Method and device for predicting cheats in games, electronic device, and storage medium

Abstract

The method and device, electronic device, and storage medium for predicting cheats in games include the following steps: 1) obtaining all player data from the current game log, processing it to obtain cheat samples, normal player samples, and unlabeled samples, downgrading the weights of the unlabeled samples and using them as negative samples with the normal player samples, and weighting the cheat samples as positive samples; 2) inputting the positive and negative samples into a pre-built cheat prediction model for prediction, obtaining a cheat list and a feature explanation graph; 3) updating the positive and negative samples based on the cheat list as samples for the next prediction. The present invention has high accuracy and strong interpretability, rationally utilizes big data to combat cheats, and supplemented by reviewing the cheat prediction list to achieve a closed-loop cold start and update of the model.

Description

Technical Field

[0001] The present invention relates to the technical field of game cheat detection, and in particular to a cheat prediction method and device, electronic equipment and storage medium in a game. Background Art

[0002] Game cheats are programs designed to modify parts of a game's code. They exploit memory, packet manipulation, simulated keyboard and mouse events, and other methods to replace real player actions in order to profit from the game. Cheats can accelerate game objectives and undermine fairness.

[0003] Currently, most game customer service teams verify player reports online, enabling real-time verification of individual cheating accounts and subsequent identification and action. Relying solely on player reports of cheating leads to high labor costs and low accuracy, making it impossible to effectively combat cheating. Machine learning algorithms are also used to identify cheating. These algorithms primarily extract and analyze features from raw data through complex feature engineering. These extracted and analyzed features are then trained using decision tree-based discriminant models to detect cheating or manually defined cheating rules. The trained models are then used to detect abnormal behavior.

[0004] Methods for detecting cheating behavior based on decision tree discriminant models can use them to identify cheating users based on their characteristics. However, this requires the use of labeled samples to train the decision tree discriminant model. Building a large number of labeled samples is costly, while building a small number of labeled samples makes it difficult to guarantee the accuracy of the decision tree discriminant model. This makes it difficult to strike a balance between training cost and model accuracy. Furthermore, a single piece of player behavior data cannot be labeled with its true label. Consequently, a large amount of unlabeled sample data exists, which cannot be determined to be cheating before manual verification. To avoid misjudgment by the model, unlabeled samples cannot be used as training sets for learning. This data remains idle without practical application, resulting in a waste of resources.

[0005] Methods for identifying cheating behavior based on manually set cheating rules require enumerating all possible cheating measures based on the specific application scenarios. These methods then organize cheating rules and use them to counteract cheating behavior. This often requires the involvement of experts in related fields and prior knowledge. This method is less flexible and difficult to scale. For complex and ever-changing online scenarios, the coverage of cheating rules often decreases significantly over time.

[0006] Furthermore, in the online gaming sector, due to user protection, the presumption of innocence is paramount. Therefore, unless there is clear information on third-party tools and the characteristics of the studio, it is impossible to determine whether a player is using cheats and, therefore, to impose penalties. Consequently, there is currently a lack of a robust, data-driven, and highly interpretable model to accurately identify cheats in online games. Summary of the Invention

[0007] The main purpose of the present invention is to overcome the defects of existing cheat detection methods, such as insufficient utilization of unlabeled samples resulting in waste of resources and low model accuracy, and to propose a cheat prediction method and device, electronic device and storage medium in games.

[0008] The present invention adopts the following technical solutions:

[0009] A method for predicting cheats in a game, characterized by comprising the following steps:

[0010] 1) Obtain all player data from the current game log, process it to obtain cheat samples, normal player samples, and unlabeled samples, downweight the unlabeled samples and use them as negative samples together with the normal player samples, and weight the cheat samples as positive samples;

[0011] 2) Input the positive and negative samples into the pre-built cheat prediction model to obtain a cheat list and feature explanation graph;

[0012] 3) Update the positive and negative samples according to the plug-in list as samples for the next prediction.

[0013] In step 1), the player data is all player data within a preset time length in the game log. The player data is subjected to feature engineering processing to obtain a sample of multi-dimensional features, including recharge, consumption, hardware statistics, behavioral data, transaction tendencies and money flows.

[0014] In step 1), the unlabeled samples are marked as normal player samples and downgraded, and then the downgraded normal player samples and the non-downgraded normal player samples are used as the negative samples.

[0015] In step 2), the feature explanation graph is used to explain the weight distribution of the features of the sample, which include recharge, consumption, hardware statistics, behavioral data, transaction tendency and money flow.

[0016] In step 2), the plug-in prediction model adopts the CatBoost model and combines the shap value as the feature explanatory graph.

[0017] In step 3), the positive samples and / or negative samples are updated according to the cheat list, specifically including the following:

[0018] If there are unlabeled samples with downgraded weights in the cheat list, the unlabeled samples will be marked as cheat samples and updated to positive samples after weighting;

[0019] If there are normal player samples in the cheat list, the normal player samples will be marked as cheat samples, and updated to positive samples after weighting.

[0020] A cheat prediction device in a game, characterized by comprising the following

[0021] The data acquisition module is used to obtain all player data from the current game log and process it to obtain cheat samples, normal player samples and unlabeled samples;

[0022] The sample module is used to downgrade the weight of unlabeled samples and combine them with normal player samples as negative samples, and weight the weight of cheat samples as positive samples;

[0023] The cheat prediction module is used to input positive and negative samples for prediction and output a cheat list and feature explanation map;

[0024] The update module updates the positive and negative samples according to the plug-in list as samples for the next prediction.

[0025] An electronic device includes a processor and a memory, wherein the memory is used to store executable instructions, and is characterized in that: when the processor is configured to run the executable instructions, it implements the method for predicting cheats in a game.

[0026] A computer-readable storage medium stores executable instructions, characterized in that the executable instructions, when executed by a processor, implement the method for predicting cheats in a game.

[0027] From the above description of the present invention, it can be seen that compared with the prior art, the present invention has the following beneficial effects:

[0028] 1. In the present invention, the weights of unlabeled samples are downgraded and used together with normal player samples as negative samples, while the weights of plug-in samples are weighted as positive samples. That is, by adjusting the sample weights, an initial model is trained to predict the plug-in list and perform feature interpretation. This model has high accuracy and strong interpretability, and rationally uses big data to combat plug-ins, supplemented by reviewing the plug-in prediction list, to achieve a cold start and update closed loop of the model.

[0029] 2. In the present invention, all player data comes from the log records of the game server. The unlabeled samples are first labeled as normal player samples and downgraded. Then, the downgraded normal player samples and the non-downgraded normal player samples are used as negative samples. The resources of a large amount of unlabeled sample player data are integrated and utilized to ensure the accuracy of the trained model, which greatly reduces the cost and scale of manual investigation.

[0030] 3. In the present invention, player data is derived from the log records of the game server. The cheat prediction model uses the CatBoost model to predict cheats, and combines the shap value as the feature explanatory graph to explain the weight distribution of the sample features. There is no need to rely on player reports. Through uninterrupted model updates and predictions, cheats in the game are cracked down in real time. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] Figure 1 This is a schematic diagram of processing player data into samples in the present invention;

[0032] Figure 2 Schematic diagram of the method of the present invention;

[0033] Figure 3 Flow chart of the method of the present invention;

[0034] Figure 4 This is a schematic diagram of the plug-in list of the present invention (after review);

[0035] Figure 5 Give an example of a feature explanation diagram for the sample;

[0036] Figure 6 To interpret physical memory using shap value;

[0037] The present invention is further described in detail below with reference to the accompanying drawings and specific embodiments. DETAILED DESCRIPTION

[0038] The present invention is further described below through specific embodiments.

[0039] In order to enable those skilled in the art to better understand the disclosed solutions, the following will clearly and completely describe the technical solutions in the disclosed embodiments in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the disclosed embodiments, not all of them. Based on the embodiments of the disclosed embodiments, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the disclosed embodiments.

[0040] It should be noted that the terms "first", "second", etc. in the specification and claims of the present disclosure and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way are interchangeable where appropriate, so that the embodiments of the present disclosure described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or modules is not necessarily limited to those steps or modules clearly listed, but may include other steps or modules that are not clearly listed or inherent to these processes, methods, products or devices.

[0041] See also Figure 2-Figure 3 The present invention proposes a method for predicting cheats in games, comprising the following steps:

[0042] 1) Obtain all player data from the current game log and process it to obtain cheat samples, normal player samples, and unlabeled samples. The unlabeled samples are weighted down and combined with the normal player samples as negative samples. The cheat samples are weighted up and used as positive samples. The data of players who are clearly cheating is weighted, so that the model considers cheat data more important than other samples.

[0043] In this step, all player data refers to all player data within a preset time length (e.g., half a year) in the game log. The player data is subjected to feature engineering to obtain samples of multi-dimensional features. For example, the multi-dimensional features include recharge, consumption, hardware statistics, behavioral data, transaction tendencies, and money flows, etc., but are not limited to these.

[0044] Among them, cheat samples and normal player samples are samples that have been verified and labeled with corresponding labels based on player behavior data. Unlabeled samples are sample data in player behavior data that cannot be determined whether they are cheats before manual verification, that is, player data of non-cheating players and non-normal players.

[0045] See also Figure 1 , the unlabeled samples are first labeled as normal players and downgraded, and then the downgraded normal player samples and the non-downgraded normal player samples are used as negative samples. The reason for downgrading the unlabeled samples instead of discarding them is that a large amount of player data is sparse data (that is, there is no excessive behavior), and this part of the data is still worth training. Therefore, its label is classified as normal player by default. Moreover, since the data of the unlabeled samples has been downgraded, even if the default classification is wrong, it will not affect the model's training on the existing plug-in data. And this operation supplements a large amount of normal player data, greatly improving the classification ability of the model.

[0046] In the present invention, the weight of a sample refers to the weight of the sample category, which is from high to low as follows: the weight of the cheat sample, the weight of the normal player sample, and the weight of the unlabeled sample, i.e., the downgraded normal player sample.

[0047] 2) Input the positive and negative samples into the pre-built cheat prediction model for prediction to obtain the cheat list and feature explanation map.

[0048] In the present invention, the plug-in prediction model can be a CatBoost model, which is a GBDT framework based on a symmetric decision tree (oblivious trees) algorithm with few parameters, support for categorical variables and high accuracy. The CatBoost model can efficiently and reasonably process categorical features, improving the accuracy and generalization ability of the algorithm. The characteristic values of categorical variables are discrete sets and variables that are meaningless to compare with each other, such as user ID, recharge, consumption, etc.

[0049] The feature interpretation diagram explains the weight distribution of sample features, reflecting the contribution of each feature to the cheat prediction model. These features include top-up, consumption, hardware statistics, behavioral data, transaction trends, and money flows. This paper uses shap values to interpret the CatBoost model, using shap values as a feature interpretation diagram to demonstrate the contribution or influence of each feature of each sample in the cheat list.

[0050] For example: See Figure 6 By interpreting the physical memory size (memory) using the shap value, we can find that the smaller the maximum physical memory (max_memory), the higher the probability of a cheat. This further suggests that the cheat uses a virtual machine, which requires smaller memory allocations to improve efficiency.

[0051] Therefore, by using the shap value as an explanation model and combining all the features, we can accurately determine the key information from the big data and predict the cheats in the game. Figure 5 An example of a feature explanation diagram is shown in the table below:

[0052]

[0053] It can be concluded that the plug-in has a large number of characters opened under the same IP, and most of the Apex (third-party anti-plug-in program) marks and illegal marks are sufficient evidence of the use of the plug-in.

[0054] pass Figure 5The feature explanation graph can also reveal potential game design flaws. For example, while item packages are paid in-game items, cheaters are heavily exploiting them. This is because the game gives these items away for free to new players, and cheaters are exploiting them extensively. Since item packages also generate tradable in-game currency, cheaters are aggressively creating new accounts, constantly refreshing the free item packages, and then farming in-game cash. The Shap explanation model can capture this information, allowing for timely adjustments to design settings to address this vulnerability.

[0055] 3) Update the positive and negative samples according to the plug-in list as samples for the next prediction.

[0056] In this step, the list of hackers is reviewed and processed. The review can be manual or machine. The processing of the hacker list includes the following:

[0057] If there are downgraded unlabeled samples in the cheat list, the unlabeled samples will be marked as cheat samples, and updated to positive samples after weighting; if there are normal player samples in the cheat list, the normal player samples will be marked as cheat samples, and updated to positive samples after weighting.

[0058] See also Figure 4 This is an example of a cheat list after review and processing. This invention utilizes a review mechanism to promptly review and process cheat lists, further increasing the number of positive labels in player data. Iteratively updating the latest labeled data from unlabeled samples allows today's unlabeled sample processing data to become tomorrow's labeled training set, significantly optimizing the model. Over time, the use of unlabeled samples will demonstrate its advantages, and the model's ability to identify and predict cheats will become increasingly accurate.

[0059] The present invention can be applied to different plug-in identification environments for the behavioral information of different target users, for example: it can be an identification environment for game plug-ins, an identification environment for online ticket purchase behavior, an identification environment for online voting behavior, and an identification environment for online auction behavior. Taking the identification environment for game plug-ins as an example, in the game plug-in identification environment, it is necessary to analyze the user behavior information in the game screens of shooting games, parkour games, racing games, multiplayer online tactical competitive games (Multiplayer Online Battle Arena, MOBA), racing games (Racing Game, RCG) and sports games (SPG) in the game scenes to determine whether the game user has used game plug-ins. The trained plug-in prediction model provided by the present application can be deployed in the game servers corresponding to the aforementioned types of game scenes, and used for the plug-in identification results in the plug-in identification environment. The game accounts that use game plug-ins will be banned to ensure that every game user in the plug-in identification environment can participate in the game fairly and justly.

[0060] The present invention also provides a device for predicting cheats in games, which uses the above-mentioned method for predicting cheats in games to predict a cheat list, and may include the following modules:

[0061] The data acquisition module is used to obtain all player data from the current game log and obtain cheat samples, normal player samples and unlabeled samples after processing.

[0062] The sample module is used to downgrade the weight of unlabeled samples and combine them with normal player samples as negative samples, and weight the weight of cheat samples as positive samples.

[0063] The cheat prediction module is used to input positive and negative samples for prediction and output a cheat list and feature explanation graph. The cheat prediction model can use the CatBoost model and combine the shap value as the feature explanation graph.

[0064] The update module updates the positive and negative samples according to the plug-in list as samples for the next prediction.

[0065] The present invention also proposes an electronic device, including a processor and a memory, wherein the memory is used to store executable instructions, and the processor is configured to implement the above-mentioned cheat prediction method in a game when running the executable instructions.

[0066] The present invention also provides a computer-readable storage medium storing executable instructions, which, when executed by a processor, implement the above-mentioned method for predicting cheats in a game.

[0067] The device embodiments described above are merely illustrative. For example, the module division described may be based on logical functions. In actual implementation, alternative divisions may be employed. For example, multiple modules or components may be combined or integrated into another system, or some features may be omitted or not implemented. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through interfaces, indirect coupling or communication connection between units or modules, and may be electrical or otherwise.

[0068] The modules described as separate components may or may not be physically separate, and the components shown as modules may or may not be physical modules, that is, they may be located in one place or distributed across multiple modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present embodiment.

[0069] In addition, the functional modules in the various embodiments of the present disclosure may be integrated into a single processing module, or each module may exist physically separately, or two or more modules may be integrated into a single module. The integrated modules may be implemented in the form of hardware or software functional modules.

[0070] If the integrated module is implemented in the form of a software function module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for enabling a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0071] The above is only a specific implementation of the present invention, but the design concept of the present invention is not limited to this. Any non-substantial changes to the present invention using this concept shall be deemed as an infringement of the protection scope of the present invention.

Claims

1. A method for predicting cheats in games, characterized by: The steps include: 1) Obtain all player data from the current game log and process it to obtain cheat samples, normal player samples, and unlabeled samples. The weight of the unlabeled samples is downgraded and combined with the normal player samples as negative samples. The weight of the cheat samples is weighted as positive samples. 2) Input positive and negative samples into the pre-built cheat prediction model to obtain a cheat list and feature explanation graph; 3) Update the positive and negative samples based on the cheat list as samples for the next prediction, specifically including the following: If there are unlabeled samples with downgraded weights in the cheat list, the unlabeled samples will be marked as cheat samples and updated to positive samples after weighting; If there are normal player samples in the cheat list, the normal player samples are marked as cheat samples, and updated to positive samples after weighting; The weight of a sample refers to the weight of the sample category, which is from high to low: the weight of the cheat sample, the weight of the normal player sample, and the weight of the unlabeled sample, which is the downgraded normal player sample.

2. A method for predicting cheats in a game according to claim 1, characterized in that: In step 1), the player data is all player data within a preset time length in the game log. The player data is subjected to feature engineering processing to obtain samples of multi-dimensional features, including recharge, consumption, hardware statistics, behavioral data, transaction trends and money flow.

3. The method for predicting cheats in a game according to claim 1, wherein: In step 1), the unlabeled samples are marked as normal player samples and downgraded, and then the downgraded normal player samples and the non-downgraded normal player samples are used as the negative samples.

4. The method for predicting cheats in a game according to claim 1, wherein: In step 2), the feature explanation graph is used to explain the weight distribution of the features of the sample, which include recharge, consumption, hardware statistics, behavioral data, transaction tendency and money flow.

5. The method for predicting cheats in a game according to claim 1, wherein: In step 2), the plug-in prediction model adopts the CatBoost model and combines the shap value as the feature explanation graph.

6. A cheat prediction device for a game, characterized by: Including the following The data acquisition module is used to obtain all player data from the current game log and process it to obtain cheat samples, normal player samples and unlabeled samples; The sample module is used to downgrade the weight of unlabeled samples and combine them with normal player samples as negative samples, and weight the weight of cheat samples as positive samples; The cheat prediction module is used to input positive and negative samples for prediction and output a cheat list and feature explanation map; The update module updates the positive and negative samples according to the plug-in list as samples for the next prediction; specifically, it includes the following: If there are unlabeled samples with downgraded weights in the cheat list, the unlabeled samples will be marked as cheat samples and updated to positive samples after weighting; If there are normal player samples in the cheat list, the normal player samples will be marked as cheat samples, and updated to positive samples after weighting; the weight of the sample refers to the weight of the sample category, from high to low, they are the weight of the cheat sample, the weight of the normal player sample, and the weight of the unlabeled sample, that is, the downgraded normal player sample.

7. An electronic device comprising a processor and a memory, wherein the memory is used to store executable instructions, wherein: The processor is configured to implement a method for predicting cheats in a game according to any one of claims 1 to 5 when running executable instructions.

8. A computer-readable storage medium storing executable instructions, characterized in that: When the executable instructions are executed by the processor, the method for predicting cheats in a game according to any one of claims 1 to 5 is implemented.

Images