature can well represent the rule characteristics of the target cheat user. When the cheat rule is used to detect the target cheat user, the virtual user that meets the cheat rule can be easily identified as the target cheat user. Moreover, the accuracy of the cheat rules obtained from each target behavior feature is also very high and easier for people to understand.

[0159] As can be seen, the cheat rules provided in this application are highly interpretable and easily understood. In other words, by using cheat rules for cheat detection, it is easy for people to understand why a virtual user is identified as a target cheat user, reducing the phenomenon of false positives and making the cheat detection results more convincing to users. As a result, the cheat rule generation method provided in this application has wider applicability and is easier for various application developers to adopt.

[0160] Furthermore, in this embodiment, since the cheat rules are obtained by parsing the prediction process of the cheat prediction model, when the cheat prediction model predicts a large number of target cheat users, it can parse out a large number of diverse cheat rules. Moreover, the obtained cheat rules can be automatically derived by the electronic device through parsing the prediction process of the cheat prediction model. Therefore, compared with the method of manual summarization, the solution provided by this application can efficiently and quickly derive a wide variety of cheat rules, thereby enabling the cheat rules to cover most cheat types, increasing the number of cheat players that can be detected, reducing the false negative rate, and improving the accuracy of cheat detection.

[0161] Furthermore, this application allows for the generation and updating of cheat rules at irregular or regular intervals to generate a greater number and more diverse range of cheat rules, thereby enabling the detection of target cheat users whose cheating methods are constantly changing.

[0162] In one implementation, the probability that the virtual user to be predicted is the target cheat user is predicted by the above-mentioned cheat prediction model. In other words, the above-mentioned cheat prediction model is used to predict the probability that the virtual user to be predicted is the target cheat user, that is, the cheat prediction model can predict the probability that the virtual user is the target cheat user.

[0163] For example, the prediction result of the cheat prediction model may be that the probability of a user being the target cheat user is 1, 0.8, 0.6, etc. In this case, users whose predicted probability is greater than the set value can be identified as target cheat users. The set value can be any value between 0.7 and 0.9, or other larger probability values.

[0164] In step S120, each first-line feature can be extracted from the first-line data according to the following steps S121.

[0165] Step S121: When it is detected that the cheat prediction model has increased the cheat probability corresponding to the first row of data, extract the first row features that increase the cheat probability from the first row of data.

[0166] The above-mentioned cheat probability is the probability used to determine whether the virtual user corresponding to the first line of data is the target cheat user.

[0167] Specifically, the electronic device can extract the first-behavior features that cause the probability of cheating to increase each time it detects an increase in the probability of cheating.

[0168] When the cheat prediction model predicts virtual users, if the probability that a virtual user is the target cheat user increases once (e.g., from 0.1 to 0.3), it indicates that there is a feature in the first row of data that meets the requirements. If the probability that a virtual user is the target cheat user increases again once (e.g., from 0.3 to 0.5), it indicates that there are other features in the first row of data that meet the requirements. This process continues until all the features that meet the requirements in the first row of data have been found. The probability that a virtual user is the target cheat user is also increased multiple times (e.g., four increases, with the final probability after the increase being 0.8), thus determining the final probability that a virtual user is the target cheat user.

[0169] This implementation method obtains behavioral characteristics that increase the probability of cheating by detecting the increase in the probability of cheating. It can accurately determine which behavioral characteristics will lead to an increase in the probability of a virtual user being a target cheating user. Virtual users with these behavioral characteristics are very likely to be target cheating users. Therefore, these first behavioral characteristics can also well represent the characteristics of target cheating users, so that the cheating rules determined by the target behavioral characteristics selected from each first behavioral characteristic can accurately screen out target cheating users.

[0170] In one specific embodiment, step S130 can be implemented according to the following steps S1 to S5.

[0171] Step S1: Set i=1.

[0172] Step S2: Select the 1st to ith semantically complete behavioral features from each first behavioral feature.

[0173] For example, when i=1, the first semantically complete behavioral feature is selected; when i=2, the first and second semantically complete behavioral features are selected; when i=3, the first, second, and third semantically complete behavioral features are selected, that is, the first to third semantically complete behavioral features are selected.

[0174] Step S3: Calculate the accuracy of the plug-in judgment of the second feature group composed of the first to i semantically complete behavioral features.

[0175] In a specific example, step S3 can calculate the cheat detection accuracy of the second feature group according to the following steps: Obtain test behavior data corresponding to multiple test virtual users; filter out a first number of target behavior data from each test behavior data, where the target behavior data matches each behavior feature in the second feature group; use a trained prediction model to predict each target behavior data, and determine a second number of target behavior data whose predicted result is a target cheat user; determine the ratio of the second number to the first number as the cheat detection accuracy of the second feature group composed of the 1st to 1st semantically complete behavior features. The calculation of the cheat detection accuracy of the second feature group composed of the 1st to 1st semantically complete behavior features in step S3 is similar to steps a to d, and will not be repeated here.

[0176] For example, if the first quantity is 100 and the second quantity is also 100, the accuracy rate of the cheat detection of the second feature group composed of the first to i second behavioral features is 1 (i.e., 100%). If the first quantity is 100 and the second quantity is 90, the accuracy rate of the cheat detection of the second feature group composed of the first to i second behavioral features is 0.9 (i.e., 90%).

[0177] The accuracy calculation method provided in this example first filters out the number of target cheat users through each feature in the second feature group, and then uses the cheat prediction model to detect whether the target cheat users filtered by the second feature group are indeed target cheat users, thus making it easy to calculate the accuracy.

[0178] Optionally, in step S3, behavioral data of users already identified as target cheat users can be obtained. This data is then filtered using the features of the second feature group to identify a third number of behavioral data points that match each feature of the second feature group. The ratio of this third number to the number of virtual users identified as target cheat users is determined as the cheat detection accuracy of the second feature group composed of the first to ith second behavioral features. Virtual users identified as target cheat users can be those created by program developers during software testing when using the application as a cheat, or they can be virtual users identified as target cheat users through other means.

[0179] This method can also easily determine the accuracy of cheat detection for the second feature group.

[0180] In step S3, the accuracy of the external plug-in judgment of the second feature group can also be determined by other means, which are not specifically limited in this application.

[0181] Figure 4 This shows the cheat prediction accuracy and the number of predicted target cheat users corresponding to cheat features of different feature lengths. Figure 4 As can be seen, the prediction accuracy of the various cheat rules generated by the cheat generation method provided in this application is high (above 90%).

[0182] Step S4: When the accuracy of the plug-in judgment of the second feature group composed of the first to i semantically complete behavioral features meets the accuracy condition, each feature in the second feature group is determined as the target behavioral feature.

[0183] The above accuracy conditions include: the accuracy of the second feature group's cheat detection is greater than or equal to a preset threshold.

[0184] Step S5: When the accuracy of the plug-in judgment of the second feature group composed of the first to i semantically complete behavioral features does not meet the accuracy condition, set i=i+1 and execute S2~S5 until each feature in the second feature group composed of the first to i semantically complete behavioral features is determined as the target behavioral feature.

[0185] If, after multiple iterations, none of the features in the second feature group are identified as target behavioral features, it indicates that the identified semantically complete behavioral features cannot accurately predict the target cheat user. In this case, the first behavioral data predicted by the cheat prediction model can be ignored, and the first behavioral features obtained from this data should not be used as the basis for generating cheat rules. This situation is usually caused by an error in the extraction of the first behavioral features. This method can avoid the phenomenon of generating cheat rules with low prediction accuracy due to errors in computer feature extraction.

[0186] This embodiment determines whether each feature in the second feature group can serve as a target behavior feature, i.e., whether it can be used as a standard for generating cheat rules, by sequentially increasing the number of features in the second feature group. This allows for obtaining cheat rules with higher prediction accuracy while minimizing the number of target behavior features, i.e., minimizing the number of behavior features included in the cheat rules. In other words, it enables cheat rules with higher accuracy and shorter length. This results in high cheat detection accuracy and improved detection efficiency, while shorter cheat rules are easier for users to understand and view.

[0187] In one specific embodiment, prior to step S4, the process of selecting at least one target behavioral feature from each of the first behavioral features may further include the following step S6.

[0188] Step S6: Calculate the accuracy of the cheat detection for the first feature group, which consists of the first to i+1 semantically complete behavioral features.

[0189] The method for calculating the accuracy of cheat detection for the first feature group consisting of semantically complete behavioral features from 1 to i+1 can be the same as the method for calculating the accuracy of cheat detection for the second feature group consisting of semantically complete behavioral features from 1 to i, and will not be repeated here.

[0190] The above accuracy judgment conditions may also include: the difference between the cheat detection accuracy of the first feature group and the cheat detection accuracy of the second feature group is less than a preset difference.

[0191] In this embodiment, when an additional semantically complete behavioral feature (i+1) is added to the first to i semantically complete behavioral features, the accuracy of the cheat detection based on the first to i+1 semantically complete behavioral features is not significantly improved. In this case, it indicates that the cheat detection accuracy of the cheat rules determined based on the first to i semantically complete behavioral features is already very high.

[0192] This embodiment can easily obtain the target behavior features based on the accuracy of the external plug-in judgment of the second feature group.

[0193] In one specific embodiment, prior to step S3, the process of selecting at least one target behavioral feature from each of the first behavioral features may further include the following step S7.

[0194] Step S7: When the target accuracy can be found in the stored accuracy information, the target accuracy is determined as the plug-in judgment accuracy of the second feature group composed of the first to i semantically complete behavioral features.

[0195] The accuracy information mentioned above includes the accuracy of each plug-in judgment corresponding to each set feature group, and the set feature group corresponding to the target accuracy is the same as the second feature group.

[0196] The accuracy information mentioned above can be stored in a buffer or in other storage areas of the electronic device; this application does not specifically limit this.

[0197] The aforementioned feature set includes multiple behavioral features. In this embodiment, the cheat detection accuracy corresponding to the feature set can be the cheat detection accuracy calculated by the feature set composed of the first to i semantically complete behavioral features of other virtual users during the process of extracting target behavioral features for other virtual users.

[0198] In the process of calculating the accuracy of cheat detection for feature groups composed of semantically complete behavioral features for different virtual users, it is very likely that there will be repeated calculations of cheat detection accuracy for some virtual users.

[0199] For example, for the first virtual user, the first to fourth semantically complete behavioral characteristics are as follows: the sub-region ID with the most items picked up in the last 7 days is Lake Hilmier, the map ID with the most AFKs in the last 7 days is Maraudon, the inflow of mail trade items in the last 7 days is <= 1.00, and the number of MOBs picked up in the current day is > 5.00; for the second virtual user, the first to fourth semantically complete behavioral characteristics are as follows: the sub-region ID with the most items picked up in the last 7 days is Lake Hilmier, the map ID with the most AFKs in the last 7 days is Maraudon, the inflow of mail trade items in the last 7 days is <= 1.00, and the item picked up most in the current day is a special mana potion. As can be seen from the comparison, the first and second virtual users differ only in the fourth semantically complete behavioral feature, while the first three semantically complete behavioral features are the same. In this case, after calculating the cheat detection accuracy rates corresponding to the feature groups composed of the first semantically complete behavioral feature, the feature groups composed of the first and second semantically complete behavioral features, and the feature groups composed of the first and third semantically complete behavioral features for the first virtual user, these three cheat detection accuracy rates for the first virtual user can be stored. When calculating the cheat detection accuracy rates for each semantically complete behavioral feature for the second virtual user, the cheat detection accuracy rates corresponding to the feature groups composed of the first and second semantically complete behavioral features, and the feature groups composed of the first and third semantically complete behavioral features for the second virtual user can be directly retrieved from the stored accuracy information without calculation, thereby improving the efficiency of accuracy determination and making the generation efficiency of cheat rules higher.

[0200] Step S3 above can be implemented as follows: when the target accuracy is not found in the accuracy information, calculate the plug-in judgment accuracy of the second feature group composed of the first to i semantically complete behavioral features.

[0201] The above-mentioned method for generating cheats may also include the following step S150:

[0202] Step S150: Update the plug-in judgment accuracy of the second feature group composed of the first to i semantically complete behavioral features to the above accuracy information.

[0203] In this embodiment, after storing the calculated accuracy of the second feature group in the accuracy information, when performing subsequent accuracy calculations, the system can first search the accuracy information to see if there is an accuracy of the same feature group corresponding to the cheat detection. This allows for the rapid determination of the cheat detection accuracy to be calculated, reducing the computational load in the cheat rule generation process and making the cheat rule generation more efficient.

[0204] In one implementation, step S120 can extract each first-behavior feature from the first-behavior data according to the following steps:

[0205] When the first row of data is continuous, the first row of data is discretized to obtain multiple discrete data.

[0206] Extract each first behavior feature from each discrete data.

[0207] Specifically, the Minimum Description Length Principle (MDLP) algorithm can be used to discretize the first row of data. MDLP is a continuous feature discretization method that returns the minimum number of split points based on the principle of information compression. Alternatively, binary splitting, equal-distance binning, or equal-frequency binning algorithms can also be used to discretize the first row of data. This application does not limit the specific discretization method.

[0208] This implementation discretizes the continuous first row of data, making the search space for feature extraction of the first row equal to the number of discrete data. Since the number of discrete data is usually limited and small, extracting from each discrete data greatly improves extraction efficiency compared to extracting from the continuous first row of data, thereby improving the extraction efficiency of the plug-in rules.

[0209] In a specific embodiment, in step S120, each first behavior feature can be extracted from the first behavior data according to the following steps: when the above-mentioned plug-in prediction model predicts multiple first behavior data at the same time, the first behavior features are extracted from the multiple first behavior data respectively through multiple parallel processes.

[0210] Specifically, a Python multi-process library called pathos can be used to extract features from multiple first-row data using Anchors.

[0211] Since the different extraction processes are not coupled with each other when extracting features from different first row data, this embodiment utilizes multi-process technology for parallel extraction and computation, which can fully exploit the performance of multi-core CPUs and achieve the effect of accelerating computation.

[0212] In one specific embodiment, the accuracy information can be stored in a shared variable, which is configured to be accessible to each of the aforementioned processes. Thus, during the extraction of the first row of features from the first row of data, each process can search for the plug-in prediction accuracy from the accuracy information stored in the shared variable, thereby facilitating access to the stored accuracy information by each process.

[0213] The second embodiment of this application also provides a method for detecting cheats, such as... Figure 2 , Figure 3 As shown, the external plug-in detection method includes the following steps S210 to S220.

[0214] Step S210: Obtain the behavioral data corresponding to the virtual user to be predicted.

[0215] The method for obtaining the behavioral data corresponding to the virtual user to be predicted can refer to the method for obtaining the first behavioral data in step S110, and will not be repeated here.

[0216] Step S220: When there is a cheat rule in the preset cheat rule library that matches the behavior data of the virtual user to be predicted, determine the virtual user to be predicted as the target cheat user.

[0217] Each cheat rule in the aforementioned cheat rule library is generated using any of the cheat rule generation methods described in the first embodiment.

[0218] Steps S210 and S220 are... Figure 3 The process of filtering cheaters is shown in the image.

[0219] The existence of cheat rules in the cheat rule base that are consistent with the behavioral data corresponding to the virtual user to be predicted means that there are cheat rules in the cheat rule base that are covered by the behavioral data corresponding to the virtual user. The cheat rule being covered by the behavioral data means that every feature in the cheat rule is contained in the behavioral data, that is, the behavioral data contains every feature of the cheat features.

[0220] For example, if the behavioral data corresponding to the virtual user to be predicted has the following three characteristics: most picked-up item of the day = special mana potion, 13000.00 < gold coin outflow in face-to-face transactions in the last 7 days <= 30000.00, and -1.00 < number of tasks currently being carried <= 0.00, and if the cheat rule in the cheat rule library is: most picked-up item of the day = special mana potion & -1.00 < number of tasks currently being carried <= 0.00, since the behavioral data corresponding to the virtual user to be predicted covers this cheat rule, it can be determined that there is a cheat rule in the cheat rule library that is consistent with the behavioral data corresponding to the virtual user to be predicted.

[0221] The cheat detection method provided in this embodiment can be used to detect reported users, screen out suspected cheat groups, etc., and can also be used in other scenarios. This application does not specifically limit it.

[0222] Initial screening of the processing flow

[0223] Faced with tens of thousands of reported users every day, manual verification by customer service is extremely inefficient. However, the cheat detection method based on this application can quickly screen out users who may be using cheats, ensuring a normal gaming experience for a large number of normal players, reducing the manpower consumption of customer service, and enabling targeted and solid evidence of cheats, thereby improving the efficiency of the reporting process and the cheat detection rate.

[0224] When the cheat detection method provided in this application is used to screen out suspected cheat groups, since each cheat rule can describe a cheat group, the cheat rule library can be used to screen out more accurate suspected cheat groups, and then conduct subsequent precise detection. Compared with full user detection, using the solution of this application to screen and then determine from the screened users makes the detection target clearer, the detection method more flexible, and the detection recall rate higher.

[0225] In one specific embodiment, the above-mentioned cheat detection method may further include the following steps S230 to S240.

[0226] Step S230: When the target plug-in user is detected to perform a preset operation, a verification code pop-up window is displayed, which displays the verification code information.

[0227] The aforementioned preset operations may include, for example, logging in, purchasing virtual items such as virtual equipment or virtual skins, transferring virtual assets, downloading, etc., but are not limited to these.

[0228] The aforementioned verification code pop-up window can also display a verification code input box.

[0229] Step S240: In response to the user-input verification code being the same as the displayed verification code information, display the execution result corresponding to the preset operation.

[0230] The verification code entered by the user can be the information that the player enters on the operation interface.

[0231] This embodiment verifies the CAPTCHA of virtual users identified as target cheaters by the cheating rules. This allows players with a high suspicion of cheating to undergo CAPTCHA verification. If they pass the verification, it indicates that they may be normal players, so they can be allowed to perform preset operations. If they fail the verification, it indicates that they are likely cheaters, so they can be refused to perform preset operations without displaying the results.

[0232] Steps S230 to S240 can be understood as Figure 3 The process of providing concrete evidence of cheating involves further verifying the authenticity of virtual users identified by the cheating rules as the target cheating user.

[0233] This embodiment uses a verification code to further verify whether the user is the target cheat user, thereby preventing the target cheat user from performing preset operations and thus greatly limiting the cheat user's cheat operations.

[0234] In one specific embodiment, the method further includes:

[0235] Determine the type of cheat program to which the target cheat user belongs.

[0236] Types of cheats can include, but are not limited to, profit-making cheats, task-based leveling cheats, and fraudulent cheats. Once the type of target cheat user is identified, the game or other operators can promptly learn the type of cheat and take targeted measures to prevent its use.

[0237] Specifically, when the aforementioned cheat detection method is used to screen suspected cheat groups, game logs of the suspected cheat groups (i.e., the identified target cheat users) can be collected over a period of time. After log cleaning and data processing, the user data is presented as behavioral sequences. These behavioral sequences are then calculated using a sequence representation model and mapped to a high-dimensional space. Clustering algorithms such as DBSCAN are then used to determine the type of cheat group. Other methods can also be used to determine the type of target cheat users; this application does not specifically limit this method.

[0238] Corresponding to the cheat rule generation method provided in the first embodiment of this application, the third embodiment of this application also provides a cheat rule generation device, wherein the cheat rules are used to detect target cheat users, such as... Figure 7 As shown, the device includes:

[0239] Data acquisition unit 310 is used to acquire the trained cheat prediction model and the first behavior data, wherein the first behavior data is: the behavior data of historical cheat users;

[0240] Feature extraction unit 320 is used to predict the first behavior data using the cheat prediction model and extract each first behavior feature from the first behavior data. The first behavior feature is the behavior feature used to determine the target cheat user.

[0241] Feature filtering unit 330 is used to filter at least one target behavior feature from each of the first behavior features based on preset filtering conditions. The preset filtering conditions include: the target behavior feature is semantically complete text data, and the plug-in judgment accuracy of the feature group corresponding to the at least one target behavior feature is greater than or equal to a preset threshold.

[0242] The rule determination unit 340 is used to determine the plug-in rules based on the behavioral characteristics of each target.

[0243] Optionally, the semantically complete text data is:

[0244] Text data containing a subject, predicate, and object; or,

[0245] Text data containing subject, linking verb, and predicate.

[0246] Optionally, the probability of a virtual user being the target cheat user can be predicted using the cheat prediction model.

[0247] The feature extraction unit is specifically used for:

[0248] When it is detected that the cheat prediction model has increased the cheat probability corresponding to the first behavior data, the first behavior features that increase the cheat probability are extracted from the first behavior data.

[0249] Optionally, the feature filtering unit is specifically configured to filter at least one target behavior feature from the first behavior features through the following steps:

[0250] S1: Set i=1;

[0251] S2: Select the 1st to 1st semantically complete behavioral feature from the first behavioral features;

[0252] S3: Calculate the accuracy of the cheat detection for the second feature group composed of the first to i semantically complete behavioral features;

[0253] S4: When the accuracy rate of the second feature group in judging the cheat meets the accuracy condition, each feature in the second feature group is determined as the target behavior feature. The accuracy condition includes: the accuracy rate of the second feature group in judging the cheat is greater than or equal to a preset threshold.

[0254] S5: When the accuracy of the external plug-in judgment of the second feature group does not meet the accuracy condition, make i=i+1, and execute S2~S5 until each feature in the second feature group is determined as the target behavior feature.

[0255] Optionally, the feature filtering unit is further configured to:

[0256] Calculate the accuracy of cheat detection for the first feature group, which consists of the 1st to i+1th semantically complete behavioral features;

[0257] The accuracy judgment condition also includes: the difference between the cheat detection accuracy of the first feature group and the cheat detection accuracy of the second feature group is less than a preset difference value.

[0258] Optionally, the feature filtering unit is specifically used for:

[0259] Acquire test behavior data corresponding to multiple test virtual users respectively; filter out a first number of target behavior data from each of the test behavior data, wherein the target behavior data is consistent with each behavior feature in the second feature group; use the prediction model to predict each of the target behavior data, and determine a second number of target behavior data whose prediction result is the target cheat user; determine the ratio of the second number to the first number as the cheat detection accuracy of the second feature group composed of the first to i second behavior features.

[0260] Optionally, the feature filtering unit is further configured to:

[0261] When the target accuracy can be found in the stored accuracy information, the target accuracy is determined as the plug-in judgment accuracy of the second feature group composed of the first to i semantically complete behavioral features. The accuracy information includes the plug-in judgment accuracy corresponding to each set feature group. The set feature group corresponding to the target accuracy is the same as the second feature group.

[0262] The feature filtering unit is specifically used to calculate the cheat detection accuracy of the second feature group composed of the first to i semantically complete behavioral features through the following steps: when the target accuracy is not found in the accuracy information, calculate the cheat detection accuracy of the second feature group.

[0263] The device further includes:

[0264] The storage update unit is used to update the calculated accuracy of the second feature group in the accuracy information.

[0265] Optionally, the feature extraction unit is specifically used for:

[0266] When the first behavior data is continuous data, the first behavior data is discretized to obtain multiple discrete data; each first behavior feature is extracted from each of the discrete data.

[0267] Optionally, the feature extraction unit is specifically used for:

[0268] When the cheat prediction model simultaneously predicts multiple sets of first behavior data, each first behavior feature is extracted from the multiple sets of first behavior data through multiple parallel processes.

[0269] Optionally, the accuracy information is stored in a shared variable, and the information in the shared variable is configured to be accessible to each of the processes.

[0270] Corresponding to the cheat detection method provided in the second embodiment of this application, the fourth embodiment of this application provides a cheat detection device, the device comprising:

[0271] The acquisition unit is used to acquire behavioral data corresponding to the virtual user to be predicted.

[0272] The prediction unit is used to determine the virtual user to be predicted as the target cheat user when there is a cheat rule in the preset cheat rule library that is consistent with the behavior data; wherein, each cheat rule in the cheat rule library is generated by any of the cheat rule generation methods in the first aspect.

[0273] Optionally, the device further includes:

[0274] The verification unit is used to display a verification code pop-up window when the target plug-in user is detected to have performed a preset operation. The verification code pop-up window displays verification code information. In response to the user inputting a verification code that is the same as the displayed verification code information, the unit displays the execution result corresponding to the preset operation.

[0275] Optionally, the preset operations include at least one of the following: login operation, virtual item purchase operation, virtual property transfer operation, and download operation.

[0276] Corresponding to the method for generating cheat rules provided in the first embodiment of this application, the fifth embodiment of this application also provides an electronic device for generating cheat rules. For example... Figure 8 As shown, the electronic device includes: a processor 401; and a memory 402 for storing a program for generating cheat rules. After the device is powered on and the program for generating cheat rules is run by the processor, the following steps are performed:

[0277] Obtain the trained cheat prediction model and the first behavioral data, which is: the behavioral data of historical cheat users;

[0278] The cheat prediction model is used to predict the first behavior data, and each first behavior feature is extracted from the first behavior data. The first behavior feature is the behavior feature used to determine the target cheat user.

[0279] At least one target behavior feature is selected from each of the first behavior features based on preset filtering conditions. The preset filtering conditions include: the target behavior feature is semantically complete text data, and the plug-in judgment accuracy of the feature group corresponding to the at least one target behavior feature is greater than or equal to a preset threshold.

[0280] The cheat rules are determined based on the behavioral characteristics of each target.

[0281] Corresponding to the cheat detection method provided in the second embodiment of this application, the sixth embodiment of this application also provides an electronic device for cheat detection. The electronic device includes: a processor; and a memory for storing a program for the cheat detection method. After the device is powered on and the program for the cheat detection method is run through the processor, the following steps are performed:

[0282] Obtain behavioral data corresponding to the virtual users to be predicted;

[0283] When a cheat rule that matches the behavioral data exists in the preset cheat rule library, the virtual user to be predicted is determined as the target cheat user; wherein, each cheat rule in the cheat rule library is generated by any of the cheat rule generation methods described in the first aspect.

[0284] Corresponding to the cheat rule generation method provided in the first embodiment of this application, the seventh embodiment of this application provides a computer-readable storage medium storing a program for a cheat rule generation method. This program is executed by a processor to perform the following steps:

[0285] Obtain the trained cheat prediction model and the first behavioral data, which is: the behavioral data of historical cheat users;

[0286] The cheat prediction model is used to predict the first behavior data, and each first behavior feature is extracted from the first behavior data. The first behavior feature is the behavior feature used to determine the target cheat user.

[0287] At least one target behavior feature is selected from each of the first behavior features based on preset filtering conditions. The preset filtering conditions include: the target behavior feature is semantically complete text data, and the plug-in judgment accuracy of the feature group corresponding to the at least one target behavior feature is greater than or equal to a preset threshold.

[0288] The cheat rules are determined based on the behavioral characteristics of each target.

[0289] Corresponding to the cheat detection method provided in the second embodiment of this application, the sixth embodiment of this application provides a computer-readable storage medium storing a program for a cheat detection method. This program is executed by a processor to perform the following steps:

[0290] Obtain behavioral data corresponding to the virtual users to be predicted;

[0291] When a cheat rule that matches the behavioral data exists in the preset cheat rule library, the virtual user to be predicted is determined as the target cheat user; wherein, each cheat rule in the cheat rule library is generated by any of the cheat rule generation methods described in the first aspect.

[0292] It should be noted that for a detailed description of the methods, apparatus, electronic devices and computer-readable storage media provided in the second to eighth embodiments of this application, please refer to the relevant description of the first embodiment of this application, which will not be repeated here.

[0293] Although this application discloses preferred embodiments as described above, it is not intended to limit this application. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of this application. Therefore, the scope of protection of this application should be determined by the scope defined in the claims of this application.

[0294] In a typical configuration, a node device in a blockchain includes one or more processors (CPUs), input / output interfaces, network interfaces, and memory.

[0295] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0296] 1. Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information by any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage media, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include non-transitory computer-readable media, such as modulated data signals and carrier waves.

[0297] 2. Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0298] Although this application discloses preferred embodiments as described above, it is not intended to limit this application. Any person skilled in the art can make possible changes and modifications without departing from the spirit and scope of this application. Therefore, the scope of protection of this application should be determined by the scope defined in the claims of this application.

Claims

1. A method for generating cheat rules, characterized in that, The method includes: Obtain the trained cheat prediction model and the first behavioral data, which is: the behavioral data of historical cheat users; The cheat prediction model is used to predict the first behavior data, and each first behavior feature is extracted from the first behavior data. The cheat prediction model is used to predict the probability that a virtual user is a target cheat user. The first behavior feature is: the behavior feature used to determine the target cheat user. At least one target behavior feature is selected from each of the first behavior features based on preset filtering conditions. The preset filtering conditions include: the target behavior feature is semantically complete text data, and the plug-in judgment accuracy of the feature group corresponding to the at least one target behavior feature is greater than or equal to a preset threshold. The cheat rules are determined based on the behavioral characteristics of each target. The step of selecting at least one target behavior feature from the first behavior features based on preset filtering conditions includes: S1: Set i=1; S2: Select the 1st to 1st semantically complete behavioral feature from the first behavioral features; S3: Calculate the accuracy of the cheat detection for the second feature group composed of the first to i semantically complete behavioral features; S4: When the accuracy rate of the second feature group in judging the cheat meets the accuracy condition, each feature in the second feature group is determined as the target behavior feature. The accuracy condition includes: the accuracy rate of the second feature group in judging the cheat is greater than or equal to a preset threshold. S5: When the accuracy of the external plug-in judgment of the second feature group does not meet the accuracy condition, make i=i+1.

2. The method according to claim 1, characterized in that, The semantically complete text data is: Text data containing a subject, predicate, and object; or, Text data containing subject, linking verb, and predicate.

3. The method according to claim 1, characterized in that, The probability of a virtual user being the target cheat user is predicted using the cheat prediction model. The extraction of each first behavior feature from the first behavior data includes: When it is detected that the cheat prediction model has increased the cheat probability corresponding to the first behavior data, the first behavior features that increase the cheat probability are extracted from the first behavior data.

4. The method according to claim 1, characterized in that, Before determining each feature in the second feature group as a target behavior feature when the accuracy of the cheat detection in the second feature group meets the accuracy condition, the method further includes: Calculate the accuracy of cheat detection for the first feature group, which consists of the 1st to i+1th semantically complete behavioral features; The accuracy judgment condition also includes: the difference between the cheat detection accuracy of the first feature group and the cheat detection accuracy of the second feature group is less than a preset difference value.

5. The method according to claim 1, characterized in that, The calculation of the accuracy of cheat detection for the second feature group composed of the first to i semantically complete behavioral features includes: Obtain test behavior data for each of the multiple virtual test users; A first number of target behavior data are selected from each of the test behavior data, wherein the target behavior data is consistent with each behavior feature in the second feature group; The prediction model is used to predict each of the target behavior data, and a second number of target behavior data of the target plug-in user is determined by the prediction result. The ratio of the second quantity to the first quantity is determined as the accuracy of the cheat detection for the second feature group composed of the first to i second behavioral features.

6. The method according to claim 5, characterized in that, In the process of selecting at least one target behavior feature from the first behavior features, before calculating the accuracy of the cheat detection for the second feature group composed of the first to i semantically complete behavior features, the method further includes: When the target accuracy can be found in the stored accuracy information, the target accuracy is determined as the plug-in judgment accuracy of the second feature group composed of the first to i semantically complete behavioral features. The accuracy information includes the plug-in judgment accuracy corresponding to each set feature group. The set feature group corresponding to the target accuracy is the same as the second feature group. The calculation of the accuracy of cheat detection for the second feature group composed of the first to i semantically complete behavioral features includes: When the target accuracy is not found in the accuracy information, calculate the cheat detection accuracy of the second feature group; The method further includes: The calculated accuracy of the second feature group in identifying cheats is updated in the accuracy information.

7. The method according to any one of claims 1 to 6, characterized in that, The extraction of each first behavior feature from the first behavior data includes: When the first row of data is continuous data, the first row of data is discretized to obtain multiple discrete data. Each first behavioral feature is extracted from each of the discrete data.

8. The method according to any one of claims 1 to 6, characterized in that, The extraction of each first behavior feature from the first behavior data includes: When the cheat prediction model simultaneously predicts multiple sets of first behavior data, each first behavior feature is extracted from the multiple sets of first behavior data through multiple parallel processes.

9. The method according to claim 8, characterized in that, The accuracy information is stored in a shared variable, and the information in the shared variable is configured to be accessible to each of the processes.

10. A method for detecting cheats, characterized in that, The method includes: Obtain behavioral data corresponding to the virtual users to be predicted; When a cheat rule that matches the behavioral data exists in the preset cheat rule library, the virtual user to be predicted is determined as the target cheat user; wherein, each cheat rule in the cheat rule library is generated by the cheat rule generation method according to any one of claims 1 to 9; The method further includes: When the target plug-in user is detected to have performed a preset operation, a verification code pop-up window is displayed, which displays the verification code information. If the verification code entered by the user matches the displayed verification code information, the execution result corresponding to the preset operation is displayed.

11. The method for detecting external plug-ins according to claim 10, characterized in that, The preset operations include at least one of the following: login operation, purchase of virtual items operation, transfer of virtual property operation, and download operation.

12. A plugin rule generation device, characterized in that, The device includes: The data acquisition unit is used to acquire the trained cheat prediction model and the first behavior data, wherein the first behavior data is: the behavior data of historical cheat users; The feature extraction unit is used to predict the first behavior data using the cheat prediction model and extract each first behavior feature from the first behavior data. The cheat prediction model is used to predict the probability that a virtual user is a target cheat user. The first behavior feature is: the behavior feature used to determine the target cheat user. The feature filtering unit is used to filter at least one target behavior feature from each of the first behavior features based on preset filtering conditions. The preset filtering conditions include: the target behavior feature is semantically complete text data, and the plug-in judgment accuracy of the feature group corresponding to the at least one target behavior feature is greater than or equal to a preset threshold. The rule determination unit is used to determine the cheat rules based on the behavioral characteristics of each target. The step of selecting at least one target behavior feature from the first behavior features based on preset filtering conditions includes: S1: Set i=1; S2: Select the 1st to 1st semantically complete behavioral feature from the first behavioral features; S3: Calculate the accuracy of the cheat detection for the second feature group composed of the first to i semantically complete behavioral features; S4: When the accuracy rate of the second feature group in judging the cheat meets the accuracy condition, each feature in the second feature group is determined as the target behavior feature. The accuracy condition includes: the accuracy rate of the second feature group in judging the cheat is greater than or equal to a preset threshold. S5: When the accuracy of the external plug-in judgment of the second feature group does not meet the accuracy condition, make i=i+1.

13. An electronic device, characterized in that, include: processor; as well as A memory for storing a data processing program, which, when the electronic device is powered on and runs through the processor, executes the method as described in any one of claims 1-11.

14. A computer-readable storage medium, characterized in that, The system contains a data processing program that is executed by a processor to perform the method as described in any one of claims 1-11.

Images