Method, device, storage medium and processor for detecting cheats in games

Abstract

The present invention discloses a method, device, storage medium and processor for detecting cheats in games. The method comprises: obtaining operation data of an account to be detected in the game; extracting feature data associated with cheating behavior from the operation data; sending the feature data to a server so that the server performs cheating detection on the feature data, obtains a detection result, and receives the detection result from the server. The present invention solves the technical problem of low cheating detection efficiency in games.

Description

Technical Field

[0001] The present invention relates to the field of game technology, and in particular to a method, device, storage medium and processor for detecting cheats in games. Background Art

[0002] Game cheats, also known as "plug-ins", seek benefits for players by modifying game data, which seriously undermines the balance and fairness of the game. With the development of game technology, a large number of clicker script plug-ins have emerged. This type of plug-in can simulate the operation of normal players to move and release skills, with higher concealment and longer duration.

[0003] At present, when detecting cheats in games, usually only click operations under fixed coordinates can be identified, and sliding operations cannot be identified. Therefore, this detection method for fixed coordinate points has certain limitations. In addition, the data stream uploaded during the game operation is large, and the server cannot process the huge data stream under normal operation, resulting in low efficiency of cheat detection in the game.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] At least some embodiments of the present disclosure provide a method, device, storage medium, and processor for detecting cheats in a game, so as to at least solve the technical problem of low efficiency of detecting cheats in a game.

[0006] According to one embodiment of the present disclosure, there is provided a method for detecting cheats in a game, comprising: obtaining operation data of an account to be detected in the game, wherein the operation data is used to determine whether the operation behavior corresponding to a virtual game character identified by the account in the game is a cheat behavior executed by using a target script; extracting feature data associated with the cheat behavior from the operation data, wherein the feature data is used to represent the operation frequency and / or operation position of the operation behavior; sending the feature data to a server so that the server performs cheat detection on the feature data to obtain a detection result, wherein the detection result is used to represent whether the operation behavior is a cheat behavior; and receiving the detection result from the server.

[0007] According to one embodiment of the present disclosure, there is provided a method for detecting cheats in a game, comprising: obtaining feature data associated with cheating behavior in the operation data of the game of an account to be detected, wherein the operation data is used to determine whether the operation behavior of a virtual game character identified by the account in the game is a cheating behavior executed using a target script, and the feature data is used to indicate the operation frequency and / or operation position of the operation behavior; performing cheating detection on the feature data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a cheating behavior; and sending the detection result to a client.

[0008] According to one embodiment of the present disclosure, a device for detecting cheats in a game is also provided. The device includes: an acquisition unit, which is used to acquire the operation data of the account to be detected in the game, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is a cheat behavior executed using a target script; an extraction unit, which is used to extract feature data associated with the cheat behavior from the operation data, wherein the feature data is used to represent the operation frequency and / or operation position of the operation behavior; a sending unit, which is used to send the feature data to a server so that the server performs cheat detection on the feature data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a cheat behavior; and a receiving unit, which is used to receive the detection result from the server.

[0009] According to one embodiment of the present disclosure, a device for detecting cheats in a game is also provided. The device includes: an acquisition unit, which is used to acquire feature data associated with cheating behavior in the game operation data of the account to be detected, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is a cheating behavior executed using a target script, and the feature data is used to indicate the operation frequency and / or operation position of the operation behavior; a first detection unit, which is used to perform cheating detection on the feature data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a cheating behavior; and a sending unit, which is used to send the detection result to the client.

[0010] According to one embodiment of the present disclosure, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute any of the above-mentioned methods for detecting cheats in a game when running.

[0011] According to one embodiment of the present disclosure, there is also provided an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute any of the above-mentioned methods for detecting cheats in a game.

[0012] In at least some embodiments of the present disclosure, the operation data of the account to be detected in the game can be obtained, and then the feature data associated with the plug-in behavior can be extracted from the obtained operation data, and the extracted feature data can be sent to the server, so that the server can perform plug-in detection on the feature data to obtain a detection result, which is used to indicate whether the operation behavior is a plug-in behavior. The plug-in detection of the game can be achieved based on the detection result of the server. That is to say, in the embodiments of the present disclosure, plug-in detection can be performed based on the feature data associated with the plug-in behavior extracted from the operation data, without having to detect all the operation data, which reduces data overhead, improves the efficiency of plug-in detection in the game, and thus solves the technical problem of low efficiency of plug-in detection in the game. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The drawings described herein are used to provide a further understanding of the present disclosure and constitute a part of the present application. The illustrative embodiments of the present disclosure and their descriptions are used to explain the present disclosure and do not constitute an improper limitation on the present disclosure. In the drawings:

[0014] Figure 1 It is a hardware structure block diagram of a mobile terminal of a method for detecting cheats in a game according to an embodiment of the present disclosure;

[0015] Figure 2 is a flow chart of a method for detecting cheats in a game according to one embodiment of the present disclosure;

[0016] Figure 3 is a flow chart of a method for detecting cheats in a game according to one embodiment of the present disclosure;

[0017] Figure 4 is a flow chart of a method for detecting cheats in a game according to one embodiment of the present disclosure;

[0018] Figure 5 is a schematic diagram of extracting feature data according to one embodiment of the present disclosure;

[0019] Figure 6 is a schematic diagram of transmitting characteristic data according to one embodiment of the present disclosure;

[0020] Figure 7 is a schematic diagram of processing feature data according to one embodiment of the present disclosure;

[0021] Figure 8 is a schematic diagram of determining a normal characteristic of a joystick according to one embodiment of the present disclosure;

[0022] Fig. 9 is a detection flow chart of a skill detection module according to one embodiment of the present disclosure;

[0023] Fig.10 is a schematic diagram of reviewing a test result according to one embodiment of the present disclosure;

[0024] Fig.11 is a schematic diagram of a cheat detection device in a game according to an embodiment of the present disclosure;

[0025] Fig.12 is a schematic diagram of another cheat detection device in a game according to an embodiment of the present disclosure;

[0026] Fig.13 is a structural block diagram of an electronic device according to one optional embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present disclosure, the technical scheme in the embodiments of the present disclosure will be clearly and completely described below in conjunction with the drawings in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, not all of the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without creative work should fall within the scope of protection of the present disclosure.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product, or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products, or devices.

[0029] In one possible implementation, with respect to a method for detecting game cheats by detecting all operation data generated during the game operation process in the field of game technology, the inventor, after practice and careful research, found that this detection method has a technical problem of low detection efficiency. Based on this, in the embodiment of the present disclosure, feature data associated with cheating behavior in the operation data is extracted, and then cheating detection is performed on the feature data. Since the feature data is data associated with cheating behavior, cheating detection based on the feature data is more accurate, and since the amount of detected data is smaller, the detection speed will also be faster, thereby solving the technical problem of low game cheating detection efficiency and achieving the technical effect of improving the game cheating detection efficiency.

[0030] The above method embodiments involved in the present disclosure can be executed in a mobile terminal, a computer terminal or a similar computing device. Taking running on a mobile terminal as an example, the mobile terminal can be a smart phone, a tablet computer, a handheld computer, a mobile Internet device, a PAD, a game console and other terminal devices. Figure 1 FIG. 1 is a hardware structure block diagram of a mobile terminal of a method for detecting cheats in a game according to an embodiment of the present disclosure. Figure 1 As shown, the mobile terminal may include one or more ( Figure 1 The processor 102 (only one is shown) may include but is not limited to a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processing (DSP) chip, a microprocessor (MCU), a field programmable logic device (FPGA), a neural network processor (NPU), a tensor processing unit (TPU), an artificial intelligence (AI) type processor, etc.) and a memory 104 for storing data. In one embodiment of the present disclosure, it may also include: a transmission device 106 for communication functions, an input and output device 108, and a display device 110.

[0031] In some optional embodiments mainly based on game scenarios, the above-mentioned device can also provide a human-computer interaction interface with a touch-sensitive surface, which can sense finger contact and / or gestures to perform human-computer interaction with a graphical user interface (GUI). The human-computer interaction function may include the following interactions: creating web pages, drawing, word processing, making electronic documents, games, video conferencing, instant messaging, sending and receiving emails, call interface, playing digital videos, playing digital music and / or web browsing, etc. The executable instructions for executing the above-mentioned human-computer interaction functions are configured / stored in a computer program product or readable storage medium executable by one or more processors.

[0032] Those skilled in the art will understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the mobile terminal. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0033] According to one embodiment of the present disclosure, an embodiment of a method for detecting cheats in a game is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0034] In a possible implementation, the present disclosure provides a method for detecting cheats in a game, which is applied to a client. Figure 2 is a flow chart of a method for detecting cheats in a game according to one embodiment of the present disclosure. Figure 2 As shown, the method comprises the following steps:

[0035] Step S201, obtaining the operation data of the account to be detected in the game.

[0036] In the technical solution provided in the above step S201 of the present disclosure, the game may include multiple virtual game characters. After logging into the game through the account to be detected, the corresponding virtual game character may be selected to participate in the game. Different virtual game characters have different skills, and various operations may be performed using the skills corresponding to the selected virtual game characters. This will generate a large amount of operation data. Based on this, the client can obtain the operation data of the account to be detected in the game in real time, wherein the operation data is used to determine whether the corresponding operation behavior of the virtual game character represented by the account in the game is a plug-in behavior executed by using a target script. The game may refer to a game application or a game client.

[0037] Optionally, the camera data during the game can be obtained, and the camera data records the operation behavior of each virtual game character during the entire game process. After obtaining the camera data, the game operation process can be reproduced in the test environment of the client to obtain the operation data.

[0038] For example, the operation data may include three sample data, namely self.move_rocker = list(), self.spell_action = list(), and self.position_list = list(), wherein self.move_rocker may be used to represent the operation data of the player's joystick, and the position of the player's joystick relative to the center of the joystick in each frame of the image may be recorded in the self.move_rocker. In order to avoid excessive duplication of data in the recorded operation data, a judgment step may be added during the recording process. For example, during the game, when the position of the joystick changes relative to the position of the joystick in the previous frame of the image in response to the player's operation of moving the joystick, the operation data of the joystick is recorded; when the position of the joystick does not change relative to the position of the joystick in the previous frame of the image in response to the player's operation of moving the joystick, the operation data of the joystick is not recorded. For example, [10, [x1, z1]], [100, [x2, z2]] is used to indicate that the joystick operation data from the 10th frame to the 99th frame is [x1, z1], and the joystick operation data at the 100th frame is [x2, z2]. self.spell_action can be used to indicate the position, time, and skill number information of the skill release, where visual_env.raw_spell_info = [x, z] can be used to indicate the position information when the skill is released. self.position_list can be used to indicate the player's position coordinates [x, z], which are sampled in seconds and controlled by total_tick_time, the total game duration. Every time total_tick_time increases by 1000ms, the player's position coordinates are recorded. During the game, the data generated in response to the player moving the joystick, dragging the skill wheel, or changing the position during the game will be recorded in the above three sample data.

[0039] Optionally, in addition to the three sample data, the operation data may also include the number of the game map used in the game, the type of the game, such as a melee, a ranked match, etc., the player's account, equipment, skills corresponding to the virtual game character, such as flash, punishment, etc., the identification (such as ID) of the virtual game character, the number of kills, the number of deaths, the number of assists, etc. Among them, the number of the game map can be represented by "map_guid", the type of the game can be represented by "match_id", the player's account can be represented by "player_guid", the equipment can be represented by "eqp", the skills corresponding to the virtual game character can be represented by "summoner_spell", the ID of the virtual game character can be represented by "hero_id", the number of kills can be represented by "k", the number of deaths can be represented by "d", and the number of assists can be represented by "a". After the game is over, various types of operation data will be saved in the specified folder path and named according to "match_id+player_guid+hero_id". Based on this, the operation data of the account to be detected in the game can be obtained from the stored data according to the identifier "player_guid" of the account to be detected, or the operation data of the account to be detected can be obtained from the stored data using the identifier "hero_id" of the virtual game character selected by the account to be detected. No specific restrictions are made here.

[0040] Step S202: extracting characteristic data associated with the cheating behavior from the operation data.

[0041] In the technical solution provided in the above step S202 of the present disclosure, after obtaining the operation data of the account to be detected in the game, feature data associated with the plug-in behavior can also be extracted from the obtained operation data, wherein the feature data is used to represent the operation frequency and / or operation position of the operation behavior.

[0042] Optionally, when extracting feature data associated with cheating behavior from the acquired operation data, the operation data of the target operation type may be first determined from the operation data, and then feature data associated with the target operation type may be extracted from the operation data of the target operation type. The operation data of the target operation type includes operation data of the joystick operation type and operation data of the skill operation type.

[0043] For example, as can be seen from the above introduction, all types of data are saved in a specified folder path, and each type of data corresponds to its own identifier. Based on this, the identifier corresponding to the operation data of the target operation type can be determined first, that is, the identifier corresponding to the operation data of the joystick operation type and the identifier corresponding to the operation data of the skill operation type can be determined first. Afterwards, the operation data of the joystick operation type is obtained from the operation data according to the identifier corresponding to the operation data of the joystick operation type. After the operation data of the joystick operation type is obtained, the first frame feature data associated with the joystick operation type can be extracted from the operation data of the joystick operation type, wherein the first frame feature data is the operation data that has changed in the operation data of the joystick operation type, and is used to characterize the operation frequency of the corresponding joystick operation behavior; similarly, the operation data of the skill operation type can be obtained from the operation data according to the identifier corresponding to the operation data of the skill operation type. After the operation data of the skill operation type is obtained, the second frame feature data associated with the skill operation type can be extracted from the operation data of the skill operation type, wherein the second frame feature data is the operation data used to release the skill in the operation data of the skill operation type, and is used to characterize the operation position of the corresponding skill release behavior.

[0044] Step S203, sending the characteristic data to the server, so that the server performs a plug-in detection on the characteristic data to obtain a detection result.

[0045] In the technical solution provided in the above step S203 of the present disclosure, the server may include a game server and an algorithm server, wherein the game server is used to transfer data, and the algorithm server is used to detect plug-ins on the data. Based on this, after the feature data is extracted, the feature data can be sent to the game server. After the game server transfers the feature data, the feature data can be transmitted to the algorithm server, so that the algorithm server can detect plug-ins on the feature data and obtain a detection result.

[0046] Optionally, when data is transmitted to the algorithm server, the feature data may be sent to the algorithm server via a message queue or a target request.

[0047] For example, the game server can send feature data by passing messages through a message queue based on the publish / subscribe mode (Kafka) to achieve asynchronous data transmission. When using the Kafka message queue for data transmission, data transmission can be performed regardless of whether the algorithm server is in normal working condition, and it does not need to rely on the business model supported by the algorithm server. The feature data can be transmitted by simply submitting it to the message queue.

[0048] For example, when the feature data is transmitted by using a target request, the feature data can be uploaded to the algorithm server through the HyperText Transfer Protocol (HTTP for short) to achieve synchronous transmission of the feature data.

[0049] Step S204, receiving the detection result from the server.

[0050] In the technical solution provided in the above step S204 of the present disclosure, after the feature data is transmitted to the algorithm server, the detection result of the algorithm server can also be received.

[0051] Optionally, after receiving the feature data, the algorithm server may detect the operation data of the joystick operation type and the operation data of the skill operation type included in the feature data, and determine whether the operation behavior corresponding to the response operation data is a cheating behavior. After obtaining the detection result, the detection result may be sent to the game server, and after receiving the detection result, the game server may send the detection result to the client, and the client may receive the detection result.

[0052] In at least some embodiments of the present disclosure, the operation data of the account to be detected in the game is obtained, and then the feature data associated with the plug-in behavior is extracted from the operation data, and then the feature data is sent to the server so that the server performs plug-in detection on the feature data to obtain the detection result. In other words, in the embodiments of the present disclosure, only the feature data associated with the plug-in behavior in the operation data can be used for plug-in detection to obtain the plug-in detection result, that is, to determine whether the account to be detected is a plug-in player, without having to detect all the operation data, which greatly improves the plug-in detection efficiency in the game and solves the technical problem of low plug-in detection efficiency in the game.

[0053] The above method of this embodiment is further introduced below with examples.

[0054] As an optional implementation, step S202, extracting characteristic data associated with the plug-in behavior from the operation data, includes: in response to the operation data being operation data of a target operation type, extracting characteristic data associated with the target operation type from the operation data of the target operation type.

[0055] In this embodiment, the operation data of the target operation type may include operation data of the joystick operation type and operation data of the skill operation type. Wherein, in response to the operation data being the operation data of the joystick operation type, first frame feature data associated with the joystick operation type may be extracted from the operation data of the joystick operation type, wherein the first frame feature data is the operation data that has changed in the operation data of the joystick operation type and is used to characterize the operation frequency of the corresponding joystick operation behavior; in response to the operation data being the operation data of the skill operation type, second frame feature data associated with the skill operation type may be extracted from the operation data of the skill operation type, wherein the second frame feature data is the operation data for releasing a skill in the operation data of the skill operation type and is used to characterize the operation position of the corresponding skill release behavior.

[0056] Optionally, as can be seen from the above introduction, each type of data corresponds to its own identifier, based on which, the identifier of the operation data of the joystick operation type and the identifier of the operation data of the skill operation type can be first determined, and then the operation data of the joystick operation type and the operation data of the skill operation type can be extracted from the operation data based on the identifier of the operation data. It should be noted that when extracting the operation data of the joystick operation type and the operation data of the skill operation type, the operation data can be identified first, and data extraction is performed only when the operation data that has changed in the operation data of the joystick operation type and the operation data used to release the skill in the operation data of the skill operation type are identified.

[0057] For example, assuming that the extracted operation data of the joystick operation type contains 13 frames, and the operation data of the joystick in the 1st to 8th frames are different, then the operation data of the joystick in each frame image from the 1st to the 8th frames are extracted. In addition, assuming that the operation data of the joystick has not changed from the 9th to the 13th frames, in this case, only the operation data of the joystick in the 9th frame is extracted, and there is no need to extract the operation data of the joystick in the 10th to the 13th frames. That is, there is no duplication in the extracted joystick operation data, which can greatly reduce the amount of data.

[0058] To take another example, assuming that the extracted operation data of the skill operation type contains 11 frames, and the skill is released in the first frame image, then the operation data of the skill operation type in the first frame image is extracted; if the skill is not released in the second to fifth frames, the operation data of the skill operation type in the second to fifth frames are not extracted; if the skill is released in the sixth to eleventh frames, then the operation data of the skill operation type in the sixth to eleventh frames are extracted, that is, only the operation data of the released skill is extracted. In this way, there is no duplication in the extracted operation data of the skill operation type, and the amount of data can be greatly reduced.

[0059] As an optional implementation, step S203, sending the feature data to the server so that the server performs plug-in detection on the operation data to obtain a detection result, includes: transmitting the feature data to the algorithm server through the game server so that the algorithm server performs plug-in detection on the feature data to obtain a detection result.

[0060] In this embodiment, the server includes a game server and an algorithm server, wherein the game server is used to transfer data, and the algorithm server is used to detect plug-ins on the data. Based on this, the client can first send the feature data to the game server. After receiving the feature data, the game server can transfer the feature data, and then send the transferred feature data to the algorithm server, so that the algorithm server can detect plug-ins on the feature data.

[0061] Optionally, when the game server sends the feature data to the algorithm server, it can use the kafka message queue to send the feature data, or it can use the HTTP request method to send the feature data. Among them, when using the kafka message queue to send the feature data, the feature data can be submitted to the kafka message queue, and then the feature data can be sent to the algorithm server in sequence based on the order in the message queue to achieve asynchronous transmission of data. The feature data can also be sent to the algorithm server by HTTP request to achieve synchronous transmission of data.

[0062] In a possible implementation, the disclosed embodiment provides another method for detecting cheats in games, which is applied to a server. Figure 3 is a flow chart of a method for detecting cheats in a game according to one embodiment of the present disclosure. Figure 3 As shown, the method may include the following steps:

[0063] Step S301, obtaining feature data associated with cheating behavior in the game operation data of the account to be detected.

[0064] In the technical solution provided in the above step S301 of the present disclosure, it can be seen from the content introduced in the above step S203 that the client can send feature data to the server, and the feature data is data associated with the plug-in behavior in the operation data. Based on this, the server can obtain the feature data associated with the plug-in behavior in the operation data of the game of the account to be detected, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is a plug-in behavior executed by using the target script, and the feature data is used to represent the operation frequency and / or operation position of the operation behavior, and the server can be an algorithm server.

[0065] Step S302, performing cheat detection on the characteristic data to obtain a detection result.

[0066] In the technical solution provided in the above step S302 of the present disclosure, after acquiring the feature data, the algorithm server can perform plug-in detection on the feature data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a plug-in behavior.

[0067] Optionally, the algorithm server may determine, based on the feature data and a target threshold, that the detection result is used to indicate that the operation behavior is a cheating behavior, wherein the target threshold may be preset.

[0068] Optionally, as can be seen from the content introduced in the aforementioned step S203, the feature data may include first frame feature data associated with the joystick operation type, and the first frame feature data is data that has changed in the operation data of the joystick operation type, and is used to characterize the operation frequency of the corresponding joystick operation behavior. The target threshold may include a frequency threshold. Based on this, when determining that the detection result is used to indicate that the operation behavior is a plug-in behavior based on the feature data and the target threshold, it can be determined that the detection result is used to indicate that the operation behavior is a plug-in behavior when the operation frequency corresponding to the first frame feature data is greater than the frequency threshold.

[0069] For example, the algorithm server can determine the operation frequency of the joystick operation behavior in the operation data of the joystick operation type, for example, the operation frequency of the joystick operation behavior can be determined based on the number of joystick operation behaviors and the total number of frames. Afterwards, the operation frequency is compared with a preset frequency threshold. If the operation frequency is greater than the frequency threshold, it means that the joystick operation behavior is a plug-in behavior. If the operation frequency is not greater than the frequency threshold, it means that the joystick operation behavior is a non-plug-in behavior.

[0070] Optionally, as can be seen from the introduction of the aforementioned step S203, the feature data may also include second frame feature data associated with the skill operation type, where the second frame feature data is the operation data for releasing the skill in the operation data of the skill operation type, and is used to characterize the operation position of the corresponding skill release behavior. The target threshold may include an aggregation threshold. Based on this, when determining that the detection result is used to indicate that the operation behavior is a plug-in behavior based on the feature data and the target threshold, the multiple operation positions corresponding to the second frame feature data can be first aggregated to obtain an aggregation result, wherein the aggregation result is used to indicate the complexity of the released skill; in response to the aggregation result being greater than the aggregation threshold, it is determined that the detection result is used to indicate that the operation behavior is a plug-in behavior; in response to the aggregation result being not greater than the aggregation threshold, it is determined that the detection result is used to indicate that the operation behavior is a non-plug-in behavior.

[0071] Step S303, sending the detection result to the client.

[0072] In the technical solution provided in the above step S303 of the present disclosure, after the detection result is determined, the detection result can be sent to the client.

[0073] Optionally, as can be seen from the above introduction, the client can first send the feature data to the game server, and after receiving the feature data, the game server can send the feature data to the algorithm server. Based on this, after obtaining the detection result, the algorithm server can also first send the detection result to the game server, and after receiving the detection result, the game server sends the detection result to the client. Of course, the algorithm server can also directly send the detection result to the client, and no specific limitation is made here.

[0074] In at least some embodiments of the present disclosure, by obtaining feature data associated with cheating behavior in the game operation data of the account to be detected, where the operation data is used to determine whether the operation behavior of the virtual game character represented by the account in the game is a cheating behavior executed using a script, the feature data can then be tested for cheating, the test result is obtained, and the test result is returned to the client. In other words, in the embodiments of the present disclosure, only the feature data associated with the cheating behavior can be tested, without having to test all the operation data in the game, which greatly reduces the amount of data, improves the detection efficiency, and solves the technical problem of low cheating detection efficiency in the game.

[0075] The above method of this embodiment is further introduced below with examples.

[0076] As an optional implementation, step S302, performing a plug-in detection on the feature data to obtain a detection result, includes: based on the feature data and a target threshold, determining that the detection result is used to indicate that the operation behavior is a plug-in behavior.

[0077] In this embodiment, the feature data may include first frame feature data associated with the joystick operation type, the first frame feature data is the operation data that changes in the operation data of the joystick operation type, and is used to characterize the operation frequency of the corresponding joystick operation behavior. In addition, the feature data may also include second frame feature data associated with the skill operation type, the second frame feature data is the operation data for releasing the skill in the operation data of the skill operation type, and is used to characterize the operation position of the corresponding skill release behavior. The target threshold may include a frequency threshold and may also include an aggregation threshold. Among them, the frequency threshold and the aggregation threshold can be preset.

[0078] Optionally, when detecting the first frame feature data associated with the joystick operation type in the feature data, when the operation frequency corresponding to the first frame feature data is greater than a frequency threshold, the detection result is determined to indicate that the operation behavior is a plug-in behavior. When the operation frequency corresponding to the first frame feature data is not greater than the frequency threshold, the detection result is determined to indicate that the operation behavior is a non-plug-in behavior. The first frame feature data may include the number of operations and the total number of frames of the joystick operation behavior, based on which the operation frequency can be determined by the number of operations and the total number of frames.

[0079] For example, the ratio between the number of operations of the joystick operation behavior included in the first frame feature data and the total number of frames can be used as the operation frequency corresponding to the first frame feature data. For example, the number of operations of the joystick operation behavior is 40 times, and the total number of frames is 50 frames. Based on this, it can be determined that the operation frequency corresponding to the first frame feature data is 0.8. Assuming that the frequency threshold is 0.5, since 0.8 is greater than 0.5, it can be determined that the operation behavior corresponding to the first frame feature data is a plug-in behavior.

[0080] Optionally, when detecting the second frame feature data associated with the skill operation type in the feature data, the multiple operation positions corresponding to the second frame feature data can be aggregated first to obtain an aggregation result, wherein the aggregation result is used to indicate the complexity of the released skill. The feature data includes the number of releases of the skill release behavior and the number of different operation positions, based on which the aggregation result can be determined using the number of releases and the number of different operation positions. After determining the aggregation result, when the response to the aggregation result is greater than the aggregation threshold, it can be determined that the detection result is used to indicate that the operation behavior is a plug-in behavior; when the response to the aggregation result is not greater than the aggregation threshold, it can be determined that the detection result is used to indicate that the operation behavior is a non-plug-in behavior.

[0081] For example, the number of skills included in the entire game can be determined based on the number of different operation positions included in the second frame feature data, and each operation position corresponds to a skill. After the number of skills is determined, the complexity of each skill can be calculated based on the position coordinates of the operation position of each skill and the number of times the skill is released in the entire game. Then, the complexity of each skill is added to obtain an aggregate result. Taking a skill as an example, the complexity of the skill can be determined by the following formula (1).

[0082]

[0083] Among them, O9spelli) can be used to represent the complexity of skill i, size represents the number of times the skill is released in the whole game, and d(x spell_i) and d(r spell_i) is the position coordinate of the release point of skill i, where d(xspell_i) is the horizontal axis, d(r spell_i) The skill complexity of each skill can be determined according to the above formula (1).

[0084] Optionally, after determining the skill complexity of each skill, the skill complexity of all skills can be added together to obtain the skill complexity of the entire game, and the skill complexity is determined as the aggregation result. The skill complexity of all skills can be calculated using the following formula (2).

[0085] O(spell)=O(spell_1)+O(spell_2)+… (2)

[0086] Among them, O9spell1) is the complexity corresponding to skill one, and O9spell2) is the complexity corresponding to skill two.

[0087] Optionally, after determining the skill complexity of the entire game, the skill complexity can be determined as an aggregation result, and then the aggregation result can be compared with the aggregation threshold. When the value of O(spell) is greater than the aggregation threshold, it can be determined that the detection result is used to indicate that the operation behavior is a plug-in behavior; when the value of O(spell) is not greater than the aggregation threshold, it can be determined that the detection result is used to indicate that the operation behavior is a non-plug-in behavior.

[0088] Optionally, when an operation behavior is detected as a cheating behavior, the camera data in the game can be reviewed based on the received review operation instructions to obtain a review result, and then the target threshold is adjusted based on the review result. Thereafter, the feature data is subjected to cheating detection based on the adjusted target threshold to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is a cheating behavior.

[0089] For example, when it is determined that the operation behavior is a plug-in behavior, in order to ensure the accuracy of the detection result, the detection result can be reviewed. Specifically, the online recording of the entire game can be obtained and reviewed using the review result optimization algorithm. Afterwards, the target threshold is readjusted according to the review results and the detection results. For example, the range of the target threshold can be adjusted to be smaller to ensure the accuracy of the detection result. After adjusting the target threshold, the feature data can be re-detected according to the method introduced above to obtain the detection result, which will not be repeated here.

[0090] Optionally, when the operation behavior is detected as a plug-in behavior, the type of the operation data can also be determined, and then the operation data is subjected to plug-in detection based on the type to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

[0091] For example, the types of operation data can be divided according to virtual game characters. For example, the operation data corresponding to a virtual game character can be regarded as one type of operation data. After that, the operation data corresponding to each virtual game character can be subjected to plug-in detection to obtain secondary detection results.

[0092] Optionally, when the operation behavior is detected as a plug-in behavior, the operation data can also be converted into a target matrix, and then the target matrix is ​​subjected to plug-in detection to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

[0093] Optionally, when the operation behavior is detected as a plug-in behavior, the attribute value of the account can also be adjusted, wherein the attribute value is used to characterize the credibility of the account, and the credibility corresponding to the adjusted attribute value is lower than the credibility corresponding to the attribute value before adjustment.

[0094] For example, when the operation behavior of the account to be detected is detected as a plug-in behavior, the attribute value of the account can be adjusted to restrict the permissions of the account to be detected as a warning. For example, the character value of the account to be detected can be deducted. A character value that is too low will be banned from participating in the ranking competition. In addition, a character value that is too low will also reduce the gold coin income obtained during combat.

[0095] In at least some embodiments of the present disclosure, only feature data associated with plug-in behavior can be detected without having to detect all operation data in the game, which greatly reduces the amount of data and improves detection efficiency. Moreover, after determining that the operation behavior is a plug-in behavior based on the feature data, the detection result can be reviewed to ensure the accuracy of the detection result. In addition, after determining that the operation behavior is a plug-in behavior, an alarm can be issued by adjusting the attribute value of the account to maintain a good gaming environment.

[0096] The technical solution of the embodiment of the present invention is further introduced below with examples in combination with preferred implementation modes.

[0097] In the related art, when detecting cheats in game operations, click operations under fixed coordinates are usually identified. However, in the process of game operations, there are not only click operations but also drag operations. This detection mode cannot identify drag operations, and the detection mode is relatively simple. In addition, when detecting operation data, all operation data generated in the entire game are usually detected. Since the amount of data generated during the game is large, this detection mode needs to process a huge amount of data, and the detection efficiency is low. Moreover, during the detection process, when a certain operation behavior is abnormal, the corresponding account is determined as an account used by a script player and is punished. This detection mode may misjudge normal players as script players to a large extent, and the detection accuracy is low.

[0098] However, the disclosed embodiment provides a method for detecting cheats in a game, which will be further introduced in the next step. Figure 4 is a flow chart of a method for detecting cheats in a game according to one embodiment of the present disclosure. Figure 4 As shown, the method may include the following steps:

[0099] Step S401, obtaining original sample data.

[0100] In this embodiment, before starting the entire detection process, sample data can be collected first. The sample data is negative sample data, and the negative sample data is used to indicate that there are script players in the game corresponding to the data. Among them, sample data can be obtained by two methods, one is to write an automated script to generate negative sample data. Optionally, based on the script player operation video circulated on the external server, an automated script can be written through AirTest to imitate the operation behavior of the script player in the internal server, obtain sample data, and compare the obtained sample data with the data generated by using the mobile interface and the skill release interface. The other is to contact the operation to obtain the information of the reported players. Optionally, the operation can be contacted to obtain a list of players reported as "hang-up scripts", and the recordings of the reported games of these players can be reviewed, and the players who meet the characteristics of the hang-up script behavior can be listed as whitelist users, and their operation data can be collected.

[0101] Step S402: extracting feature data from the original sample data.

[0102] In this embodiment, after the operation data is acquired, feature data may be extracted from the operation data, the feature data including operation data associated with the left joystick controlling movement and operation data associated with the right skill button releasing skills.

[0103] Optionally, a game is composed of a large number of frames of images. A game lasts about 30 minutes, 1 second contains about 20 frames of images, one minute contains 1,200 frames, and 30 minutes contain 36,000 frames. Based on this, if each frame of the image is recorded, taking a game with 10 players as an example, it is estimated that a single game will generate about 10 megabytes of data. Based on this, in order to reduce overhead, the acquired operation data can be streamlined. Specifically, Figure 5 is a schematic diagram of extracting feature data according to one embodiment of the present disclosure, such as Figure 5 As shown, when recording operation data, the number of frames can be used as the minimum unit. For operation data associated with the left joystick operation, only the operation data of the change point can be recorded. That is, if the player's joystick operation information remains unchanged between the Pth frame and the Qth frame, then for the left joystick operation information between the Pth frame and the Qth frame, only the operation data of the Qth frame can be recorded. For skill operation data, only the operation data of the release point can be recorded, that is, in the tens of thousands of frames of a whole game, only the skill operation data of the player at certain frames is recorded. The amount of data obtained based on this method is only about 1 / 4 of the predetermined amount, which greatly reduces the amount of data.

[0104] Step S403: transmitting characteristic data.

[0105] Optionally, Figure 6 is a schematic diagram of transmission of characteristic data in one embodiment of the present disclosure, such as Figure 6 As shown, after obtaining the feature data, the client 601 can send the feature data to the game server 602. After the game server 602 transfers the feature data, it can send the transferred feature data to the algorithm server 603. The algorithm server 603 can receive the feature data sent by the game server 602.

[0106] Step S404, identifying cheating behavior based on a detection algorithm.

[0107] In this embodiment, after receiving the feature data, the algorithm server can perform algorithm recognition on the feature data. Figure 7 The algorithm server 700 includes a joystick detection module 701 and a skill detection module 702, through which the joystick detection module 701 and the skill detection module 702 can be used to comprehensively analyze the feature data and obtain the idle conclusion.

[0108] For example, the joystick detection module 701 can compare the overall operation frequency f1 and the maximum operation frequency f2 of the sliding window with the threshold of the set threshold respectively to determine whether the joystick is in normal characteristics. Among them, the overall operation frequency f1 can be calculated by the number of player operations and the total number of battle frames. The maximum operation frequency f2 of the sliding window can be obtained by calculating the average value of the misalignment difference in each window to obtain the operation frequency in a single kernel, and then the average value of the obtained data is calculated to be the final operation frequency f2. Among them, the calculation process depends on the selection of a suitable window length win_size and the selection of the jump step win_step. Figure 8 is a schematic diagram of determining a normal feature of a joystick provided by an embodiment of the present disclosure, such as Figure 8 As shown, when the overall operation frequency f1 is greater than the threshold α1 and the sliding window maximum operation frequency f2 is greater than the threshold α2, the joystick is determined to be a normal feature, otherwise the joystick is determined to be an abnormal feature, that is, the clicker feature is hit.

[0109] For example, Fig. 9 is a detection flow chart of a skill detection module according to one embodiment of the present disclosure, such as Fig. 9 As shown, for different skills, the skill detection module can first classify different skills according to the skill type, and then calculate the complexity of skill release O(spell), where the skill release complexity can be calculated by the following formula (3).

[0110]

[0111] Among them, d(x k ) is the horizontal coordinate of each skill release point, d(r k ) is the ordinate of each skill release point, and size is the number of times the corresponding skill is released in the entire game. When the complexity of skill release O(spell) is greater than the threshold, the skill is determined to be a skill that hits the clicker script.

[0112] Step S405: optimizing the detection algorithm.

[0113] In this embodiment, in order to ensure the accuracy of the detection result, the entire detection scheme can be optimized to ensure that its false alarm rate is reduced to 1 / 100000 or lower. Fig.10 This is a schematic diagram of a method for reviewing the detection results provided by the embodiment of the present disclosure. The sample data hit by the algorithm can be classified and analyzed. For example, a dedicated person is asked to pull the player's online battle video for review, and the algorithm is optimized according to the review result. The optimized algorithm is used to perform a second test on the false positive sample data, and this cycle is repeated.

[0114] Step S406: Setting permissions for the account to be tested based on the test results.

[0115] In this embodiment, after obtaining the detection result, the algorithm server can return the detection result to the game client, optionally, as Figure 6 As shown, the algorithm server 603 may first send the detection result to the game server 602 for transfer. After receiving the detection result, the game server 602 may send the detection result to the game client 601. After receiving the detection result, the game client 601 may set permissions for the account to be detected based on the detection result. For example, the character value of the account to be detected may be deducted. Among them, deducting the character value of the account to be detected will have two effects on the player. First, a character value that is too low will be prohibited from participating in the ranking competition; second, a character value that is too low will reduce the gold coin income obtained when participating in the battle.

[0116] Step S407, evaluating the loudspeaker result.

[0117] In this embodiment, after the detection scheme is launched, it is necessary to evaluate the effectiveness of the detection scheme in combating actual cheating behaviors. Optionally, one month of online player data can be tracked and analyzed, and operational feedback can be obtained. If the effect is as expected, it indicates that the detection scheme can solve the problem of clicker-type cheating scripts.

[0118] Optionally, the detection scheme is also applicable to other games involving user information input. For example, left joystick + right general attack or skill + others: shooting games, multiplayer online battle arena (MOBA), sports games, racing games, action games, action role playing games (ARPG); click / drag: card games, strategy games, etc.

[0119] Through the description of the above implementation methods, those skilled in the art can clearly understand that the method according to the above embodiment can be implemented by means of software plus a necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present disclosure, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, a disk, or an optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, a computer, a server, or a network device, etc.) to execute the methods described in each embodiment of the present disclosure.

[0120] In this embodiment, a plug-in detection device in a game is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the terms "unit" and "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0121] Fig.11 is a schematic diagram of a cheat detection device in a game according to an embodiment of the present disclosure, such as Fig.11 As shown, the cheat detection device 1100 in the game includes: an acquisition unit 1101, an extraction unit 1102, a sending unit 1103 and a receiving unit 1104.

[0122] The acquisition unit 1101 is used to acquire the operation data of the account to be detected in the game, wherein the operation data is used to determine whether the operation behavior corresponding to the virtual game character identified by the account in the game is a plug-in behavior executed by using a target script;

[0123] An extraction unit 1102 is used to extract feature data associated with the cheating behavior from the operation data, wherein the feature data is used to represent the operation frequency and / or operation position of the operation behavior;

[0124] The sending unit 1103 is used to send the characteristic data to the server, so that the server performs a plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a plug-in behavior;

[0125] The receiving unit 1104 is used to receive the detection result from the server.

[0126] Optionally, the extracting unit 1102 includes: an extracting module, configured to extract feature data associated with the target operation type from the operation data of the target operation type in response to the operation data being operation data of the target operation type.

[0127] Optionally, the extraction module is used to, in response to the operation data being operation data of a joystick operation type, extract first frame feature data associated with the joystick operation type from the operation data of the joystick operation type, wherein the first frame feature data is operation data that has changed in the operation data of the joystick operation type and is used to characterize the operation frequency of the corresponding joystick operation behavior; and / or in response to the operation data being operation data of a skill operation type, extract second frame feature data associated with the skill operation type from the operation data of the skill operation type, wherein the second frame feature data is operation data for releasing skills in the operation data of the skill operation type and is used to characterize the operation position of the corresponding skill release behavior.

[0128] Optionally, the server includes a game server and an algorithm server, wherein the sending unit 1103 includes: a transmission module, used to transmit the feature data to the algorithm server through the game server, so that the algorithm server performs plug-in detection on the feature data to obtain a detection result.

[0129] Optionally, the transmission module is used to send the feature data to the game server so that the game server sends the feature data to the algorithm server through a message queue; or to send the feature data to the game server so that the game server sends the feature data to the algorithm server through a target request.

[0130] Optionally, the acquisition unit 1101 is used to acquire video data of the account in the game; and reproduce the operation behavior based on the video data to obtain the operation data.

[0131] In the cheat detection device in the game of this embodiment, the acquisition unit is used to obtain the operation data of the account to be detected in the game; the extraction unit is used to extract the feature data associated with the cheat behavior from the operation data; the sending unit is used to send the feature data to the server so that the server performs cheat detection on the feature data and obtains the detection result; the receiving unit is used to receive the detection result from the server. In the embodiment of the present disclosure, cheat detection can be performed based on the feature data associated with the cheat behavior extracted from the operation data, without having to detect all the operation data, which reduces data overhead, improves the cheat detection efficiency in the game, and thus solves the technical problem of low cheat detection efficiency in the game.

[0132] Fig.12 is a schematic diagram of another cheat detection device in a game according to an embodiment of the present disclosure, such as Fig.12 As shown, the cheat detection device 1200 in the game includes: an acquisition unit 1201, a first detection unit 1202, and a sending unit 1203.

[0133] The acquisition unit 1201 is used to acquire feature data associated with the cheating behavior in the game operation data of the account to be detected, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is a cheating behavior executed by using a target script, and the feature data is used to indicate the operation frequency and / or operation position of the operation behavior;

[0134] The first detection unit 1202 is used to perform cheat detection on the feature data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a cheat behavior;

[0135] The sending unit 1203 is used to send the detection result to the client.

[0136] Optionally, the first detection unit 1202 includes: a determination module, used to determine, based on feature data and a target threshold, that a detection result indicates that the operation behavior is a cheating behavior.

[0137] Optionally, the feature data includes first frame feature data associated with the joystick operation type, the first frame feature data is operation data that has changed in the operation data of the joystick operation type, and is used to characterize the operation frequency of the corresponding joystick operation behavior, and the target threshold includes a frequency threshold, wherein the determination module is also used to, in response to the operation frequency corresponding to the first frame feature data being greater than the frequency threshold, determine that the detection result is used to indicate that the operation behavior is a plug-in behavior.

[0138] Optionally, the first frame feature data includes the number of operations and the total number of frames of the joystick operation behavior, and the device 1200 is further used to determine the operation frequency based on the number of operations and the total number of frames.

[0139] Optionally, the feature data includes second frame feature data associated with the skill operation type, the second frame feature data is the operation data for releasing the skill in the operation data of the skill operation type, and is used to characterize the operation position of the corresponding skill release behavior, and the target threshold includes an aggregation threshold, wherein the determination module also includes: an aggregation submodule, used to aggregate multiple operation positions corresponding to the second frame feature data to obtain an aggregation result, wherein the aggregation result is used to indicate the complexity of the released skill; a determination submodule, used to determine, in response to the aggregation result being greater than the aggregation threshold, that the detection result is used to indicate that the operation behavior is a plug-in behavior.

[0140] Optionally, the feature data includes the number of releases and the number of different operation positions of the skill release behavior, and the aggregation submodule is used to determine the aggregation result based on the number of releases and the number of different operation positions.

[0141] Optionally, the device 1200 also includes: a review unit, used to detect that the operation behavior is a plug-in behavior, and based on the received review operation instruction, review the camera data in the game to obtain a review result; a first adjustment unit, used to adjust the target threshold based on the review result; a second detection unit, used to perform plug-in detection on the feature data based on the adjusted target threshold to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

[0142] Optionally, the device 1200 also includes: a determination unit, used to detect that the operation behavior is a plug-in behavior and determine the type of operation data; a third detection unit, used to perform plug-in detection on the operation data based on the type to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

[0143] Optionally, the device 1200 also includes: a conversion unit, used to detect that the operation behavior is a plug-in behavior, and convert the operation data into a target matrix; a fourth detection unit, used to perform plug-in detection on the target matrix to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

[0144] Optionally, the device 1200 also includes: a second adjustment unit, used to detect that the operation behavior is a plug-in behavior, and adjust the attribute value of the account, wherein the attribute value is used to characterize the credibility of the account, and the credibility corresponding to the adjusted attribute value is lower than the credibility corresponding to the attribute value before adjustment.

[0145] In the cheat detection device in the game of this embodiment, the acquisition unit is used to obtain the feature data associated with the cheat behavior in the game operation data of the account to be detected; the detection unit is used to perform cheat detection on the feature data to obtain the detection result; the sending unit is used to send the detection result to the client. In the embodiment of the present disclosure, only the feature data associated with the cheat behavior can be detected, without having to detect all the operation data in the game, which greatly reduces the amount of data, improves the detection efficiency, and solves the technical problem of low cheat detection efficiency in the game.

[0146] It should be noted that the above-mentioned units and modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to this: the above-mentioned units and modules are all located in the same processor; or, the above-mentioned units and modules are located in different processors in any combination.

[0147] An embodiment of the present disclosure further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0148] Optionally, in this embodiment, the above-mentioned computer-readable storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store computer programs.

[0149] Optionally, in this embodiment, the computer-readable storage medium may be located in any one of the computer terminals in a computer terminal group in a computer network, or in any one of the mobile terminals in a mobile terminal group.

[0150] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0151] S1, obtaining operation data of the account to be detected in the game, wherein the operation data is used to determine whether the operation behavior corresponding to the virtual game character identified by the account in the game is a plug-in behavior executed by using a target script;

[0152] S2, extracting feature data associated with the cheating behavior from the operation data, wherein the feature data is used to represent the operation frequency and / or operation position of the operation behavior;

[0153] S3, sending the characteristic data to the server, so that the server performs a plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a plug-in behavior;

[0154] S4, receiving the detection result from the server.

[0155] As an optional example, in this embodiment, the computer-readable storage medium may also be configured to store a computer program for performing the following steps:

[0156] S1, obtaining feature data associated with cheating behavior in the game operation data of the account to be detected, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is a cheating behavior executed using a target script, and the feature data is used to indicate the operation frequency and / or operation position of the operation behavior;

[0157] S2, performing cheat detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a cheat behavior;

[0158] S3, sends the detection results to the client.

[0159] In the computer-readable storage medium of this embodiment, plug-in detection can be performed based on feature data associated with plug-in behavior extracted from the operation data without detecting all the operation data, thereby reducing data overhead, improving the efficiency of plug-in detection in the game, and thus solving the technical problem of low efficiency of plug-in detection in the game.

[0160] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a computer-readable storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0161] In an exemplary embodiment of the present application, a program product capable of implementing the above method of the present embodiment is stored on a computer-readable storage medium. In some possible implementations, various aspects of the embodiments of the present disclosure may also be implemented in the form of a program product, which includes a program code, and when the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps described in the above "Exemplary Method" section of the present embodiment according to various exemplary implementations of the present disclosure.

[0162] According to the program product for implementing the above method in the embodiment of the present disclosure, it can adopt a portable compact disk read-only memory (CD-ROM) and include program code, and can be run on a terminal device, such as a personal computer. However, the program product of the embodiment of the present disclosure is not limited to this. In the embodiment of the present disclosure, the computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by or in combination with an instruction execution system, an apparatus or a device.

[0163] The program product may be in any combination of one or more computer-readable media. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination thereof. More specific examples (non-exhaustive) of computer-readable storage media include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof.

[0164] It should be noted that the program code contained in the computer-readable storage medium can be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the above.

[0165] An embodiment of the present disclosure further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0166] Optionally, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0167] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0168] S1, obtaining operation data of the account to be detected in the game, wherein the operation data is used to determine whether the operation behavior corresponding to the virtual game character identified by the account in the game is a plug-in behavior executed by using a target script;

[0169] S2, extracting feature data associated with the cheating behavior from the operation data, wherein the feature data is used to represent the operation frequency and / or operation position of the operation behavior;

[0170] S3, sending the characteristic data to the server, so that the server performs a plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a plug-in behavior;

[0171] S4, receiving the detection result from the server.

[0172] As an optional example, in this embodiment, the processor may also be configured to perform the following steps through a computer program:

[0173] S1, obtaining feature data associated with cheating behavior in the game operation data of the account to be detected, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is a cheating behavior executed using a target script, and the feature data is used to indicate the operation frequency and / or operation position of the operation behavior;

[0174] S2, performing cheat detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is a cheat behavior;

[0175] S3, sends the detection results to the client.

[0176] In the electronic device of this embodiment, cheat detection can be performed based on feature data associated with cheat behavior extracted from the operation data, without having to detect all the operation data, thereby reducing data overhead, improving the efficiency of cheat detection in the game, and thereby solving the technical problem of low cheat detection efficiency in the game.

[0177] Fig.13 is a schematic diagram of an electronic device according to an embodiment of the present disclosure. Fig.13 As shown, the electronic device 1300 is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0178] like Fig.13 As shown, the electronic device 1300 is in the form of a general computing device. The components of the electronic device 1300 may include but are not limited to: at least one processor 1310, at least one memory 1320, a bus 1330 connecting different system components (including the memory 1320 and the processor 1310), and a display 1340.

[0179] The memory 1320 stores program codes, which can be executed by the processor 1310, so that the processor 1310 executes the steps described in the method part of the embodiment of the present application according to various exemplary embodiments of the present disclosure.

[0180] The memory 1320 may include a readable medium in the form of a volatile storage unit, such as a random access memory unit (RAM) 13201 and / or a cache memory unit 13202, and may further include a read-only memory unit (ROM) 13203, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.

[0181] In some examples, the memory 1320 may also include a program / utility 13204 having a set (at least one) of program modules 13205, such program modules 13205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination thereof may include the implementation of a network environment. The memory 1320 may further include a memory remotely disposed relative to the processor 1310, and these remote memories may be connected to the electronic device 1300 via a network. Examples of the above-mentioned network include but are not limited to the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0182] The bus 1330 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a local bus of the processor 1310, or a bus using any of a variety of bus architectures.

[0183] The display 1340 may be, for example, a touch screen type liquid crystal display (LCD) that enables a user to interact with a user interface of the electronic device 1300 .

[0184] Optionally, the electronic device 1300 may also communicate with one or more external devices 1400 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable a user to interact with the electronic device 1300, and / or any device that enables the electronic device 1300 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 1350. Furthermore, the electronic device 1300 may also communicate with one or more networks (e.g., a local area network (LAN), a wide area network (WAN), and / or a public network, such as the Internet) via a network adapter 1360. Fig.13As shown, the network adapter 1360 communicates with other modules of the electronic device 1300 via the bus 1330. It should be understood that although Fig.13 Not shown, other hardware and / or software modules may be used in conjunction with the electronic device 1300, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0185] The electronic device 1300 may further include: a keyboard, a cursor control device (such as a mouse), an input / output interface (I / O interface), a network interface, a power supply and / or a camera.

[0186] It can be understood by those skilled in the art that Fig.13 The structure shown is only for illustration and does not limit the structure of the above electronic device. Fig.13 More or fewer components as shown, or with Figure 1 The memory 1320 can be used to store computer programs and corresponding data, such as the computer programs and corresponding data corresponding to the cheat detection method in the game in the embodiment of the present disclosure. The processor 1310 executes various functional applications and data processing by running the computer program stored in the memory 1320, that is, implementing the cheat detection method in the game described above.

[0187] The serial numbers of the above-mentioned embodiments of the present disclosure are only for description and do not represent the advantages or disadvantages of the embodiments.

[0188] In the above embodiments of the present disclosure, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0189] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0190] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0191] In addition, each functional unit in each embodiment of the present disclosure may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0192] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present disclosure is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present disclosure. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, disk or optical disk and other media that can store program codes.

[0193] The above is only a preferred embodiment of the present disclosure. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present disclosure. These improvements and modifications should also be regarded as the scope of protection of the present disclosure.

Claims

1. A method for detecting cheats in a game, characterized in that: include: Obtaining operation data of the account to be detected in the game, wherein the operation data is used to determine whether the corresponding operation behavior of the virtual game character identified by the account in the game is a plug-in behavior executed by using a target script; Extracting feature data associated with the cheating behavior from the operation data, wherein the feature data is used to represent the operation frequency and / or operation position of the operation behavior; Sending the characteristic data to a server, so that the server performs a plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is the plug-in behavior; Receiving the detection result from the server; Wherein, feature data associated with the plug-in behavior is extracted from the operation data, including: in response to the operation data being operation data of a joystick operation type, first frame feature data associated with the joystick operation type is extracted from the operation data of the joystick operation type, wherein the first frame feature data is operation data that has changed in the operation data of the joystick operation type, and is used to characterize the operation frequency of the corresponding joystick operation behavior; and / or, in response to the operation data being operation data of a skill operation type, second frame feature data associated with the skill operation type is extracted from the operation data of the skill operation type, wherein the second frame feature data is operation data for releasing skills in the operation data of the skill operation type, and is used to characterize the operation position of the corresponding skill release behavior.

2. The method according to claim 1, characterized in that The server includes a game server and an algorithm server, wherein the feature data is sent to the server so that the server performs a plug-in detection on the operation data to obtain a detection result, including: The feature data is transmitted to the algorithm server through the game server, so that the algorithm server performs plug-in detection on the feature data to obtain the detection result.

3. The method according to claim 2, characterized in that Transmitting the feature data to the algorithm server via the game server includes: Sending the feature data to the game server, so that the game server sends the feature data to the algorithm server through a message queue; or The feature data is sent to the game server, so that the game server sends the feature data to the algorithm server through a target request.

4. The method according to any one of claims 1 to 3, characterized in that Get the game operation data of the account to be tested, including: Obtaining camera data of the account in the game; The operation behavior is reproduced based on the camera data to obtain the operation data.

5. A method for detecting cheats in a game, characterized in that: include: Acquire feature data associated with the cheating behavior in the game operation data of the account to be detected, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is the cheating behavior executed by adopting a target script, and the feature data is used to represent the operation frequency and / or operation position of the operation behavior, the feature data includes first frame feature data associated with a joystick operation type, and the feature data includes second frame feature data associated with a skill operation type, the first frame feature data is the operation data that changes in the operation data of the joystick operation type, and is used to characterize the operation frequency of the corresponding joystick operation behavior, and the second frame feature data is the operation data for releasing a skill in the operation data of the skill operation type, and is used to characterize the operation position of the corresponding skill release behavior; Performing a cheat detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is the cheat behavior; The detection result is sent to the client.

6. The method according to claim 5, characterized in that Performing a plug-in detection on the characteristic data to obtain a detection result, including: Based on the characteristic data and the target threshold, the detection result is determined to indicate that the operation behavior is the cheating behavior.

7. The method according to claim 6, characterized in that The target threshold includes a frequency threshold, wherein, based on the feature data and the target threshold, determining that the detection result is used to indicate that the operation behavior is the cheating behavior includes: In response to the operating frequency corresponding to the first frame feature data being greater than the frequency threshold, determining the detection result is used to indicate that the operating behavior is the cheating behavior.

8. The method according to claim 7, characterized in that The first frame feature data includes the number of operations and the total number of frames of the joystick operation behavior, and the method further includes: The operation frequency is determined based on the number of operations and the total number of frames.

9. The method according to claim 6, characterized in that The target threshold includes an aggregate threshold, wherein, based on the feature data and the target threshold, determining that the detection result is used to indicate that the operation behavior is the cheating behavior includes: Aggregating the multiple operation positions corresponding to the second frame feature data to obtain an aggregation result, wherein the aggregation result is used to indicate the complexity of the skill released; In response to the aggregation result being greater than the aggregation threshold, determining that the detection result is used to indicate that the operation behavior is the cheating behavior.

10. The method according to claim 9, characterized in that The feature data includes the number of times the skill release behavior is released and the number of different operation positions. The multiple operation positions corresponding to the second frame feature data are aggregated to obtain an aggregation result, including: The aggregation result is determined based on the number of releases and the number of different operation positions.

11. The method according to claim 6, characterized in that The method further comprises: Detecting that the operation behavior is the cheating behavior, and based on the received review operation instruction, reviewing the camera data in the game to obtain a review result; adjusting the target threshold based on the review result; The feature data is subjected to cheat detection based on the adjusted target threshold to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is the cheat behavior.

12. The method according to claim 5, characterized in that The method further comprises: Detecting that the operation behavior is the plug-in behavior, and determining the type of the operation data; The operation data is subjected to a plug-in detection based on the type to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is the plug-in behavior.

13. The method according to claim 5, characterized in that The method further comprises: Detecting that the operation behavior is the plug-in behavior, converting the operation data into a target matrix; Perform a plug-in detection on the target matrix to obtain a secondary detection result, wherein the secondary detection result is used to indicate whether the operation behavior is the plug-in behavior.

14. The method according to any one of claims 5 to 13, characterized in that: The method further comprises: It is detected that the operation behavior is the plug-in behavior, and the attribute value of the account is adjusted, wherein the attribute value is used to characterize the credibility of the account, and the credibility corresponding to the adjusted attribute value is lower than the credibility corresponding to the attribute value before the adjustment.

15. A device for detecting cheats in a game, characterized in that: include: An acquisition unit, used for acquiring operation data of the account to be detected in the game, wherein the operation data is used to determine whether the operation behavior of the virtual game character identified by the account in the game is a plug-in behavior executed by using a target script; An extraction unit, configured to extract feature data associated with the cheating behavior from the operation data, wherein the feature data is used to represent an operation frequency and / or an operation position of the operation behavior; A sending unit, used for sending the characteristic data to a server, so that the server performs a plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used to indicate whether the operation behavior is the plug-in behavior; A receiving unit, configured to receive the detection result from the server; Wherein, the extraction unit is used to extract the feature data by executing the following steps: in response to the operation data being operation data of a joystick operation type, extracting first frame feature data associated with the joystick operation type from the operation data of the joystick operation type, wherein the first frame feature data is operation data that has changed in the operation data of the joystick operation type, and is used to characterize the operation frequency of the corresponding joystick operation behavior; and / or, in response to the operation data being operation data of a skill operation type, extracting second frame feature data associated with the skill operation type from the operation data of the skill operation type, wherein the second frame feature data is operation data for releasing skills in the operation data of the skill operation type, and is used to characterize the operation position of the corresponding skill release behavior.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program is configured to execute the method according to any one of claims 1 to 14 when executed by a processor.

17. An electronic device comprising a memory and a processor, characterized in that: A computer program is stored in the memory, and the processor is configured to run the computer program to perform the method according to any one of claims 1 to 14.

Images