Method, device, electronic device and computer-readable storage medium for detecting external devices

Abstract

The present application discloses a plug-in detection method, device, electronic device and computer-readable storage medium. The method includes: when the set detection time is reached, obtaining the first behavior data of the virtual user to be detected; from the multiple second behavior data corresponding to the multiple stored historical plug-in groups, searching for target behavior data similar to the first behavior data, wherein each historical plug-in user contained in any of the historical plug-in groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical plug-in group as a whole; when the target behavior data is found, it is determined that the virtual user to be detected is a plug-in user. The solution provided by the embodiment of the present application can reduce the phenomenon of misjudging normal users as plug-in players, thereby reducing the phenomenon of mishandling normal users, making the plug-in detection more accurate and better ensuring the gaming experience of normal users.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a cheat detection method, device, electronic device and computer-readable storage medium. Background Art

[0002] Game cheats refer to players using automatic scripts to enter the system and continuously perform difficult or boring tasks without taking a break, such as bulk idling, automatic execution of tasks, etc. Therefore, cheat players can easily defeat normal players, causing a great negative impact on game fairness and affecting the gaming experience of normal players.

[0003] In the related art, the model detection method can be used to detect cheating players. However, the detection accuracy of the model detection method depends on the accuracy of the trained model. When the accuracy of the trained model is not high enough, it is easy to misjudge normal players as cheating players, which can easily cause mishandling of normal players (such as account suspension, ban, etc.), affecting the game experience of normal players. Summary of the invention

[0004] The present application provides a cheat detection method, device, electronic device and computer-readable storage medium, which can reduce the phenomenon of misjudging normal users as cheat players, thereby reducing the phenomenon of mishandling normal users, making cheat detection more accurate and better protecting the gaming experience of normal users. The specific scheme is as follows.

[0005] In a first aspect, an embodiment of the present application provides a method for detecting a cheat, the method comprising:

[0006] When the set detection time is reached, the first behavior data of the virtual user to be detected is obtained;

[0007] Searching for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups, wherein each historical cheat user included in any of the historical cheat groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical cheat group as a whole;

[0008] When the target behavior data is found, it is determined that the virtual user to be detected is a plug-in user.

[0009] Optionally, before searching for target behavior data similar to the first behavior data from a plurality of second behavior data respectively corresponding to a plurality of stored historical cheat groups, the method further includes:

[0010] Converting the first behavior data into a first behavior representation vector by using a trained behavior representation model;

[0011] The step of searching for target behavior data similar to the first behavior data from the plurality of second behavior data corresponding to the plurality of historical plug-in groups stored respectively includes:

[0012] From the plurality of second behavior representation vectors corresponding to the plurality of stored historical plug-in groups, a target behavior representation vector similar to the first behavior representation vector is searched.

[0013] Optionally, the second behavior characterization vector corresponding to the historical cheat group is obtained in the following manner:

[0014] Obtaining third behavior data corresponding to each historical cheating user included in the historical cheating group;

[0015] Converting each of the third behavior data into each third behavior representation vector through the behavior representation model;

[0016] The second behavior characterization vector corresponding to the historical plug-in group is determined according to each of the third behavior characterization vectors.

[0017] Optionally, the determining the second behavior representation vector corresponding to the historical cheat group according to each of the third behavior representation vectors includes:

[0018] The average vector of each of the third behavior characterization vectors is determined as the second behavior characterization vector corresponding to the historical plug-in group.

[0019] Optionally, searching for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical plug-in groups respectively includes:

[0020] Obtaining the update times corresponding to the stored multiple historical cheating groups, respectively, wherein the update time is the latest time among the cheating detection times of the historical cheating users included in the historical cheating group;

[0021] Filtering out a target plug-in group from the multiple historical plug-in groups, wherein the update time corresponding to the target plug-in group is shorter than the set time from the current moment;

[0022] From each second behavior data corresponding to each target plug-in group, search for target behavior data similar to the first behavior data.

[0023] Optionally, the method further comprises:

[0024] Obtaining the update times corresponding to the stored multiple historical cheating groups, respectively, wherein the update time is the latest time among the cheating detection times of the historical cheating users included in the historical cheating group;

[0025] The second behavior data corresponding to the first plug-in group is deleted from the multiple second behavior data corresponding to the multiple stored historical plug-in groups, and the update time corresponding to the first plug-in group is equal to or longer than the set time from the current moment.

[0026] Optionally, the method further comprises:

[0027] The second behavior data corresponding to the similar plug-in group is updated according to the first behavior data, and the similar plug-in group is a historical plug-in group corresponding to the target behavior data.

[0028] Optionally, the method further comprises:

[0029] The detection time of the virtual user to be detected is updated to the update time corresponding to the similar plug-in group.

[0030] Optionally, the method further comprises:

[0031] When the target behavior data is not found, monitoring whether there is similar behavior data in a first time period from the current moment, wherein the similar behavior data is: behavior data similar to the first behavior data among the behavior data of each virtual user to be tested obtained in the first time period;

[0032] When the similar behavior data is detected in the first time period, or when a plurality of similar behavior data is detected in the first time period, the virtual user to be detected is determined to be a plug-in user.

[0033] Optionally, before searching for target behavior data similar to the first behavior data from a plurality of second behavior data respectively corresponding to a plurality of stored historical cheat groups, the method further includes:

[0034] Pre-detecting the first behavior data by a set pre-detection method to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in;

[0035] The step of searching for target behavior data similar to the first behavior data from the plurality of second behavior data corresponding to the plurality of historical plug-in groups stored respectively includes:

[0036] When the pre-detection result is suspected to be a cheat, target behavior data similar to the first behavior data is searched from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups.

[0037] Optionally, the method further comprises:

[0038] When the target behavior data is not found, a historical cheating group is created for the virtual user to be detected, and the first behavior data is determined as the second behavior data corresponding to the created historical cheating group.

[0039] Optionally, the second behavior data is any one of the following:

[0040] Average data of each behavior data corresponding to each historical cheating user in the historical cheating group;

[0041] The median data of each behavior data corresponding to each historical cheating user in the historical cheating group arranged by detection time;

[0042] The behavior data with the latest detection time among the behavior data corresponding to each historical cheating user in the historical cheating group.

[0043] Optionally, the detection opportunity includes at least one of the following:

[0044] When the virtual user to be detected logs in;

[0045] Before the virtual user to be detected completes the virtual asset transaction;

[0046] Before the virtual user level to be detected is upgraded.

[0047] Optionally, the method further comprises:

[0048] Acquire the behavior data of each virtual user in real time, and store the behavior data of each virtual user in a storage database;

[0049] The obtaining of first behavior data of the virtual user to be detected includes:

[0050] The first behavior data of the virtual user to be detected is obtained from the storage database.

[0051] Optionally, the first behavior data is a first behavior sequence, and the first behavior sequence includes various behavior events performed by the virtual user to be detected.

[0052] Optionally, the pre-detecting the first behavior data by a set pre-detection method to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in includes:

[0053] Inputting the first behavior data into a trained plug-in detection model to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in;

[0054] Alternatively, the first behavior data is compared with a preset plug-in feature to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in.

[0055] In a second aspect, an embodiment of the present application further provides a cheat detection device, the device comprising:

[0056] An acquisition unit, used for acquiring first behavior data of a virtual user to be detected when a set detection timing is reached;

[0057] A search unit, used to search for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups, wherein each historical cheat user included in any of the historical cheat groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical cheat group as a whole;

[0058] The determination unit is used to determine that the virtual user to be detected is a plug-in user when the target behavior data is found.

[0059] Optionally, the device further comprises:

[0060] A conversion unit, configured to convert the first behavior data into a first behavior representation vector by using a trained behavior representation model;

[0061] The search unit is specifically used to search for a target behavior representation vector similar to the first behavior representation vector from a plurality of second behavior representation vectors corresponding to a plurality of stored historical plug-in groups.

[0062] Optionally, the conversion unit is also used to: obtain each third behavior data corresponding to each historical plug-in user included in the historical plug-in group; convert each third behavior data into each third behavior representation vector through the behavior representation model; and determine the second behavior representation vector corresponding to the historical plug-in group based on each third behavior representation vector.

[0063] Optionally, the conversion unit is specifically used to:

[0064] The average vector of each of the third behavior characterization vectors is determined as the second behavior characterization vector corresponding to the historical plug-in group.

[0065] Optionally, the search unit is specifically used to: obtain update times corresponding to each of the stored multiple historical plug-in groups, the update time being the latest of the plug-in detection times of each historical plug-in user included in the historical plug-in group; filter out a target plug-in group from the multiple historical plug-in groups, the update time corresponding to the target plug-in group being shorter than a set time from the current moment; and search for target behavior data similar to the first behavior data from the second behavior data corresponding to each of the target plug-in groups.

[0066] Optionally, the device further comprises:

[0067] A deletion unit is used to obtain the update times corresponding to the multiple stored historical plug-in groups, where the update time is the latest time among the plug-in detection times of the historical plug-in users included in the historical plug-in groups; and to delete the second behavior data corresponding to the first plug-in group from the multiple second behavior data corresponding to the multiple stored historical plug-in groups, where the update time corresponding to the first plug-in group is equal to or longer than the set time from the current moment.

[0068] Optionally, the device further comprises:

[0069] An updating unit is used to update the second behavior data corresponding to the similar plug-in group according to the first behavior data, and the similar plug-in group is a historical plug-in group corresponding to the target behavior data.

[0070] Optionally, the updating unit is further used to: update the detection time of the virtual user to be detected to the update time corresponding to the similar plug-in group.

[0071] Optionally, the device further comprises:

[0072] a monitoring unit, configured to monitor whether similar behavior data exists in a first time period from a current moment when the target behavior data is not found, wherein the similar behavior data is behavior data similar to the first behavior data among the behavior data of each virtual user to be tested acquired in the first time period;

[0073] The determination unit is further configured to determine the virtual user to be detected as a plug-in user when the similar behavior data is detected within the first time period, or when a plurality of similar behavior data are detected within the first time period.

[0074] Optionally, the device further comprises:

[0075] A pre-detection unit, configured to perform a pre-detection on the first behavior data by a set pre-detection method, and obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in;

[0076] The search unit is specifically used to: when the pre-detection result is a suspected plug-in, search for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical plug-in groups.

[0077] Optionally, the device further comprises:

[0078] A creating unit is used to create a historical cheating group for the virtual user to be detected when the target behavior data is not found, and determine the first behavior data as the second behavior data corresponding to the created historical cheating group.

[0079] Optionally, the second behavior data is any one of the following:

[0080] Average data of each behavior data corresponding to each historical cheating user in the historical cheating group;

[0081] The median data of each behavior data corresponding to each historical cheating user in the historical cheating group arranged by detection time;

[0082] The behavior data with the latest detection time among the behavior data corresponding to each historical cheating user in the historical cheating group.

[0083] Optionally, the detection opportunity includes at least one of the following:

[0084] When the virtual user to be detected logs in;

[0085] Before the virtual user to be detected completes the virtual asset transaction;

[0086] Before the virtual user level to be detected is upgraded.

[0087] Optionally, the device further comprises:

[0088] A storage unit, used to obtain the behavior data of each virtual user in real time and store the behavior data of each virtual user in a storage database;

[0089] The acquisition unit is specifically used to: acquire the first behavior data of the virtual user to be detected from the storage database.

[0090] Optionally, the first behavior data is a first behavior sequence, and the first behavior sequence includes various behavior events performed by the virtual user to be detected.

[0091] Optionally, the pre-detection unit is specifically used to: input the first behavior data into a trained plug-in detection model to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in; or, compare the first behavior data with a preset plug-in feature to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in.

[0092] In a third aspect, the present application further provides an electronic device, including:

[0093] Processor; and

[0094] The memory is used to store a data processing program. After the electronic device is powered on and the program is run by the processor, the method described in any one of the first aspects is executed.

[0095] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium storing a data processing program, which is executed by a processor to perform the method as described in any one of the first aspects.

[0096] Compared with the prior art, this application has the following advantages:

[0097] The plug-in detection method provided by the present application obtains the first behavior data of the virtual user to be detected when the set detection time is reached, and searches for target behavior data similar to the first behavior data from multiple second behavior data corresponding to multiple stored historical plug-in groups. When the first behavior data is similar to the target behavior data, it indicates that the virtual user to be detected has similar behavior data to each historical plug-in virtual user in the historical plug-in group corresponding to the target behavior data. Since each historical plug-in user in the historical plug-in group is a plug-in user that has been detected, the virtual user to be detected has similar behavior data to each plug-in user that has been detected, which indicates that the virtual user to be detected has a group plug-in characteristic, so that the virtual user to be detected can be determined to be a plug-in user.

[0098] In an embodiment of the present application, when the behavior data of the virtual user to be detected is similar to the second behavior data corresponding to a historical plug-in group, it indicates that the virtual user to be detected belongs to the historical plug-in group, that is, the virtual user to be detected and each plug-in user in the historical plug-in group use the same plug-in means (for example, the same plug-in plug-in, the same plug-in software, etc.), thereby being able to indicate that the virtual user to be detected is a plug-in user belonging to the historical plug-in group.

[0099] Since group nature is a universal characteristic of plug-in users, group nature refers to the behavioral characteristics of multiple virtual users using a plug-in means to start a large number of virtual users to play games (or other operations), and each virtual user using the same plug-in means usually has similar behavioral data. In the embodiment of the present application, when the behavioral data of the virtual user to be detected is similar to the behavioral data of a historical plug-in group, that is, when the virtual user to be detected has a group plug-in characteristic, it can basically be explained that the virtual user to be detected belongs to this historical plug-in group, indicating that the virtual user to be detected is using the plug-in means corresponding to the historical plug-in group to perform operations such as games, so it can be accurately determined that the virtual user to be detected is a plug-in user belonging to the historical plug-in group. It can be seen that the probability of misjudgment of the plug-in user determined by the scheme provided by the present application is very small, thereby reducing the phenomenon of misjudging normal users as plug-in users, reducing the phenomenon of mishandling normal users, making the accuracy of plug-in detection higher, and better guaranteeing the gaming experience of normal users. BRIEF DESCRIPTION OF THE DRAWINGS

[0100] Figure 1 is a flowchart of an example of a cheat detection method provided in an embodiment of the present application;

[0101] Figure 2 is a detection flow chart of a cheat detection system provided in an embodiment of the present application;

[0102] Figure 3 Schematic diagram of the training and reasoning process of the behavior representation model in the embodiment of the present application;

[0103] Figure 4 is a structural block diagram of an example of a cheat detection device provided in an embodiment of the present application;

[0104] Figure 5 It is a structural block diagram of an example of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0105] Many specific details are described in the following description to facilitate a full understanding of the present application. However, the present application can be implemented in many other ways than those described herein, and those skilled in the art can make similar generalizations without violating the connotation of the present application, so the present application is not limited by the specific implementation disclosed below.

[0106] Game cheat detection is one of the most urgent problems for game publishers to solve. In related technologies, cheat players can be identified through model detection methods. Specifically, the player's game data can be input into the AI ​​model to output a prediction result of whether the player is a cheat player. Alternatively, the player's game behavior can be analyzed using manually summarized cheat features. When the player's game behavior is consistent with the manually summarized cheat characteristics, the player is determined to be a cheat player.

[0107] However, since the detection accuracy of the cheat feature detection method or the model detection method depends on the accuracy of the summarized cheat features or the trained model, when the accuracy of the summarized cheat features or the trained model is not high enough, normal players may be easily misjudged as cheat players, which may easily lead to incorrect treatment of normal players (such as account blocking, suspension, etc.), affecting the gaming experience of normal players.

[0108] Based on the above reasons, in order to reduce the phenomenon of misjudging normal users as plug-in players, thereby reducing the phenomenon of mishandling normal users, improve the efficiency of real-time detection, and prevent subsequent losses more promptly, thereby making the plug-in detection more accurate and better protecting the gaming experience of normal users, the first embodiment of the present application provides a plug-in detection method, which is applied to electronic devices, which may be servers, desktop computers, laptops, mobile phones, tablet computers, servers, terminal devices, etc., or other electronic devices capable of data processing, which are not specifically limited in the embodiments of the present application.

[0109] The cheat detection method provided in the embodiments of the present application can be used to detect cheat users in virtual games, and can also be used to detect cheats in other applications, which is not specifically limited in the present application.

[0110] like Figure 1 As shown, the cheat detection method provided in the present application includes the following steps S110 to S130.

[0111] Step S110: When the set detection time is reached, the first behavior data of the virtual user to be detected is obtained.

[0112] The detection timing set above may be at least one of the following: when the virtual user to be detected logs in, before the virtual user to be detected completes a virtual asset transaction, and before the level of the virtual user to be detected is upgraded.

[0113] When the above-mentioned virtual user to be detected logs in, it can be when the electronic device receives a login request sent by the client corresponding to the virtual user to be detected, or it can be when the virtual user to be detected completes the login. The virtual user to be detected login refers to the virtual user to be detected logging in to the server corresponding to the application. In this way, when the virtual user to be detected is a plug-in user, it can be discovered in time that it is a plug-in user before it logs in, so that login restrictions such as login restriction and verification code login can be imposed on it, ensuring the timeliness and real-time nature of the detection, thereby avoiding post-loss losses.

[0114] Before the virtual user to be detected completes the virtual asset transaction, it can be when the electronic device receives the virtual asset transaction request initiated by the virtual user to be detected, or when the electronic device detects that the last step of the virtual asset transaction is triggered, but not limited to this. In this way, it can prevent the plug-in user from trading virtual assets, thereby reducing the subsequent losses and protecting the interests of normal users.

[0115] Before the virtual user to be detected is upgraded, it can be when the virtual user to be detected reaches the upgrade condition but has not yet been upgraded, or it can be other time before the virtual user to be detected is upgraded. In this way, it can also prevent external users from upgrading through external means, and ensure the interests of normal users.

[0116] The detection time set above can also be the time when the preset time interval arrives. For example, if the preset time interval is 1 hour, the detection time set above can be the time corresponding to every hour. The detection time set above can also be the preset time. For example, the detection time set can be 8 o'clock every day, 9 o'clock every Monday, etc.

[0117] Those skilled in the art can determine the specific timing of the detection opportunity according to actual scenario requirements, and this application does not specifically limit it.

[0118] In step S110, the electronic device may obtain first behavior data from the behavior log of the virtual user to be detected.

[0119] After a virtual user performs a certain behavior event, corresponding behavior data will be generated for the virtual user, and the behavior data can be recorded in the behavior log corresponding to the virtual user. For example, if a virtual user defeats a virtual monster at a certain moment, behavior data of defeating a virtual monster at a certain moment will be generated for the virtual user. In this way, the electronic device can easily obtain the behavior data of each virtual user, for example, obtain the behavior data from the log of the virtual user, and thus can also easily obtain the first behavior data of the virtual user to be detected.

[0120] In step S110, the first behavior data corresponding to the behavior events completed by the virtual user to be detected within the set time period can be obtained. For example, the first behavior data corresponding to the behavior events completed by the virtual user to be detected within one week or three days before the current moment can be obtained, or the first behavior data of the behavior events completed by the virtual user to be detected within other time periods before the current moment can be obtained. The specific time period can be determined according to the actual application scenario, and the present application does not limit the time period of the obtained first behavior data.

[0121] The first behavior data may be a first behavior sequence, and the first behavior sequence includes various behavior events performed by the virtual user to be detected. Specifically, each behavior event in the first behavior sequence may be arranged according to the time of occurrence of the event. For example, the first behavior sequence may be: 2022.5.1.16:10 Picking up 5 virtual equipment at Lake Hilmiye - 2022.5.1.18:10 Trading virtual items - 2022.5.1.19:20 Purchasing virtual skin.

[0122] like Figure 2 As shown, the plug-in detection method provided in the embodiment of the present application can be applied to a plug-in detection system, which may include an online trigger module, a behavior data storage and query module, a unified general behavior characterization module, a stream data clustering module, a historical suspected library storage module, and a result output module. The execution process of step S110 can be Figure 2 The online trigger module in is executed.

[0123] Step S120: searching for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical plug-in groups.

[0124] Among them, each historical plug-in user included in any historical plug-in group has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical plug-in group as a whole.

[0125] It is understandable that the behavior data corresponding to each historical plug-in user contained in a historical plug-in group are similar, which means that the behavior events performed by each historical plug-in user contained in a historical plug-in group are similar, and also means that a historical plug-in group represents a group of plug-in users with similar plug-in characteristics.

[0126] The second behavior data may be the average data of each behavior data corresponding to each historical plug-in user in the historical plug-in group, or the median data of each behavior data corresponding to each historical plug-in user in the historical plug-in group after being arranged by detection time, or the behavior data with the latest detection time among each behavior data corresponding to each historical plug-in user in the historical plug-in group, or other behavior data that can represent the historical plug-in group as a whole. The above detection time can be understood as the time when the virtual user corresponding to the behavior data is detected as a plug-in user.

[0127] The multiple second behavior data corresponding to the multiple historical plug-in groups can be stored in a database created on the electronic device, and can also be stored in other storage devices other than the electronic device.

[0128] In the embodiment of the present application, each historical cheating user in the historical cheating group may be each cheating user detected after cheating detection in the past. After each cheating user is detected, each cheating user is divided into groups according to the similarity of the behavior data of each cheating user, thereby obtaining each historical cheating group. Specifically, Figure 2 As shown, the behavior data of the historical plug-in group and each historical plug-in user in the historical plug-in group can be obtained through the historical suspected library storage module.

[0129] In step S120, target behavior data similar to the first behavior data may be searched from the plurality of second behavior data according to a text similarity algorithm, or the target behavior data may be searched according to other similarity calculation methods.

[0130] In step S120, the second behavior data corresponding to the historical cheat group may be a second behavior sequence corresponding to the historical cheat group. The specific form of the second behavior sequence may refer to the first behavior sequence, which will not be described in detail here.

[0131] like Figure 2 As shown, the execution process of step S120 is Figure 2 The process of similarity search performed by the midstream data clustering module.

[0132] Step S130: When the target behavior data is found, it is determined that the virtual user to be detected is a plug-in user.

[0133] When the target behavior data can be found, it means that the behavior operations of the virtual user to be detected and the historical plug-in group corresponding to the target behavior data are similar. It can also largely explain that the virtual user to be detected and the various historical plug-in users in the historical plug-in group corresponding to the target behavior data perform plug-in operations through the same plug-in means. Therefore, it can be determined that the virtual user to be detected is a plug-in user.

[0134] The plug-in detection method provided by the present application obtains the first behavior data of the virtual user to be detected when the set detection time is reached, and searches for target behavior data similar to the first behavior data from multiple second behavior data corresponding to multiple stored historical plug-in groups. When the first behavior data is similar to the target behavior data, it indicates that the virtual user to be detected has similar behavior data to each historical plug-in virtual user in the historical plug-in group corresponding to the target behavior data. Since each historical plug-in user in the historical plug-in group is a plug-in user that has been detected, the virtual user to be detected has similar behavior data to each plug-in user that has been detected, which indicates that the virtual user to be detected has a group plug-in characteristic, so that the virtual user to be detected can be determined to be a plug-in user.

[0135] In an embodiment of the present application, when the behavior data of the virtual user to be detected is similar to the second behavior data corresponding to a historical plug-in group, it indicates that the virtual user to be detected belongs to the historical plug-in group, that is, the virtual user to be detected and each plug-in user in the historical plug-in group use the same plug-in means (for example, the same plug-in plug-in, the same plug-in software, etc.), thereby being able to indicate that the virtual user to be detected is a plug-in user belonging to the historical plug-in group.

[0136] Since group nature is a universal characteristic of plug-in users, group nature refers to the behavioral characteristics of multiple virtual users using a plug-in means to start a large number of virtual users to play games (or other operations), and each virtual user using the same plug-in means usually has similar behavioral data. In the embodiment of the present application, when the behavioral data of the virtual user to be detected is similar to the behavioral data of a historical plug-in group, that is, when the virtual user to be detected has a group plug-in characteristic, it can basically be explained that the virtual user to be detected belongs to this historical plug-in group, indicating that the virtual user to be detected is using the plug-in means corresponding to the historical plug-in group to perform operations such as games, so it can be accurately determined that the virtual user to be detected is a plug-in user belonging to the historical plug-in group. It can be seen that the probability of misjudgment of the plug-in user determined by the scheme provided by the present application is very small, thereby reducing the phenomenon of misjudging normal users as plug-in users, reducing the phenomenon of mishandling normal users, making the accuracy of plug-in detection higher, and better guaranteeing the gaming experience of normal users.

[0137] In one implementation, before step S120, the above-mentioned cheat detection method may further include the following step S140.

[0138] Step S140: Pre-detect the first behavior data using a set pre-detection method to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in.

[0139] The pre-detection method set above may be a model detection method, a plug-in feature detection method, a plug-in process detection method, etc., but is not limited thereto.

[0140] Specifically, when the above-set pre-detection method is the model detection method, step S140 can be implemented according to the following steps: input the above-mentioned first behavior data into the trained plug-in detection model to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in.

[0141] When the pre-detection method set above is a feature detection method, step S140 can be implemented according to the following steps: compare the first behavior data with the preset plug-in feature to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in. Specifically, when the first behavior data is consistent with the preset plug-in feature, it is determined that the virtual user to be detected is a suspected plug-in.

[0142] When the pre-detection method set above is the plug-in process detection method, step S140 can be implemented according to the following steps: when it is detected that a preset plug-in process is running on the client corresponding to the virtual user to be detected, it is determined that the virtual user to be detected is a suspected plug-in.

[0143] The above step S140 can be performed by Figure 2 The online trigger module in is executed.

[0144] Step S120 can be implemented according to the following step S121.

[0145] Step S121: When the above pre-detection result is suspected to be a plug-in, search for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical plug-in groups.

[0146] When performing plug-in detection, this embodiment first pre-detects the first behavior data of the virtual user to be detected through a set pre-detection method, which can quickly and efficiently determine whether the virtual user to be detected is a suspected plug-in. When it is determined that the virtual user to be detected is a suspected plug-in, the target behavior data similar to the first behavior data is searched from multiple second behavior data corresponding to multiple historical plug-in groups to further determine whether the virtual user to be detected is a plug-in user. In this way, the number of virtual users to be detected that need to be searched from historical plug-in groups can be reduced through the pre-detection method. Since the pre-detection can detect suspected plug-ins relatively broadly, the pre-detection method can be a relatively simple detection method. In this way, the pre-detection has a relatively low performance consumption on the system during the detection process, and the detection speed is very fast, thereby reducing the consumption of the system performance of the electronic device by plug-in detection and improving the efficiency of plug-in detection.

[0147] In one implementation, before step S120, the above-mentioned cheat detection method may further include the following step S150.

[0148] Step S150: converting the first behavior data into a first behavior representation vector through the trained behavior representation model.

[0149] The above behavior representation vector can represent the behavior data in the form of a vector.

[0150] The trained behavior representation model can be trained in the following manner: obtaining a model to be trained and training samples, inputting the training sample data into the model to be trained for training, and obtaining a trained behavior representation model.

[0151] refer to Figure 3 , Figure 3 The above is the training process of the behavior representation vector model. Figure 3 As shown, the training samples can be obtained from the behavior sequence warehouse, and the above-mentioned model to be trained can be a BERT model, a GameBERT model, a long short-term memory model (Long-Short Term Memory, referred to as LSTM), etc., or other machine learning algorithm models. The above-mentioned training samples can be the behavior data (such as behavior sequences) of each virtual user.

[0152] Exemplarily, during the training process, multiple (for example, 300,000) pieces of behavior sequence data can be obtained from the behavior sequence warehouse every day as the input of the model to be trained, and the GameBERT model can be incrementally trained. After the training is completed, the trained behavior representation model is saved for use as a sequence encoder in the behavior vector conversion stage.

[0153] The training process of the behavior representation model can refer to the relevant training process of the BERT model, which will not be repeated here.

[0154] In step S150, the first behavior data may be input into a trained behavior representation model to obtain a first behavior representation vector.

[0155] Figure 3 The following is the reasoning process of the behavior representation vector model.

[0156] Step S120 can be implemented according to the following step S121.

[0157] Step S121: searching for a target behavior representation vector similar to the first behavior representation vector from among the plurality of second behavior representation vectors corresponding to the plurality of stored historical plug-in groups.

[0158] In step S121, the second behavior data is the second behavior characterization vector, and the first behavior data is the first behavior characterization vector. The second behavior characterization vector corresponding to the historical plug-in group can be obtained by following steps S121a to S121c.

[0159] Step S121a: Acquire the third behavior data corresponding to each historical cheating user included in the historical cheating group.

[0160] Step S121b: converting each third behavior data into each third behavior representation vector through the above-mentioned trained behavior representation model.

[0161] The behavior characterization model in step S121b and the behavior characterization model in step S150 can be the same model, so that it can better ensure that the obtained third behavior characterization vectors and the first behavior characterization vector are located in the same vector space, so that the second behavior characterization vector obtained according to the third behavior characterization vector can be better comparable with the first behavior characterization vector.

[0162] Step S121c: Determine the second behavior representation vector corresponding to the historical plug-in group according to each third behavior representation vector.

[0163] In step S121c, the average vector of each third behavior characterization vector can be determined as the second behavior characterization vector corresponding to the historical plug-in group, the median vector of each third behavior characterization vector arranged by detection time can be determined as the second behavior characterization vector corresponding to the historical plug-in group, or the vector with the latest detection time in each third behavior characterization vector can be determined as the second behavior characterization vector corresponding to the historical plug-in group.

[0164] In step S121a to step S121c, the second behavior characterization vector corresponding to the historical plug-in group can be determined based on the stream data clustering algorithm. Specifically, each historical plug-in group can be regarded as a group cluster, and the third behavior characterization vectors corresponding to each historical plug-in user in the historical plug-in group are each cluster vector in the group cluster. In this way, the cluster center vector of the group cluster can be determined as the second behavior characterization vector corresponding to the historical plug-in group.

[0165] In the embodiment of the present application, the third behavior vector corresponding to each historical plug-in user in the group cluster can be indexed by <user ID, timestamp, group ID> to facilitate subsequent retrieval and search of historical plug-in users when necessary.

[0166] In step S121, it can be specifically implemented as follows: from the multiple second behavior characterization vectors corresponding to the multiple historical plug-in groups stored, search for the target behavior characterization vector whose Euclidean distance with the first behavior characterization vector is less than a preset threshold. When the Euclidean distance between two vectors is relatively small, it means that the similarity between the two vectors is high, and similar vectors can be easily determined by Euclidean distance calculation. In step S121, the similarity between the two vectors can also be determined by calculating the Pearson correlation coefficient, cosine similarity, Manhattan distance, etc. between the first behavior characterization vector and the second behavior characterization vector, which is not specifically limited in this application.

[0167] In this embodiment, the first behavior data and the second behavior data are represented in the form of behavior characterization vectors. The obtained first behavior characterization vectors and second behavior characterization vectors are easier to compare for similarity, and the results of the similarity comparison are more accurate, thereby making the process of plug-in detection more convenient and more accurate.

[0168] Step S150 and step S121 are Figure 2 The unified general behavior characterization module in the embodiment determines the characterization vector library and the behavior characterization vector.

[0169] In a specific embodiment, step S120 can be implemented according to the following steps S122 to S124.

[0170] Step S122: Obtain the update times corresponding to the stored multiple historical plug-in groups.

[0171] The above-mentioned update time is the latest time among the cheat detection times of each historical cheat user included in the historical cheat group.

[0172] For example, if the historical plug-in group includes three historical plug-in users, plug-in user one, plug-in user two, and plug-in user three, and the corresponding detection times of the three users are May 1, 2022, May 4, 2022, and May 5, 2022, respectively, then the corresponding update time of the historical plug-in group is May 5, 2022.

[0173] Step S123: Filter out a target plug-in group from multiple historical plug-in groups.

[0174] The update time corresponding to the target plug-in group is shorter than the set time from the current time.

[0175] The above-mentioned setting time can range from 10 days to 3 months, for example, the setting time can be 3 months, 2 months, 1 month, 10 days, etc. The setting time can also be other longer or shorter time, which is not specifically limited in this application.

[0176] Step S124: searching for target behavior data similar to the first behavior data from the second behavior data corresponding to each target plug-in group.

[0177] In this embodiment, if the time from the update time corresponding to the historical plug-in group to the current moment is longer than the set time, it means that the latest detection time of each historical plug-in user included in the historical plug-in group is also a long time away from the current moment. In this way, it can be explained that there has been no plug-in user similar to the historical plug-in group for a long time, and it also means that the plug-in means corresponding to the historical plug-in group have not been used for a long time. In this case, it means that the plug-in means may have been eliminated or abandoned by the plug-in players. Therefore, the reference value of the behavior data corresponding to the historical plug-in group is not great. In this embodiment, the historical plug-in groups corresponding to these plug-in means that have not been used for a long time are filtered out to obtain the target plug-in group. The second behavior data corresponding to the target plug-in group obtained by screening can find the target behavior data more quickly and efficiently, thereby making the plug-in detection more efficient.

[0178] In another specific embodiment, the above-mentioned cheating detection method may also include the following steps S160 to S170.

[0179] Step S160: Obtain the update times corresponding to the plurality of stored historical plug-in groups.

[0180] The above update time is the latest time among the cheat detection times of the historical cheat users included in the historical cheat group. The implementation process of step S160 can refer to step S122, which will not be repeated here.

[0181] Step S170: deleting the second behavior data corresponding to the first plug-in group from the plurality of second behavior data corresponding to the plurality of stored historical plug-in groups.

[0182] The update time corresponding to the above-mentioned first plug-in group is equal to or longer than the set time from the current time. The specific value of the set time can refer to the set time in step S123, which will not be repeated here.

[0183] This embodiment deletes the second behavior data corresponding to the first plug-in group, that is, deletes the behavior data of the historical plug-in group corresponding to the plug-in means that have not been used for a long time. The deleted data is similar to the previous embodiment and is also not very useful for reference. In this way, when the subsequent plug-in detection is performed, it is based on the behavior data of the plug-in group corresponding to the plug-in means that have not been deleted and have been used recently. In this way, the storage space of the device can be saved and the efficiency of plug-in detection can be made higher.

[0184] In a specific embodiment, the above-mentioned cheating detection method may also include the following step S180.

[0185] Step S180: Update the second behavior data corresponding to the similar plug-in group according to the first behavior data.

[0186] The above-mentioned similar plug-in group is the historical plug-in group corresponding to the target behavior data.

[0187] Specifically, when the first behavior data and the second behavior data are the first behavior characterization vector and the second behavior characterization vector, in step S180, the first behavior vector and the average vector of the third behavior vectors corresponding to each historical plug-in user in the similar plug-in group can be determined as the second behavior data corresponding to the updated similar plug-in group. Alternatively, the first behavior data can also be determined as the second behavior data corresponding to the similar plug-in group.

[0188] Optionally, in step S180, the first behavior data corresponding to the virtual user to be detected may also be added to the similar plug-in group.

[0189] When the first behavior data is similar to the target behavior data, it means that the virtual user to be detected belongs to a similar plug-in group, and the virtual user to be detected and each historical plug-in user in the similar plug-in group belong to the same plug-in group and use the same plug-in method. Therefore, after updating the second behavior data corresponding to the similar plug-in group according to the first behavior data, the second behavior data corresponding to the similar plug-in group can be updated, and the second behavior data can more accurately reflect the behavior characteristics of the similar plug-in group, so that the accuracy of subsequent plug-in detection is higher.

[0190] In a specific embodiment, the above-mentioned cheating detection method may also include the following step S190.

[0191] Step S190: Update the detection time of the virtual user to be detected to the update time corresponding to the similar plug-in group.

[0192] In step S190, since the electronic device performs cheat detection on the virtual user to be detected very quickly, usually completing the detection in seconds, the detection time of the virtual user to be detected is usually the current moment.

[0193] After this embodiment updates the detection time of the virtual user to be detected to the update time corresponding to the similar plug-in group, it means that the plug-in means corresponding to the similar plug-in group is used again at the current moment to perform a plug-in operation, and it also means that the plug-in means is still being actively used. In this case, it means that the reference value of the behavior data of the similar plug-in group is still relatively large, and the similar plug-in group can be used to detect plug-in users later, which is convenient for the subsequent screening or deletion of historical plug-in groups.

[0194] In a specific embodiment, the above-mentioned cheating detection method may also include the following steps S1100 to S1110.

[0195] Step S1100: When the target behavior data is not found, monitor whether there is similar behavior data in the first time period from the current moment.

[0196] The similar behavior data are: behavior data similar to the first behavior data among the behavior data of each virtual user to be tested obtained in the first time period.

[0197] The first time period may range from 3 hours to 2 days. For example, the first time period may be 3 hours, 1 day, 2 days, etc. The first time period may also be other longer or shorter time periods, which is not specifically limited in this application.

[0198] Step S1100 is to monitor whether there is a virtual user to be tested whose corresponding behavior data is similar to the first behavior data among the virtual users to be tested acquired in a first time period from the current moment. The virtual user to be tested is the virtual user to be detected.

[0199] Step S1110: When similar behavior data is monitored within the first time period, the virtual user to be detected is determined to be a plug-in user.

[0200] In this embodiment, when similar behavior data is monitored within the first time period, it means that in the first time period from the current moment to the future, other virtual users have used the same plug-in means as the virtual user to be detected to perform plug-in behavior. This shows that the virtual user to be detected also has group plug-in characteristics to a large extent. The reason why a similar plug-in group is not found in the historical plug-in group is that the virtual user to be detected is likely to have used new plug-in means to perform new plug-in behavior. Since the virtual user to be detected is determined to be a suspected plug-in through pre-detection before the target behavior data query is performed, combined with the group characteristics of the virtual user to be detected, it means that the probability that the virtual user to be detected is a plug-in is very high. Therefore, the virtual user to be detected can be accurately determined as a plug-in user.

[0201] Optionally, step S1120 may also be replaced by the following step S1130.

[0202] Step S1130: When multiple similar behavior data are monitored within the first time period, the virtual user to be detected is determined to be a plug-in user.

[0203] The existence of multiple similar behavior data refers to the existence of multiple similar behavior data corresponding to multiple virtual users to be tested. The number of the multiple similar behavior data can be 10 to 100, or can be more or less, which is not specifically limited in this application.

[0204] In this embodiment, when multiple similar behavior data are stored in the first time period, it can be determined to a greater extent that the virtual user to be detected has group characteristics, so that it is more likely that the virtual user to be detected is a plug-in user, making the plug-in detection more accurate.

[0205] In a specific embodiment, the above-mentioned cheating detection method may also include the following steps S1140.

[0206] Step S1140: When the above-mentioned target behavior data is not found, a historical cheating group is created for the virtual user to be detected, and the first behavior data is determined as the second behavior data corresponding to the created historical cheating group.

[0207] In step S1140, since the first behavior data corresponding to the virtual user to be detected has been pre-detected, it indicates that the virtual user to be detected is suspected of using plug-ins. After the virtual user to be detected is created as a historical plug-in group, the virtual users to be detected subsequently can be easily compared and queried with the created historical plug-in group to determine whether it is a plug-in user group that uses new plug-in methods, thereby improving the plug-in detection rate.

[0208] The execution process of the above steps S170 to S190 and S1140 is Figure 2 The midstream data clustering module performs cluster update, merge, delete, add, and other operations.

[0209] Optionally, the first behavior data is determined as the second behavior data corresponding to the created historical plug-in group, and the detection time of the virtual user to be detected can also be determined as the update time corresponding to the created historical plug-in group. In this way, the created historical plug-in group can also be deleted through steps S170 to S180.

[0210] In one implementation, the above-mentioned cheat detection method may further include the following step S1150.

[0211] Step S1150: Acquire the behavior data of each virtual user in real time, and store the behavior data of each virtual user in a storage database.

[0212] The storage database may be a Key-Value database such as an Hbase database or a Redis database, but is not limited thereto.

[0213] In step S1150, the behavior data corresponding to each virtual user in the storage database may be stored with <user ID, timestamp> as an index. The user ID may be a user's Universally Unique Identifier (UUID). The timestamp refers to the time or time period when the behavior of the virtual user occurs.

[0214] In step S1150, Figure 2 The behavior data storage and query module in is executed.

[0215] In step S110, the first behavior data of the virtual user to be detected can be obtained according to the following step S111.

[0216] Step S111: Acquire the first behavior data of the virtual user to be detected from the storage database.

[0217] In the present embodiment, since the behavior data of each virtual user is acquired in real time and stored in the storage database, when it is necessary to perform plug-in detection on the virtual user to be detected, the behavior data of the virtual user to be detected can be quickly acquired, so that it is possible to timely and quickly detect whether the virtual user to be detected is a plug-in user, which provides timely and effective guarantees for the subsequent processing of the plug-in user, and can better detect the plug-in user before the plug-in user causes losses, thereby ensuring the gaming experience of normal users.

[0218] The above storage database is Figure 2 The suspected population library constructed by the midstream data clustering module.

[0219] Optionally, to facilitate unified offline inspection and batch banning, the data of each plug-in user detected within a preset time period can be packaged and stored, and the packaged data can also be uploaded to a File Transfer Protocol (FTP) system for relevant personnel to view.

[0220] Optionally, the detection results of the virtual users to be detected can be displayed in real time on the user portrait platform, and the cheat statistics can be displayed. Game operators can observe recent changes in the game environment through the statistical indicators on the user portrait platform. The visual display of results makes it easier to quickly verify when reporting complaints. At the same time, when the game operator finds misjudgments or missed judgments, manual annotations can also be used to help improve the cheat detection solution. Specifically, Figure 2 The result output module in outputs and displays the detection results.

[0221] Corresponding to the cheat detection method provided in the first embodiment of the present application, the second embodiment of the present application further provides a cheat detection device. Figure 4 As shown, the cheating detection device provided in the embodiment of the present application includes:

[0222] The acquisition unit 410 is used to acquire the first behavior data of the virtual user to be detected when the set detection time is reached;

[0223] The searching unit 420 is used to search for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheating groups, wherein each historical cheating user included in any of the historical cheating groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical cheating group as a whole;

[0224] The determination unit 430 is used to determine that the virtual user to be detected is a plug-in user when the target behavior data is found.

[0225] Optionally, the device further comprises:

[0226] A conversion unit, configured to convert the first behavior data into a first behavior representation vector by using a trained behavior representation model;

[0227] The searching unit 420 is specifically configured to search for a target behavior representation vector similar to the first behavior representation vector from among a plurality of second behavior representation vectors corresponding to a plurality of stored historical plug-in groups.

[0228] Optionally, the conversion unit is also used to: obtain each third behavior data corresponding to each historical plug-in user included in the historical plug-in group; convert each third behavior data into each third behavior representation vector through the behavior representation model; and determine the second behavior representation vector corresponding to the historical plug-in group based on each third behavior representation vector.

[0229] Optionally, the conversion unit is specifically used to:

[0230] The average vector of each of the third behavior characterization vectors is determined as the second behavior characterization vector corresponding to the historical plug-in group.

[0231] Optionally, the search unit 420 is specifically used to: obtain the update times corresponding to the multiple stored historical plug-in groups, the update time being the latest time among the plug-in detection times of each historical plug-in user contained in the historical plug-in group; filter out a target plug-in group from the multiple historical plug-in groups, the update time corresponding to the target plug-in group being shorter than the set time from the current moment; and search for target behavior data similar to the first behavior data from the second behavior data corresponding to each target plug-in group.

[0232] Optionally, the device further comprises:

[0233] A deletion unit is used to obtain the update times corresponding to the multiple stored historical plug-in groups, where the update time is the latest time among the plug-in detection times of the historical plug-in users included in the historical plug-in groups; and to delete the second behavior data corresponding to the first plug-in group from the multiple second behavior data corresponding to the multiple stored historical plug-in groups, where the update time corresponding to the first plug-in group is equal to or longer than the set time from the current moment.

[0234] Optionally, the device further comprises:

[0235] An updating unit is used to update the second behavior data corresponding to the similar plug-in group according to the first behavior data, and the similar plug-in group is a historical plug-in group corresponding to the target behavior data.

[0236] Optionally, the updating unit is further used to: update the detection time of the virtual user to be detected to the update time corresponding to the similar plug-in group.

[0237] Optionally, the device further comprises:

[0238] a monitoring unit, configured to monitor whether similar behavior data exists in a first time period from a current moment when the target behavior data is not found, wherein the similar behavior data is behavior data similar to the first behavior data among the behavior data of each virtual user to be tested acquired in the first time period;

[0239] The determination unit 430 is further configured to determine the virtual user to be detected as a cheating user when the similar behavior data is detected within the first time period, or when a plurality of similar behavior data are detected within the first time period.

[0240] Optionally, the device further comprises:

[0241] A pre-detection unit, configured to perform a pre-detection on the first behavior data by a set pre-detection method, and obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in;

[0242] The search unit 420 is specifically used to: when the pre-detection result is a suspected cheat, search for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups.

[0243] Optionally, the device further comprises:

[0244] A creating unit is used to create a historical cheating group for the virtual user to be detected when the target behavior data is not found, and determine the first behavior data as the second behavior data corresponding to the created historical cheating group.

[0245] Optionally, the second behavior data is any one of the following:

[0246] Average data of each behavior data corresponding to each historical cheating user in the historical cheating group;

[0247] The median data of each behavior data corresponding to each historical cheating user in the historical cheating group arranged by detection time;

[0248] The behavior data with the latest detection time among the behavior data corresponding to each historical cheating user in the historical cheating group.

[0249] Optionally, the detection opportunity includes at least one of the following:

[0250] When the virtual user to be detected logs in;

[0251] Before the virtual user to be detected completes the virtual asset transaction;

[0252] Before the virtual user level to be detected is upgraded.

[0253] Optionally, the device further comprises:

[0254] A storage unit, used to obtain the behavior data of each virtual user in real time and store the behavior data of each virtual user in a storage database;

[0255] The acquisition unit is specifically used to: acquire the first behavior data of the virtual user to be detected from the storage database.

[0256] Optionally, the first behavior data is a first behavior sequence, and the first behavior sequence includes various behavior events performed by the virtual user to be detected.

[0257] Optionally, the pre-detection unit is specifically used to: input the first behavior data into a trained plug-in detection model to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in; or, compare the first behavior data with a preset plug-in feature to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in.

[0258] Corresponding to the cheat detection method provided in the first embodiment of the present application, the third embodiment of the present application further provides an electronic device for cheat detection. Figure 5As shown, the electronic device includes: a processor 501; and a memory 502, which is used to store a program of a cheat detection method. After the device is powered on and the program of the cheat detection method is run by the processor, the following steps are performed:

[0259] When the set detection time is reached, the first behavior data of the virtual user to be detected is obtained;

[0260] Searching for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups, wherein each historical cheat user included in any of the historical cheat groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical cheat group as a whole;

[0261] When the target behavior data is found, it is determined that the virtual user to be detected is a plug-in user.

[0262] Corresponding to the cheat detection method provided in the first embodiment of the present application, the fourth embodiment of the present application provides a computer-readable storage medium storing a program of the cheat detection method, which is executed by a processor to perform the following steps:

[0263] When the set detection time is reached, the first behavior data of the virtual user to be detected is obtained;

[0264] Searching for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups, wherein each historical cheat user included in any of the historical cheat groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical cheat group as a whole;

[0265] When the target behavior data is found, it is determined that the virtual user to be detected is a plug-in user.

[0266] It should be noted that the detailed description of the apparatus, electronic device and computer-readable storage medium provided in the second to fourth embodiments of the present application can refer to the relevant description of the first embodiment of the present application, and will not be repeated here.

[0267] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

[0268] In a typical configuration, a node device in a blockchain includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0269] Memory may include non-permanent storage in a computer-readable medium, in the form of random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of a computer-readable medium.

[0270] 1. Computer-readable media includes permanent and non-permanent, removable and non-removable media that can be used to store information by any method or technology. Information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), random access memory (RAM) of other attributes, read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage media or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined in this article, computer-readable media does not include non-transitory media such as modulated data signals and carrier waves.

[0271] 2. Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.

[0272] Although the present application is disclosed as above in the form of a preferred embodiment, it is not intended to limit the present application. Any technical personnel in this field may make possible changes and modifications without departing from the spirit and scope of the present application. Therefore, the scope of protection of the present application shall be based on the scope defined by the claims of the present application.

Claims

1. A method for detecting cheating, characterized in that: The method comprises: When the set detection time is reached, the first behavior data of the virtual user to be detected is obtained; Searching for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups, wherein each historical cheat user included in any of the historical cheat groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical cheat group as a whole; When the target behavior data is found, determining that the virtual user to be detected is a plug-in user; The step of searching for target behavior data similar to the first behavior data from the plurality of second behavior data corresponding to the plurality of historical plug-in groups stored respectively includes: Obtaining the update times corresponding to the stored multiple historical cheating groups, respectively, wherein the update time is the latest time among the cheating detection times of the historical cheating users included in the historical cheating group; Filtering out a target plug-in group from the multiple historical plug-in groups, wherein the update time corresponding to the target plug-in group is shorter than the set time from the current moment; From each second behavior data corresponding to each target plug-in group, search for target behavior data similar to the first behavior data.

2. The method according to claim 1, characterized in that Before searching for target behavior data similar to the first behavior data from the plurality of second behavior data respectively corresponding to the plurality of stored historical cheat groups, the method further includes: Converting the first behavior data into a first behavior representation vector by using a trained behavior representation model; The step of searching for target behavior data similar to the first behavior data from the plurality of second behavior data corresponding to the plurality of historical plug-in groups stored respectively includes: From the plurality of second behavior representation vectors corresponding to the plurality of stored historical plug-in groups, a target behavior representation vector similar to the first behavior representation vector is searched.

3. The method according to claim 2, characterized in that The second behavior representation vector corresponding to the historical cheat group is obtained in the following way: Obtaining third behavior data corresponding to each historical cheating user included in the historical cheating group; Converting each of the third behavior data into each third behavior representation vector through the behavior representation model; The second behavior characterization vector corresponding to the historical plug-in group is determined according to each of the third behavior characterization vectors.

4. The method according to claim 3, characterized in that The determining the second behavior representation vector corresponding to the historical cheat group according to each of the third behavior representation vectors includes: The average vector of each of the third behavior characterization vectors is determined as the second behavior characterization vector corresponding to the historical plug-in group.

5. The method according to claim 1, characterized in that The method further comprises: Obtaining the update times corresponding to the stored multiple historical cheating groups, respectively, wherein the update time is the latest time among the cheating detection times of the historical cheating users included in the historical cheating group; The second behavior data corresponding to the first plug-in group is deleted from the multiple second behavior data corresponding to the multiple stored historical plug-in groups, and the update time corresponding to the first plug-in group is equal to or longer than the set time from the current moment.

6. The method according to claim 1, characterized in that The method further comprises: The second behavior data corresponding to the similar plug-in group is updated according to the first behavior data, and the similar plug-in group is the historical plug-in group corresponding to the target behavior data.

7. The method according to claim 6, characterized in that The method further comprises: The detection time of the virtual user to be detected is updated to the update time corresponding to the similar plug-in group.

8. The method according to claim 1, characterized in that The method further comprises: When the target behavior data is not found, monitoring whether there is similar behavior data in a first time period from the current moment, wherein the similar behavior data is: behavior data similar to the first behavior data among the behavior data of each virtual user to be tested obtained in the first time period; When the similar behavior data is detected in the first time period, or when a plurality of similar behavior data is detected in the first time period, the virtual user to be detected is determined to be a plug-in user.

9. The method according to claim 1, characterized in that: Before searching for target behavior data similar to the first behavior data from the plurality of second behavior data respectively corresponding to the plurality of stored historical cheat groups, the method further includes: Pre-detecting the first behavior data by a set pre-detection method to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in; The step of searching for target behavior data similar to the first behavior data from the plurality of second behavior data corresponding to the plurality of historical plug-in groups stored respectively includes: When the pre-detection result is suspected to be a cheat, target behavior data similar to the first behavior data is searched from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups.

10. The method according to claim 9, characterized in that The method further comprises: When the target behavior data is not found, a historical cheating group is created for the virtual user to be detected, and the first behavior data is determined as the second behavior data corresponding to the created historical cheating group.

11. The method according to any one of claims 1 to 5, characterized in that The second behavior data is any one of the following: Average data of each behavior data corresponding to each historical cheating user in the historical cheating group; The median data of each behavior data corresponding to each historical cheating user in the historical cheating group arranged by detection time; The behavior data with the latest detection time among the behavior data corresponding to each historical cheating user in the historical cheating group.

12. The method according to any one of claims 1 to 5, characterized in that The detection opportunity includes at least one of the following: When the virtual user to be detected logs in; Before the virtual user to be detected completes the virtual asset transaction; Before the virtual user level to be detected is upgraded.

13. The method according to any one of claims 1 to 5, characterized in that The method further comprises: Acquire the behavior data of each virtual user in real time, and store the behavior data of each virtual user in a storage database; The obtaining of first behavior data of the virtual user to be detected includes: The first behavior data of the virtual user to be detected is obtained from the storage database.

14. The method according to any one of claims 1 to 5, characterized in that The first behavior data is a first behavior sequence, and the first behavior sequence includes various behavior events performed by the virtual user to be detected.

15. The method according to claim 9 or 10, characterized in that The pre-detection of the first behavior data by a set pre-detection method to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in includes: Inputting the first behavior data into a trained plug-in detection model to obtain a pre-detection result of whether the virtual user to be detected is a suspected plug-in; Alternatively, the first behavior data is compared with a preset plug-in feature to obtain a preliminary detection result of whether the virtual user to be detected is a suspected plug-in.

16. A cheating detection device, characterized in that: The device comprises: An acquisition unit, used for acquiring first behavior data of a virtual user to be detected when a set detection timing is reached; A search unit, used to search for target behavior data similar to the first behavior data from a plurality of second behavior data corresponding to a plurality of stored historical cheat groups, wherein each historical cheat user included in any of the historical cheat groups has similar behavior data, and the second behavior data is used to represent the behavior data corresponding to the historical cheat group as a whole; A determination unit, configured to determine that the virtual user to be detected is a cheating user when the target behavior data is found; The search unit is specifically used to: obtain the update times corresponding to the multiple stored historical plug-in groups, the update time being the latest time among the plug-in detection times of the historical plug-in users contained in the historical plug-in group; filter out a target plug-in group from the multiple historical plug-in groups, the update time corresponding to the target plug-in group being shorter than the set time from the current moment; and search for target behavior data similar to the first behavior data from the second behavior data corresponding to each of the target plug-in groups.

17. An electronic device, characterized in that: include: processor; as well as The memory is used to store a data processing program. After the electronic device is powered on and the program is run by the processor, the method according to any one of claims 1 to 15 is executed.

18. A computer-readable storage medium, characterized in that: A data processing program is stored, and the program is run by a processor to execute the method according to any one of claims 1 to 15.

Images