Method, device and electronic equipment for detecting game hacking behavior

Abstract

The application provides a game external plug-in behavior detection method and device and electronic equipment. Operation data of a target game account in a game scene is obtained. The operation data is input into a preset white box model, the operation data is processed by the white box model, and basic operation characteristics of the target game account are determined. The operation data and scene information in the game scene are input into a preset black box model, the operation data and the scene information in the game scene are processed by the black box model, and time sequence operation characteristics of the target game account are determined. Whether the target game account has an external plug-in behavior is determined based on the basic operation characteristics and the time sequence operation characteristics. The method determines the basic operation characteristics and the time sequence operation characteristics of the target game account by using the white box model and the black box model, and then determines whether the target game account has an external plug-in behavior, so that the process of detecting the game external plug-in behavior has interpretability and robustness, and the detection accuracy is high.

Description

Technical Field

[0001] This invention relates to the field of online game technology, and more specifically, to a method, apparatus, and electronic device for detecting game cheating behavior. Background Technology

[0002] In games, cheat programs significantly impact the player experience and the effective operation of game companies. Related technologies typically use rules and hard-coded generation to detect cheat programs by reading game processes and files, thereby capturing and identifying them. White-box or black-box models can also be used to identify cheat users and combat cheating. However, while rule-based and hard-coded detection methods offer high interpretability, they are prohibitively expensive. White-box model-based machine learning detection methods offer good interpretability and lower costs, but their accuracy and robustness are often low. Black-box model-based machine learning models offer good accuracy and robustness, but their interpretability is poor, and additional manpower is required for annotation of image and audio data. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a method, apparatus and electronic device for detecting game cheating behavior, so that the process of detecting game cheating behavior is both interpretable and robust, and improves the detection accuracy.

[0004] In a first aspect, embodiments of the present invention provide a method for detecting game cheating behavior. The method includes: acquiring operation data of a target game account in a game scene; inputting the operation data into a preset white-box model, processing the operation data through the white-box model to determine the basic operation characteristics of the target game account; wherein the white-box model has a preset data processing algorithm; the basic operation characteristics include: real-time operation characteristics and / or static attribute characteristics of the target game account; inputting the operation data and scene information in the game scene into a preset black-box model, processing the operation data and scene information in the game scene through the black-box model to determine the temporal operation characteristics of the target game account; wherein the black-box model is trained using a preset neural network model; and determining whether the target game account has engaged in cheating behavior based on the basic operation characteristics and temporal operation characteristics.

[0005] Secondly, embodiments of the present invention provide a device for detecting game cheating behavior. The device includes: an operation data acquisition module for acquiring operation data of a target game account in a game scene; a basic operation feature determination module for inputting the operation data into a preset white-box model, processing the operation data through the white-box model, and determining the basic operation features of the target game account; wherein the white-box model has a preset data processing algorithm; the basic operation features include: real-time operation features and / or static attribute features of the target game account; a time-series operation feature determination module for inputting the operation data and scene information in the game scene into a preset black-box model, processing the operation data and scene information in the game scene through the black-box model, and determining the time-series operation features of the target game account; wherein the black-box model is trained using a preset neural network model; and a cheating behavior determination module for determining whether the target game account has engaged in cheating behavior based on the basic operation features and time-series operation features.

[0006] Thirdly, embodiments of the present invention provide an electronic device, including a processor and a memory, wherein the memory stores machine-executable instructions that can be executed by the processor, and the processor executes the machine-executable instructions to implement the above-mentioned method for detecting game cheating behavior.

[0007] Fourthly, embodiments of the present invention provide a machine-readable storage medium storing machine-executable instructions. When the machine-executable instructions are invoked and executed by a processor, the machine-executable instructions cause the processor to implement the aforementioned method for detecting game cheating behavior.

[0008] The embodiments of the present invention bring the following beneficial effects:

[0009] The aforementioned method, device, and electronic device for detecting game cheating behavior acquires the operation data of a target game account in a game scene; inputs the operation data into a preset white-box model, processes the operation data through the white-box model to determine the basic operation characteristics of the target game account; inputs the operation data and scene information in the game scene into a preset black-box model, processes the operation data and scene information in the game scene through the black-box model to determine the temporal operation characteristics of the target game account; and determines whether the target game account has engaged in cheating behavior based on the basic operation characteristics and temporal operation characteristics. This method determines the basic operation characteristics and temporal operation characteristics of the target game account through white-box and black-box models respectively, thereby determining whether the target game account has engaged in cheating behavior. This makes the process of detecting game cheating behavior both interpretable and robust, and achieves high detection accuracy.

[0010] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. The objects and other advantages of the invention are realized and obtained in accordance with the structures particularly pointed out in the description, claims and drawings.

[0011] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0012] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0013] Figure 1 A flowchart illustrating a method for detecting game cheating behavior provided in an embodiment of the present invention;

[0014] Figure 2 This is a schematic diagram of the structure of an external plug-in detection system provided in an embodiment of the present invention;

[0015] Figure 3 A schematic diagram of the structure of a game cheat detection device provided in an embodiment of the present invention;

[0016] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0017] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0018] "Cheat programs" generally refer to programs or software that modify game data to gain an advantage for players. They use computer technology to perform non-original operations on one or more software programs, tampering with the game's original settings and rules, greatly enhancing the skills and extraordinary abilities of game characters, thereby easily obtaining the benefits of victory, rewards, and pleasure. These cheat programs are created by modifying parts of the software's program.

[0019] In games, the emergence of cheat programs and scripts has greatly impacted the player experience and the effective operation of game companies. Cheat tools can acquire large quantities of in-game items, leading to a sharp decline in game company revenue, and the imbalance between players further causes a large number of players to leave.

[0020] In recent years, the rapid progress in machine learning, especially deep learning, has spurred innovation in game behavior analysis and driven advancements in game cheat detection technology. Game companies have developed various anti-cheat solutions, such as rule-based and hard-coded cheat detection schemes, which detect cheat software by monitoring its access to game processes and files. Recent developments have also seen the emergence of solutions based on image recognition, graph networks, and user trajectory.

[0021] The main methods for detecting game cheats can be summarized into the following two types:

[0022] 1. By using rules and hard-coded detection, cheat programs can be detected and identified as they read game processes and game files.

[0023] As described above, this method requires manual analysis of the characteristics of each cheat software and the design of specific detection programs. Its advantage is that the programming process for combating cheats is transparent and highly explainable. However, its disadvantages are also obvious: first, creating such anti-cheat programs requires a significant investment of manpower and funds; second, cheat developers can easily bypass anti-cheat programs; and third, too many anti-cheat programs may negatively impact the game experience.

[0024] 2. Using machine learning to identify cheaters and thus combat cheating. This can be further divided into two approaches: white-box model and black-box model.

[0025] White-box model-based solutions model cheat users by constructing a series of manually generated features and a white-box machine learning model. For example, one solution performs feature engineering on user login IP, login device, game level, and other data. After obtaining the feature data, it uses white-box models such as decision trees and rule filtering to classify cheat users. The advantages of this approach are cost-effectiveness, no impact on the game experience, and good interpretability. However, the disadvantages are low accuracy and a tendency to miss or misdetect cheat users.

[0026] Black-box model-based solutions eliminate the need for manual feature construction. They directly utilize the black-box model to model the raw data, with the algorithm automatically extracting features during the modeling process. For example, one solution captures screenshots of cheaters' gameplay, manually labels the cheat software components, and then uses the labeled images to train a convolutional neural network (CNN). This ultimately enables the CNN to identify cheat software in user game screenshots. Compared to white-box models, this approach offers higher accuracy, but its potential drawbacks include the need for additional investment in labeling during development, poor model interpretability, and the inability to modify the model after detecting false negatives or missed detections, requiring retraining.

[0027] In general, while rule-based and hard-coded detection methods offer high interpretability, they are prohibitively expensive. White-box model-based machine learning detection methods, while ensuring good interpretability and low cost, often suffer from low accuracy and robustness. Black-box model-based machine learning models, while offering good accuracy and robustness, have poor interpretability and require additional manpower for annotation when dealing with image or audio data. Therefore, none of these methods can simultaneously satisfy the requirements of high robustness, high accuracy, high interpretability, and low cost.

[0028] The anti-cheat algorithms in related technologies have problems such as excessive manpower costs, low robustness of the algorithms, low accuracy of cheat detection, easy cracking by cheat developers, and lack of interpretability.

[0029] Based on this, the present invention provides a method, device, and electronic device for detecting game cheating behavior, which can be applied to various user operation game scenarios.

[0030] To facilitate understanding of this embodiment, we will first describe a method for detecting game cheating behavior disclosed in this embodiment of the invention, such as... Figure 1 As shown, the method includes the following steps:

[0031] Step S102: Obtain the operation data of the target game account in the game scene.

[0032] The aforementioned operational data typically refers to data generated during the target game account's movement within the game scene and the execution of game tasks. This data is usually generated by the target game account's operation of human-computer interaction devices such as a mouse, keyboard, or touchscreen, and is typically sent from the terminal device controlled by the target game account to a server running the game system, or to a database or cloud storage space that collects the game account's operational data. When the target game account uses a cheat program to perform game operations, the cheat program usually runs on the terminal device, generating operational data, which is then sent by the terminal device to the corresponding server or database.

[0033] During gameplay, game accounts may also engage in activities such as chatting in chat channels or checking in-game mail. These actions generate data unrelated to gameplay, but the terminal device typically sends this data along with gameplay data to a database that collects game account activity data. The raw activity data retrieved from the database needs to be processed based on the specific actions performed, such as filtering out irrelevant data, to minimize interference with the detection of cheating behavior.

[0034] When a large amount of operation data of the target game account is obtained, more complete operation data of the corresponding game process can be selected from it. For example, the operation data shows that one or more game tasks were completed, or the movement path in the game scene is relatively complete, so that more accurate operation features of the target game account can be extracted in the future.

[0035] Step S104: Input the operation data into the preset white-box model, process the operation data through the white-box model, and determine the basic operation characteristics of the target game account; wherein, the white-box model has a preset data processing algorithm; the basic operation characteristics include: the real-time operation characteristics and / or static attribute characteristics of the target game account.

[0036] The aforementioned basic operational features can include multiple elements, such as click count features and click area features, which are characteristics of real-time operations. During game operation, the target game account typically needs to click on controls in the game scene, such as clicking on the icon of an interactive virtual character to generate an interactive event, or clicking on the entrance icon of a game scene to enter the game scene accessed by that entrance icon from the current game scene.

[0037] When a game account operated by a genuine player makes clicks, the clicks are highly targeted and the click locations are relatively accurate. In contrast, clicks generated by cheat programs may be faster, more frequent, and the click areas may not all be concentrated in the display area of ​​controls. Therefore, it is possible to extract click-related features from the operation data to determine whether the target game account is using cheat programs, i.e., engaging in cheating behavior. Specifically, one can first identify click-related data concerning the target object from the operation data based on correlation principles, and then further perform statistical processing on the click-related data to determine the click-related features.

[0038] When completing game tasks, the target game account typically needs to move from one game location to another within the game scene. This process can be achieved through one or more paths, and the target game account may need to interact with virtual characters during the movement. A real player's game account might typically only complete one or a few tasks, choosing one or a few paths, and their movement speed might vary. A cheat program, however, might traverse all paths, completing multiple tasks in a short time to maximize gains, with a relatively fast and almost constant movement speed. The movement speed characteristic described above can be considered an instantaneous operational characteristic, while the complexity and repetition of the movement paths, as well as the time characteristic for completing the task, can be considered static attribute characteristics. Therefore, movement-related features can be extracted from the operational data to determine whether the target game account used a cheat program, i.e., whether cheating behavior occurred. These features can usually be obtained based on statistical processing of the operational data and can be represented as normalized matrices, vectors, or numerical values.

[0039] Step S106: Input the operation data and scene information in the game scene into a preset black box model. Process the operation data and scene information in the game scene through the black box model to determine the temporal operation characteristics of the target game account. The black box model is trained by a preset neural network model.

[0040] The aforementioned scene information can include interactive virtual characters, triggerable game controls, map coordinates, etc. This scene information influences the target game account's actions during gameplay, such as causing it to linger near interactive virtual characters. Inputting this information into the black-box model allows it to better understand the operational data and obtain more accurate temporal operational characteristics.

[0041] Since the operational data of a target game account is often quite complex, and due to factors such as unfamiliarity with the controls, wandering around in a certain game scene may generate some useless data, this operational data can be simplified to obtain simplified operational data that can represent the behavior of the target game account. One or several data points from the simplified operational data can represent the game behavior of the target game account, such as a single data point representing the click behavior of the target game account.

[0042] Furthermore, data can be manipulated to determine the game behavior of the target game account, such as arriving at a certain location or interacting with a virtual character. This scene information, game behavior, and simplified operational data are input into a black-box model, allowing the model to process this data and determine the temporal operational characteristics of the target game account.

[0043] The aforementioned black-box models are typically built upon neural networks or deep learning models, often employing network structures such as Recurrent Neural Networks (RNNs), Long Short-Term Memory networks (LSTMs), and Independent Recurrent Neural Networks (IRNs). When training a black-box model, it is usually necessary to learn the temporal operational features of both data containing cheating behavior and data without cheating behavior. The former, referred to as negative samples, represents data obtained through game operations performed using cheat programs, while the latter, referred to as positive samples, represents data obtained through real player gameplay. After training the black-box model with a large number of negative and positive samples, a black-box model capable of extracting the temporal operational features of the data can be obtained.

[0044] Step S108: Based on basic operation characteristics and time sequence operation characteristics, determine whether the target game account has engaged in cheating behavior.

[0045] The aforementioned basic and sequential operational features can typically be represented numerically, as vectors, or as matrices. Each feature can be processed separately to transform its representation into a single, unified form, such as numerical representation. Then, weighted summations can be applied to these transformed features to obtain a probability parameter indicating whether the target game account has engaged in cheating behavior. Finally, based on the relationship between this probability parameter and a preset threshold, it is determined whether the target game account has engaged in cheating behavior.

[0046] In addition, a cheat behavior judgment model can be established based on classification algorithms, neural networks or deep learning algorithms, and the model can be trained based on a large number of basic operation features and time sequence operation features to obtain a model that can judge whether cheat behavior has occurred based on various operation features, and finally realize the detection of cheat behavior.

[0047] The aforementioned method for detecting game cheating behavior involves acquiring the target game account's operational data within the game scene; inputting this data into a pre-defined white-box model, which processes the data to determine the target game account's basic operational characteristics; inputting the operational data and scene information from the game scene into a pre-defined black-box model, which also processes the data to determine the target game account's temporal operational characteristics; and finally, based on these basic and temporal operational characteristics, determining whether the target game account has engaged in cheating behavior. This method uses both white-box and black-box models to determine the target game account's basic and temporal operational characteristics, thereby determining whether the target game account has engaged in cheating behavior. This makes the process of detecting game cheating behavior both interpretable and robust, and also achieves high detection accuracy.

[0048] The following embodiments provide a specific method for processing operational data through a white-box model to determine the basic operational characteristics of a target game account.

[0049] The aforementioned basic operational characteristics may include real-time operational characteristics of the target game account, such as click operation characteristics, as well as static attribute characteristics, such as pathfinding operation characteristics and task time characteristics.

[0050] When determining click operation characteristics, a white-box model can be used based on the Pearson correlation coefficient to identify click operation data corresponding to the target object in the game scene from the operation data. Based on the click operation data corresponding to the target object in the game scene, the click operation characteristics of the target game account can be determined, such as the maximum number of clicks on the target object and the average click time on the target object.

[0051] Typically, game scenes involve multiple target objects, usually interactive virtual characters, virtual items, or skill controls. When determining the click behavior characteristics of a target game account, for each target object in the game scene, based on the target object and its corresponding click data, the number of clicks for that target object can be determined. The maximum number of clicks for the target game account is then determined from among the multiple target objects. For example, if the number of clicks for multiple target objects is 1, 4, and 6, the maximum number of clicks for the target game account is 6. Alternatively, for each target object in the game scene, the click time for that target object can be determined based on the operation time of the target object and its corresponding click data. The average of the click times for multiple target objects is then determined as the average click time for the target game account. Generally, game cheats, lacking human intelligence, often require repeatedly clicking the same target.

[0052] Pathfinding operation features are typically used to characterize the degree of repetition in the movement paths of a target game account within a game scene. Game cheats often exhibit unusual pathfinding methods; for example, due to internal design, they may repeatedly follow a particular route. First, motion path data from the operation data can be obtained using a white-box model. Different operations, such as clicks and movements, usually have defined identifiers, which can be used to identify the motion path data. Then, repetitive sub-path data is identified from the motion path data. Based on the length and repetition count of the sub-path data, the pathfinding operation features of the target game account are determined. Specifically, the length of the sub-path data can be multiplied by the repetition count, and the result is used as the pathfinding operation feature; the larger the value, the higher the suspicion of cheating.

[0053] Task time characteristics typically refer to the time taken by a target game account to complete a target task. For certain specific tasks, game cheats, due to their fixed operations, exhibit very stable task times; in contrast, human task completion times show significant variance. Specifically, a white-box model can first be used to determine the operational data corresponding to the target task in the game scene from the operational data, based on the correlation between the task and the operational data. Then, based on the operational data corresponding to the target task, the execution time of the target task is determined, which is usually multiple. Finally, based on the execution time of the target task, the task time characteristics of the target game account are determined. Specifically, the variance of the execution time can be determined based on the length of time the target task is executed, and then the ratio of the number of executions of the target task to the variance of the execution time is determined as the task time characteristic of the target game account.

[0054] The following embodiments provide a method for inputting operation data and scene information in the game scene into a preset black box model, and processing the operation data and scene information in the game scene through the black box model to determine the specific method of the timing operation characteristics of the target game account.

[0055] Since operational data is often quite messy, the target game account may make some meaningless movements in the game scene, which can interfere with the extraction of temporal operation features. Therefore, the operational data can be preprocessed, such as by simplifying operations, to obtain preprocessed operational data. Then, the preprocessed operational data and scene information in the game scene are input into a preset black-box model. The black-box model processes the preprocessed operational data and scene information to determine the temporal operation features of the target game account.

[0056] When preprocessing the data, the operation data can be simplified first to obtain simplified operation data for the target game account. Then, based on the simplified operation data of the target game account, the timing operation parameters of the target game account are generated, and the simplified operation data and timing operation parameters are then used as the preprocessed operation data.

[0057] Specifically, simplifying operations can involve removing operation data that is irrelevant to the game scene from the operation data, and merging duplicate data in the removed operation data to obtain simplified operation data for the target game account; where duplicate data indicates that the target game account performs repetitive actions in the game scene.

[0058] When determining the timing operation parameters of a target game account, basic information and the order of multiple game behaviors of the target game account can be determined based on simplified operation data. Game behaviors can include interacting with a virtual character, obtaining a virtual item, etc. Basic information includes one or more of the following: time, number of times, average interval, and relative map coordinates corresponding to the game behavior. Then, based on the basic information and order of multiple game behaviors, an absolute position code is generated. The absolute position code indicates the absolute order of multiple game behaviors. For example, if the target game account successively performs three game behaviors: interacting with virtual character 1, interacting with virtual character 2, and obtaining virtual item 1, then the absolute position code can be a combination of the occurrence order, game behavior code, and occurrence location of the game behavior. The correlation of game behaviors is obtained. This correlation can be provided by the game developers or relevant experts. Based on the basic information corresponding to the correlated game behaviors, a relative position code is generated. This code can also be obtained by processing the occurrence order, game behavior code, and occurrence location of the game behavior using a preset algorithm. The relative position code indicates the relative position between correlated game behaviors. Finally, the basic information, absolute position code, and relative position code of the game behaviors are determined as the timing operation parameters of the target game account. These timing operation parameters can help black-box models extract the timing operation features of operation data more accurately.

[0059] The aforementioned black-box model can be trained as follows: Training data is determined from a pre-defined sample set; the training data includes both positive and negative samples; positive samples include operation data judged by a pre-defined algorithm as exhibiting cheating behavior, or operation data generated by a cheat program; negative samples include operation data judged by a pre-defined algorithm as not exhibiting cheating behavior, or data generated by real player operations; the positive and negative samples are input into the initial model to obtain the processing result output by the initial model; the initial model is built based on a bidirectional long short-term memory network; this network is a bidirectional time recurrent neural network, suitable for processing and predicting important events with relatively long intervals and delays in time series. Then, an adaptive moment estimation optimizer determines the loss value of the initial model based on the processing result; the model parameters of the initial model are updated based on the loss value; the step of determining training data from the pre-defined sample data continues until the loss value converges, and the initial model after the loss value converges is determined as the trained black-box model.

[0060] The following embodiments provide a specific method for determining whether a target game account has engaged in cheating behavior based on basic and timing operation features.

[0061] In practical implementation, an anti-cheat behavior determination model can be built and trained based on the Boosting algorithm. During use, basic operation features and time-series operation features can be input into the pre-trained anti-cheat behavior determination model. The model then processes these features to obtain probability parameters indicating that the target game account has engaged in anti-cheat behavior. The anti-cheat behavior determination model is built based on the Boosting algorithm, a meta-heuristic algorithm in machine learning primarily used to reduce bias and variance in supervised learning, and a series of machine learning algorithms that transform weak learners into strong learners. Based on the probability parameters, it is determined whether the target game account has engaged in anti-cheat behavior. If the probability parameter is greater than a certain threshold, the target game account is considered to have engaged in anti-cheat behavior; otherwise, it is considered that the target account has not engaged in anti-cheat behavior.

[0062] Furthermore, SHAPs can be applied to models for identifying cheating behavior. SHAPs are game-theoretic methods used to interpret the output of machine learning models. They leverage the classic Shapley value and its extensions to correlate local analyticity with feature scores. Then, the contribution parameters of basic operational features and time-series operational features in the probability parameters of a target game account sending cheating behaviors can be used to further generate a suspicion map based on the contribution parameters of these basic and time-series operational features. This allows relevant personnel to identify which aspects of the target game account are most likely to exhibit cheating behavior.

[0063] This invention also provides another method for detecting game cheating behavior. This method... Figure 1 This method is implemented based on the method shown. To simultaneously meet the requirements of high robustness, high accuracy, high interpretability, and low cost, this method is mainly aimed at massively multiplayer online role-playing games (MMORPGs), and uses a gray-box model to detect cheating behavior in the game account's gameplay.

[0064] The method primarily employs the following process: First, a subset of user operations is selected from numerous basic user actions to describe the user's basic operation flow, and the user's actions within a specific gameplay flow are recorded on the server. Then, user data is processed through white-box and black-box models to extract manually generated features and automatically learned features, respectively. Finally, the manually generated features and automatically learned features are fused through a gray-box model to output the probability that the user is using cheats, and SHAPs are used to visualize the suspicion level of each user feature. SHAPs is a game theory method used to interpret the output of machine learning models; it utilizes the classic Shapley value and its related extensions to correlate local analysis with feature scoring.

[0065] like Figure 2 As shown, the above method is mainly implemented based on an anti-cheat behavior detection system composed of a data preprocessing module, a feature extraction module, and a model discrimination module. In the data preprocessing stage, the user's raw interaction data is first stored in the raw database, and then processed by the data processing module and saved as game behavior data. In the feature extraction stage, the game behavior data is used to extract user features through both a manual feature extraction submodule and an automatically learned feature extraction submodule. Finally, the two types of user features are combined and input into the model discrimination module, which outputs the discrimination probability and related feature analysis.

[0066] The three modules will be described in detail below:

[0067] (1) Preprocessing module: mainly includes two processes. First, select a suitable subset of data from a large number of user interaction data and save it to the original database. Second, clean, filter and format the original dataset and save the processed data to the game behavior database.

[0068] (2) Feature Extraction Module: The feature extraction module is the core technology of the entire system. Its main responsibility is to perform a series of feature engineering on game behavior data and output feature data. Its goal is to enable cheating users and ordinary users to be classified in a new data domain. The overall requirements of the feature extraction module will be described first, and then the requirements of its two sub-modules will be described separately.

[0069] General requirements:

[0070] A. Consistency. The features obtained by the feature extraction module should maintain consistency in distinguishing between cheating and non-cheating users. For example, if one feature biases towards higher values ​​indicating greater suspicion of cheating, while another biases towards lower values ​​indicating greater suspicion, then when these two features are fused into the discrimination model, both features should maintain their numerical relationship with the suspicion level. Otherwise, it indicates that the two features influence each other, and appropriate features should be retained while useless features are discarded.

[0071] B. Multiplicity. The feature extraction module needs to fully analyze game behavior from multiple perspectives to ensure the diversity of feature extraction and improve the system's generalization ability.

[0072] Below is an overview of two submodules and their corresponding requirements:

[0073] Manual Feature Extraction Submodule: This module is a white-box model. Its core is designing a series of feature extraction algorithms based on expert knowledge. This module possesses high reliability and good interpretability. Its requirements are as follows:

[0074] a. Accuracy. The algorithm within this module should accurately reflect expert knowledge, and the generated features should effectively distinguish between ordinary users and cheat users.

[0075] b. Completeness. This module should be able to output all feature extractions for each user, and should avoid situations where user features cannot be calculated.

[0076] c. Robustness. The feature extraction algorithm of this module should remain stable across users and in time and space. The feature extraction process should be fair and unbiased for different users; for different time and space environments (such as different computation times or different computers), the output of this module should remain consistent for the same input.

[0077] Automatic Learning Feature Extraction Submodule: This module is a black-box model used to model game behaviors that cannot be obtained through expert knowledge or cannot be directly encoded, such as the order of operations over long periods. Its core algorithm is Bi-LSTM. It needs to meet the following requirements:

[0078] a. Temporal sequence. This module needs to extract the player's actions over a certain time span and form features with a temporal sequence.

[0079] b. Effectiveness. The temporal features extracted by this module can effectively distinguish between cheating players and non-cheating players.

[0080] (3) Model discrimination module: This module is a gray-box model, mainly responsible for fusing the white-box and black-box models in the feature extraction module. At the data level, it is represented by unifying manual features and automatically learned features under a unified framework for modeling. One of the outputs of this module is the probability of suspected cheating, and the other is a suspected cheating map of each feature of the user visualized with the help of SHAPs.

[0081] The feature extraction module is the core module of the entire system. The effectiveness of the extracted features determines the final result of the system. The following will describe the specific functions and technologies implemented by the two sub-modules.

[0082] A. Manual Feature Extraction Submodule: This module belongs to the white-box model and its function is to extract numerical feature vectors from game behavior data based on expert knowledge. Technically, features modeled from the same expert knowledge can take many different forms; for example, features related to click behavior can be modeled as maximum number of clicks, average click time, etc. To select the best feature representation, this method uses the Pearson correlation coefficient as the criterion for selecting all features, as shown in Formula 1. Where x i It is a feature value of the i-th sample. It is the average value of this feature, y i This is the label of the sample. is the average label value, and r is the Pearson correlation coefficient. For the same expert knowledge, this scheme selects the three with the highest Pearson correlation coefficients as the criterion for feature selection.

[0083]

[0084] The following lists the key expert knowledge used in this method:

[0085] Click behavior characteristics: This feature is mainly used to distinguish the clicking habits of cheat users and non-cheat users. For game cheats, due to their lack of human intelligence, they typically need to repeatedly click the same target multiple times. Using the Pearson correlation coefficient, the maximum number of clicks and the average click time can be selected as features.

[0086] Pathfinding Behavior Features: This feature is primarily used to distinguish the pathfinding habits of cheating users and non-cheating users. Game cheats often repeat a certain route multiple times. This method uses the maximum repeating subsequence method to extract this feature, as shown in Formula 2.

[0087] f 寻路 =length 最大重复子序列 ×N 重复数 (2)

[0088] Task Time Feature: This feature is mainly used to distinguish between cheat users and non-cheat users in terms of task duration. For certain specific tasks, cheat users, due to their fixed operations, have very stable task times; in contrast, human task completion times exhibit greater variance. Feature extraction is shown in Formula 3.

[0089]

[0090] Among them, Var 任务时间 This represents the variance of the task time.

[0091] B. Automatic Learning Feature Extraction Module: This module is based on a black-box model and its function is to model the temporal features of game behavior, thereby compensating for user characteristics that expert knowledge cannot cover. Technically, this module first simplifies and merges the game behavior sequence, then encodes each operation into a vector that can be input into a Bi-LSTM, and finally completes model training through supervised training methods to extract features from future data. The key technical points of this module will be introduced from three aspects below.

[0092] Game behavior is complex, and simplifying game behavior can prevent severe overfitting in neural networks. This method simplifies user action sequences by ignoring task-irrelevant actions and merging consecutive repetitive actions into a single action.

[0093] The aforementioned black-box model is based on Bi-LSTM. This model design uses a single-layer Bi-LSTM as the backbone and a single-layer neural network discriminator layer. The last hidden layer vectors from both forward and backward passes of the Bi-LSTM are concatenated as the input to the single-layer neural network. The output is a binary classification output, and a negative log-likelihood loss function is used to optimize the model. The structure of the Bi-LSTM is shown in Equations 4 to 8, the binary classification output is shown in Equation 9, and the loss function is shown in Equation 10.

[0094] f t =σ(W f x t +U f h t-1 +b f (4)

[0095] i t =σ g (W i x t +U i h t-1 +b i (5)

[0096] o t =σ g (W o xt +U o h t-1 +b o (6)

[0097] c t =f t ⊙c t-1 +i t ⊙σ c (W c x t +U c h t-1 +b c (7)

[0098] h t =o t ⊙σ h (c t (8)

[0099]

[0100] loss=NLLLoss(Pred,Label) (10)

[0101] The meanings of each variable are as follows:

[0102] x t : The action vector of the current input;

[0103] f t The forget gate of LSTM;

[0104] i t : The input gate of LSTM;

[0105] o t : Output gate of LSTM;

[0106] h t The hidden state of LSTM;

[0107] c t : LSTM cell states;

[0108] W: The matrix used in training, where the network learns and calculates meta-values.

[0109] Due to the black-box nature of Bi-LSTM, its classification ability can be enhanced by artificially introducing features at the input. Specifically, features considered effective in expert knowledge, such as behavioral information and NPC information, can be introduced at the input. Absolute position encoding and relative position encoding can be designed to reinforce the temporal nature of game actions. Absolute position encoding is used to encode the absolute order of game actions, while relative position encoding is used to encode the relative position of any two game actions considered related in expert knowledge. Furthermore, the operation time, number of operations, and average interval corresponding to the operation data can also be input as features into the Bi-LSTM model.

[0110] 4) Training Design: This method uses the Adam optimizer as the training optimizer for Bi-LSTM. The training labels are manually labeled or obtained from other cheat detection programs as positive samples from cheat users. A batch of representative users are manually filtered from ordinary users as negative samples. Bi-LSTM is trained through common machine learning training procedures.

[0111] The model discrimination module is responsible for receiving all features from the feature extraction module as input and providing a judgment on whether a user is using cheats, along with the basis for this judgment. This module is the overall output module of the system. Technically, this module is designed based on the principles of gray-box modeling and uses the Boosting algorithm as its core. The input to the Boosting algorithm is a user's manually generated features and automatically learned features, and the output is the probability that the user is using cheats. Simultaneously, SHAPs are used at the output to visualize the suspicion level of each feature of the user. Since this module also belongs to the machine learning module, it also requires a training process; however, because its training process is similar to that of Bi-LSTM, it will not be elaborated here.

[0112] The above method has the following advantages:

[0113] 1. Save on the cost of combating cheating software.

[0114] During the model development phase, since this method does not involve unstructured data such as images and speech, no additional manpower is required for data annotation. Once the model is developed, the entire system can run automatically without additional manpower. Moreover, due to the use of gray box modeling, the cost of maintenance and problem repair is greatly reduced.

[0115] Since the above methods are modeled based on the essential characteristics of game cheat operation, they have strong universality among different cheat software, do not require a lot of manpower to monitor the updates and improvements of cheat software, and have very low operating costs.

[0116] 2. Improve the robustness and accuracy of test results.

[0117] The above method effectively combines the advantages of both black-box and white-box models. With limited labeled data, the black-box model accurately captures the complex operational habits of cheat users, ensuring basic recognition accuracy. Meanwhile, the white-box model leverages expert knowledge to effectively expand the model's recognition scope, extracting both real-time operational and static attribute features of users, achieving good robustness. The diverse features determined by both methods guarantee the overall reliability of the approach. From an algorithmic perspective, the gray-box model, with its combination of accuracy and interpretability, ensures accuracy and robustness in the cheat-fighting process.

[0118] 3. Highly targeted. The data source for this method is limited to the game itself and does not involve the detection of other applications on the user's host, effectively protecting the user's privacy. Moreover, the entire detection process is carried out on the server side and will not affect the game experience itself.

[0119] 4. High interpretability. The main body of the system adopts white-box modeling, while the black-box part is only added as a feature to the gray-box system. It can provide complete analysis for each output of the system, thus providing strong evidence for combating cheating.

[0120] 5. It promotes fairness in the gaming environment.

[0121] The above methods operate entirely on the server side, effectively protecting the gaming experience and privacy of ordinary users. Through long-term efforts to combat cheating software, this method has effectively promoted a fairer gaming environment.

[0122] For the above method embodiments, see Figure 3 The device shown is a detection device for game cheating behavior, the device comprising:

[0123] Operation data acquisition module 302 is used to acquire operation data of the target game account in the game scene;

[0124] The basic operation feature determination module 304 is used to input operation data into a preset white-box model, process the operation data through the white-box model, and determine the basic operation features of the target game account; wherein, the white-box model has a preset data processing algorithm; the basic operation features include: the real-time operation features and / or static attribute features of the target game account;

[0125] The timing operation feature determination module 306 is used to input operation data and scene information in the game scene into a preset black box model, and process the operation data and scene information in the game scene through the black box model to determine the timing operation features of the target game account; wherein, the black box model is trained through a preset neural network model.

[0126] The cheat behavior determination module 308 is used to determine whether a target game account has engaged in cheat behavior based on basic operation characteristics and time sequence operation characteristics.

[0127] The aforementioned method, device, and electronic device for detecting game cheating behavior acquires the operation data of a target game account in a game scene; inputs the operation data into a preset white-box model, processes the operation data through the white-box model to determine the basic operation characteristics of the target game account; inputs the operation data and scene information in the game scene into a preset black-box model, processes the operation data and scene information in the game scene through the black-box model to determine the temporal operation characteristics of the target game account; and determines whether the target game account has engaged in cheating behavior based on the basic operation characteristics and temporal operation characteristics. This method determines the basic operation characteristics and temporal operation characteristics of the target game account through white-box and black-box models respectively, thereby determining whether the target game account has engaged in cheating behavior. This makes the process of detecting game cheating behavior both interpretable and robust, and achieves high detection accuracy.

[0128] The aforementioned basic operational features include the real-time operational features of the target game account; the real-time operational features include click operational features; the basic operational feature determination module is also used to: determine the click operational data corresponding to the target object in the game scene from the operational data using a white-box model based on the Pearson correlation coefficient; and determine the click operational features of the target game account based on the click operational data corresponding to the target object in the game scene.

[0129] The aforementioned click operation characteristics include the maximum number of clicks on the target object and the average click time on the target object; the target object includes multiple objects; the basic operation characteristic determination module is also used to: for each target object in the game scene, determine the number of click operations corresponding to the target object based on the target object and its corresponding click operation data; determine the maximum number of click operations with the largest value among multiple target objects as the maximum number of clicks for the target game account; for each target object in the game scene, determine the corresponding click time based on the operation time of the target object and its corresponding click operation data; and determine the average of the sum of the click times of multiple target objects as the average click time for the target game account.

[0130] The aforementioned basic operational features include the static attribute features of the target game account; the static attribute features include pathfinding operation features; the pathfinding operation features are used to characterize the degree of repetition of the movement paths of the target game account in the game scene; the basic operational feature determination module is also used to: obtain movement path data in the operational data through a white-box model; identify repetitive sub-path data from the movement path data; and determine the pathfinding operation features of the target game account based on the length and repetition count of the sub-path data.

[0131] The aforementioned basic operational features include the static attribute features of the target game account; the static attribute features include task time features; the basic operational feature determination module is also used to: determine the operational data corresponding to the target task in the game scene from the operational data through a white-box model; determine the execution time of the target task based on the operational data corresponding to the target task; and determine the task time features of the target game account based on the execution time of the target task.

[0132] The aforementioned execution time includes the duration of at least one execution of the target task; the basic operation feature determination module is also used to: determine the variance of the execution time based on the duration of the target task execution; and determine the ratio of the number of times the target task is executed to the variance of the execution time as the task time feature of the target game account.

[0133] The aforementioned timing operation feature determination module is also used to: preprocess the operation data to obtain preprocessed operation data; input the preprocessed operation data and scene information in the game scene into a preset black box model, and process the preprocessed operation data and scene information through the black box model to determine the timing operation features of the target game account.

[0134] The aforementioned timing operation feature determination module is also used to: simplify the operation data to obtain simplified operation data of the target game account; generate timing operation parameters of the target game account based on the simplified operation data of the target game account; and determine the simplified operation data and timing operation parameters as preprocessed operation data.

[0135] The aforementioned timing operation feature determination module is also used to: remove operation data that is irrelevant to the game scene from the operation data; merge duplicate data in the removed operation data to obtain simplified operation data for the target game account; and use duplicate data to indicate that the target game account performs repeated actions in the game scene.

[0136] The aforementioned timing operation feature determination module is also used to: determine the basic information and order of multiple game behaviors of the target game account based on simplified operation data; the basic information includes one or more of the following: time, number of times, average interval, and relative map coordinates corresponding to the game behavior; generate absolute position codes based on the basic information and order of multiple game behaviors; the absolute position codes indicate the absolute order of multiple game behaviors; obtain the correlation of game behaviors; generate relative position codes based on the basic information corresponding to correlated game behaviors; the relative position codes indicate the relative positions between correlated game behaviors; and determine the basic information, absolute position codes, and relative position codes of game behaviors as timing operation parameters of the target game account.

[0137] The aforementioned device also includes a black-box model training module, used for: determining training data from a preset sample set; the training data includes positive and negative samples; positive samples include operation data determined by a preset algorithm to have cheating behavior; negative samples include operation data determined by a preset algorithm not to have cheating behavior; inputting the positive and negative samples into an initial model to obtain the processing result output by the initial model; the initial model is built based on a bidirectional long short-term memory network; determining the loss value of the initial model based on the processing result using an adaptive moment estimation optimizer; updating the model parameters of the initial model based on the loss value; continuing to execute the step of determining training data from the preset sample data until the loss value converges, and determining the initial model after the loss value converges as the trained black-box model.

[0138] The aforementioned cheat behavior determination module is also used to: input basic operation features and time-series operation features into a pre-trained cheat behavior determination model; process the basic operation features and time-series operation features through the cheat behavior determination model to obtain probability parameters of the target game account sending cheat behavior; the cheat behavior determination model is built based on the Boosting algorithm; and determine whether the target game account has engaged in cheat behavior based on the probability parameters.

[0139] The aforementioned device further includes: a contribution parameter determination module, used to determine the contribution parameters of the basic operation features and time sequence operation features of the model in the probability parameters of sending cheating behavior in the target game account through cheating behavior; and a suspicion map generation module, used to generate a suspicion map corresponding to the probability parameters based on the contribution parameters of the basic operation features and time sequence operation features.

[0140] This embodiment also provides an electronic device, including a processor and a memory. The memory stores machine-executable instructions that can be executed by the processor. The processor executes the machine-executable instructions to implement the aforementioned method for detecting game cheating behaviors, for example:

[0141] The system acquires the target game account's operational data within the game environment; inputs this data into a pre-defined white-box model, processes it, and determines the target game account's basic operational characteristics; the white-box model has a pre-defined data processing algorithm; the basic operational characteristics include: the target game account's real-time operational characteristics and / or static attribute characteristics; inputs the operational data and scene information from the game environment into a pre-defined black-box model, processes it, and determines the target game account's temporal operational characteristics; the black-box model is trained using a pre-defined neural network model; based on the basic operational characteristics and temporal operational characteristics, it determines whether the target game account has engaged in cheating behavior.

[0142] The above method uses white-box and black-box models to determine the basic operational characteristics and temporal operational characteristics of the target game account, respectively, and then determines whether the target game account has engaged in cheating behavior. This makes the process of detecting game cheating behavior both interpretable and robust, and the detection accuracy is high.

[0143] Optionally, the aforementioned basic operational characteristics include the real-time operational characteristics of the target game account; the real-time operational characteristics include click operational characteristics; the step of processing the operational data through a white-box model to determine the basic operational characteristics of the target game account includes: using a white-box model based on the Pearson correlation coefficient to determine the click operational data corresponding to the target object in the game scene from the operational data; and determining the click operational characteristics of the target game account based on the click operational data corresponding to the target object in the game scene.

[0144] Optionally, the aforementioned click operation characteristics include the maximum number of clicks on the target object and the average click time on the target object; the target object includes multiple objects; the step of determining the click operation characteristics of the target game account based on the click operation data corresponding to the target objects in the game scene includes: for each target object in the game scene, determining the number of click operations corresponding to the target object based on the target object and the corresponding click operation data; determining the maximum number of click operations among multiple target objects as the maximum number of clicks for the target game account; for each target object in the game scene, determining the click time corresponding to the target object based on the operation time of the target object and the corresponding click operation data; and determining the average of the sum of the click times of multiple target objects as the average click time for the target game account.

[0145] Optionally, the aforementioned basic operational features include the static attribute features of the target game account; the static attribute features include pathfinding operation features; the pathfinding operation features are used to characterize: the degree of repetition of the movement path of the target game account in the game scene; the steps of processing the operation data through a white-box model to determine the basic operational features of the target game account include: obtaining movement path data in the operation data through a white-box model; identifying repetitive sub-path data from the movement path data; and determining the pathfinding operation features of the target game account based on the length and repetition count of the sub-path data.

[0146] Optionally, the aforementioned basic operational characteristics include the static attribute characteristics of the target game account; the static attribute characteristics include task time characteristics; the step of processing the operational data through a white-box model to determine the basic operational characteristics of the target game account includes: determining the operational data corresponding to the target task in the game scene from the operational data through a white-box model; determining the execution time of the target task based on the operational data corresponding to the target task; and determining the task time characteristics of the target game account based on the execution time of the target task.

[0147] Optionally, the above execution time includes the duration of at least one execution of the target task; the step of determining the task time characteristics of the target game account based on the execution time of the target task includes: determining the variance of the execution time based on the duration of the execution of the target task; and determining the ratio of the number of executions of the target task to the variance of the execution time as the task time characteristics of the target game account.

[0148] Optionally, the steps described above, which involve inputting operation data and scene information from the game scene into a preset black-box model, and processing the operation data and scene information from the game scene through the black-box model to determine the temporal operation characteristics of the target game account, include: preprocessing the operation data to obtain preprocessed operation data; inputting the preprocessed operation data and scene information from the game scene into a preset black-box model, and processing the preprocessed operation data and scene information through the black-box model to determine the temporal operation characteristics of the target game account.

[0149] Optionally, the above steps of preprocessing the operation data to obtain preprocessed operation data include: simplifying the operation data to obtain simplified operation data for the target game account; generating time-series operation parameters for the target game account based on the simplified operation data; and determining the simplified operation data and time-series operation parameters as the preprocessed operation data.

[0150] Optionally, the steps of simplifying the operation data to obtain simplified operation data for the target game account include: removing operation data that is not related to the game scene; merging duplicate data in the removed operation data to obtain simplified operation data for the target game account; and the duplicate data instructing the target game account to perform repetitive actions in the game scene.

[0151] Optionally, the step of generating time-series operation parameters for the target game account based on simplified operation data includes: determining basic information and the order of multiple game behaviors of the target game account based on the simplified operation data; the basic information includes one or more of the following: time, number of times, average interval, and relative map coordinates corresponding to the game behavior; generating absolute position codes based on the basic information and the order of multiple game behaviors; the absolute position codes indicate the absolute order of multiple game behaviors; obtaining the correlation between game behaviors; generating relative position codes based on the basic information corresponding to correlated game behaviors; the relative position codes indicate the relative positions between correlated game behaviors; and determining the basic information, absolute position codes, and relative position codes of the game behaviors as the time-series operation parameters for the target game account.

[0152] Optionally, the aforementioned black-box model is trained in the following manner: Training data is determined from a pre-defined sample set; the training data includes positive and negative samples; positive samples include operation data judged by a pre-defined algorithm as exhibiting cheating behavior; negative samples include operation data judged by a pre-defined algorithm as not exhibiting cheating behavior; the positive and negative samples are input into the initial model to obtain the processing result output by the initial model; the initial model is built based on a bidirectional long short-term memory network; the loss value of the initial model is determined based on the processing result using an adaptive moment estimation optimizer; the model parameters of the initial model are updated based on the loss value; the step of determining training data from the pre-defined sample data continues until the loss value converges, and the initial model after the loss value converges is determined as the trained black-box model.

[0153] Optionally, the steps for determining whether a target game account has engaged in cheating behavior based on basic operation features and time-series operation features include: inputting the basic operation features and time-series operation features into a pre-trained cheating behavior determination model; processing the basic operation features and time-series operation features through the cheating behavior determination model to obtain probability parameters of the target game account sending cheating behavior; establishing the cheating behavior determination model based on the Boosting algorithm; and determining whether the target game account has engaged in cheating behavior based on the probability parameters.

[0154] Optionally, the above method further includes: determining the contribution parameters of basic operation features and time-series operation features in the probability parameters of the target game account sending cheating behavior based on cheating behavior; and generating a suspicion map corresponding to the probability parameters based on the contribution parameters of basic operation features and time-series operation features.

[0155] See Figure 4 As shown, the electronic device includes a processor 100 and a memory 101. The memory 101 stores machine-executable instructions that can be executed by the processor 100. The processor 100 executes the machine-executable instructions to implement the above-mentioned method for detecting game cheating behavior.

[0156] Furthermore, Figure 4 The electronic device shown also includes a bus 102 and a communication interface 103, with the processor 100, the communication interface 103 and the memory 101 connected via the bus 102.

[0157] The memory 101 may include high-speed random access memory (RAM) or non-volatile memory, such as at least one disk storage device. Communication between this system network element and at least one other network element is achieved through at least one communication interface 103 (which can be wired or wireless), such as the Internet, wide area network, local area network, or metropolitan area network. The bus 102 may be an ISA bus, PCI bus, or EISA bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 4 The symbol is represented by a single double-headed arrow, but this does not mean that there is only one bus or one type of bus.

[0158] Processor 100 may be an integrated circuit chip with signal processing capabilities. In implementation, each step of the above method can be completed by the integrated logic circuitry in the hardware of processor 100 or by instructions in software form. Processor 100 may be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc.; it may also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software module can reside in a readily available storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 101, and the processor 100 reads the information from memory 101 and, in conjunction with its hardware, completes the steps of the method described in the foregoing embodiments.

[0159] This embodiment also provides a machine-readable storage medium storing machine-executable instructions. When the machine-executable instructions are called and executed by a processor, the machine-executable instructions cause the processor to implement the above-mentioned method for detecting game cheating behavior.

[0160] The present invention provides a method, apparatus, and electronic device for detecting game cheating behavior, including a computer-readable storage medium storing program code. The instructions included in the program code can be used to execute the methods described in the preceding method embodiments, for example:

[0161] The system acquires the target game account's operational data within the game environment; inputs this data into a pre-defined white-box model, processes it, and determines the target game account's basic operational characteristics; the white-box model has a pre-defined data processing algorithm; the basic operational characteristics include: the target game account's real-time operational characteristics and / or static attribute characteristics; inputs the operational data and scene information from the game environment into a pre-defined black-box model, processes it, and determines the target game account's temporal operational characteristics; the black-box model is trained using a pre-defined neural network model; based on the basic operational characteristics and temporal operational characteristics, it determines whether the target game account has engaged in cheating behavior.

[0162] The above method uses white-box and black-box models to determine the basic operational characteristics and temporal operational characteristics of the target game account, respectively, and then determines whether the target game account has engaged in cheating behavior. This makes the process of detecting game cheating behavior both interpretable and robust, and the detection accuracy is high.

[0163] Optionally, the aforementioned basic operational characteristics include the real-time operational characteristics of the target game account; the real-time operational characteristics include click operational characteristics; the step of processing the operational data through a white-box model to determine the basic operational characteristics of the target game account includes: using a white-box model based on the Pearson correlation coefficient to determine the click operational data corresponding to the target object in the game scene from the operational data; and determining the click operational characteristics of the target game account based on the click operational data corresponding to the target object in the game scene.

[0164] Optionally, the aforementioned click operation characteristics include the maximum number of clicks on the target object and the average click time on the target object; the target object includes multiple objects; the step of determining the click operation characteristics of the target game account based on the click operation data corresponding to the target objects in the game scene includes: for each target object in the game scene, determining the number of click operations corresponding to the target object based on the target object and the corresponding click operation data; determining the maximum number of click operations among multiple target objects as the maximum number of clicks for the target game account; for each target object in the game scene, determining the click time corresponding to the target object based on the operation time of the target object and the corresponding click operation data; and determining the average of the sum of the click times of multiple target objects as the average click time for the target game account.

[0165] Optionally, the aforementioned basic operational features include the static attribute features of the target game account; the static attribute features include pathfinding operation features; the pathfinding operation features are used to characterize: the degree of repetition of the movement path of the target game account in the game scene; the steps of processing the operation data through a white-box model to determine the basic operational features of the target game account include: obtaining movement path data in the operation data through a white-box model; identifying repetitive sub-path data from the movement path data; and determining the pathfinding operation features of the target game account based on the length and repetition count of the sub-path data.

[0166] Optionally, the aforementioned basic operational characteristics include the static attribute characteristics of the target game account; the static attribute characteristics include task time characteristics; the step of processing the operational data through a white-box model to determine the basic operational characteristics of the target game account includes: determining the operational data corresponding to the target task in the game scene from the operational data through a white-box model; determining the execution time of the target task based on the operational data corresponding to the target task; and determining the task time characteristics of the target game account based on the execution time of the target task.

[0167] Optionally, the above execution time includes the duration of at least one execution of the target task; the step of determining the task time characteristics of the target game account based on the execution time of the target task includes: determining the variance of the execution time based on the duration of the execution of the target task; and determining the ratio of the number of executions of the target task to the variance of the execution time as the task time characteristics of the target game account.

[0168] Optionally, the steps described above, which involve inputting operation data and scene information from the game scene into a preset black-box model, and processing the operation data and scene information from the game scene through the black-box model to determine the temporal operation characteristics of the target game account, include: preprocessing the operation data to obtain preprocessed operation data; inputting the preprocessed operation data and scene information from the game scene into a preset black-box model, and processing the preprocessed operation data and scene information through the black-box model to determine the temporal operation characteristics of the target game account.

[0169] Optionally, the above steps of preprocessing the operation data to obtain preprocessed operation data include: simplifying the operation data to obtain simplified operation data for the target game account; generating time-series operation parameters for the target game account based on the simplified operation data; and determining the simplified operation data and time-series operation parameters as the preprocessed operation data.

[0170] Optionally, the steps of simplifying the operation data to obtain simplified operation data for the target game account include: removing operation data that is not related to the game scene; merging duplicate data in the removed operation data to obtain simplified operation data for the target game account; and the duplicate data instructing the target game account to perform repetitive actions in the game scene.

[0171] Optionally, the step of generating time-series operation parameters for the target game account based on simplified operation data includes: determining basic information and the order of multiple game behaviors of the target game account based on the simplified operation data; the basic information includes one or more of the following: time, number of times, average interval, and relative map coordinates corresponding to the game behavior; generating absolute position codes based on the basic information and the order of multiple game behaviors; the absolute position codes indicate the absolute order of multiple game behaviors; obtaining the correlation between game behaviors; generating relative position codes based on the basic information corresponding to correlated game behaviors; the relative position codes indicate the relative positions between correlated game behaviors; and determining the basic information, absolute position codes, and relative position codes of the game behaviors as the time-series operation parameters for the target game account.

[0172] Optionally, the aforementioned black-box model is trained in the following manner: Training data is determined from a pre-defined sample set; the training data includes positive and negative samples; positive samples include operation data judged by a pre-defined algorithm as exhibiting cheating behavior; negative samples include operation data judged by a pre-defined algorithm as not exhibiting cheating behavior; the positive and negative samples are input into the initial model to obtain the processing result output by the initial model; the initial model is built based on a bidirectional long short-term memory network; the loss value of the initial model is determined based on the processing result using an adaptive moment estimation optimizer; the model parameters of the initial model are updated based on the loss value; the step of determining training data from the pre-defined sample data continues until the loss value converges, and the initial model after the loss value converges is determined as the trained black-box model.

[0173] Optionally, the steps for determining whether a target game account has engaged in cheating behavior based on basic operation features and time-series operation features include: inputting the basic operation features and time-series operation features into a pre-trained cheating behavior determination model; processing the basic operation features and time-series operation features through the cheating behavior determination model to obtain probability parameters of the target game account sending cheating behavior; establishing the cheating behavior determination model based on the Boosting algorithm; and determining whether the target game account has engaged in cheating behavior based on the probability parameters.

[0174] Optionally, the above method further includes: determining the contribution parameters of basic operation features and time-series operation features in the probability parameters of the target game account sending cheating behavior based on cheating behavior; and generating a suspicion map corresponding to the probability parameters based on the contribution parameters of basic operation features and time-series operation features.

[0175] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working process of the system and apparatus described above can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0176] Furthermore, in the description of the embodiments of the present invention, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to a fixed connection, a detachable connection, or an integral connection; they can refer to a mechanical connection or an electrical connection; they can refer to a direct connection or an indirect connection through an intermediate medium; and they can refer to the internal connection of two components. Those skilled in the art can understand the specific meaning of the above terms in the present invention based on the specific circumstances.

[0177] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0178] In the description of this invention, it should be noted that the terms "center," "upper," "lower," "left," "right," "vertical," "horizontal," "inner," and "outer," etc., indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings. They are used only for the convenience of describing the invention and for simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation. Therefore, they should not be construed as limitations on the invention. Furthermore, the terms "first," "second," and "third" are used for descriptive purposes only and should not be construed as indicating or implying relative importance.

[0179] Finally, it should be noted that the above embodiments are merely specific implementations of the present invention, used to illustrate the technical solutions of the present invention, and not to limit it. The scope of protection of the present invention is not limited thereto. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that any person skilled in the art can still modify or easily conceive of changes to the technical solutions described in the foregoing embodiments within the technical scope disclosed in the present invention, or make equivalent substitutions for some of the technical features; and these modifications, changes, or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting game cheating behavior, characterized in that, The method includes: Obtain the target game account's operation data in the game scene; The operation data is input into a preset white-box model, which processes the data to determine the basic operation characteristics of the target game account. The white-box model has a preset data processing algorithm. The basic operation characteristics include: real-time operation characteristics and / or static attribute characteristics of the target game account. The real-time operation characteristics include click operation characteristics; the click operation characteristics include the maximum number of clicks on the target object and the average click time on the target object. The static attribute characteristics include: pathfinding operation characteristics and / or task time characteristics. The pathfinding operation characteristics characterize the degree of repetition of the target game account's movement path in the game scene. The operation data and scene information in the game scene are input into a preset black box model. The black box model processes the operation data and scene information in the game scene to determine the temporal operation characteristics of the target game account. The black box model is trained by a preset neural network model. The basic operation features and the temporal operation features are input into a pre-trained cheat behavior determination model. The cheat behavior determination model processes the basic operation features and the temporal operation features to obtain the probability parameters of the target game account sending cheat behavior. Based on the probability parameters, it is determined whether the target game account has engaged in cheating behavior.

2. The method according to claim 1, characterized in that, The basic operational features include the real-time operational features of the target game account; The steps of processing the operational data using the white-box model to determine the basic operational characteristics of the target game account include: Based on the Pearson correlation coefficient, the white-box model is used to determine the click operation data corresponding to the target object in the game scene from the operation data; Based on the click operation data corresponding to the target object in the game scene, the click operation characteristics of the target game account are determined.

3. The method according to claim 2, characterized in that, The target objects include multiple ones; The step of determining the click operation characteristics of the target game account based on click operation data corresponding to the target object in the game scene includes: For each target object in the game scene, the number of click operations corresponding to the target object is determined based on the target object and the corresponding click operation data; Among multiple target objects, the maximum number of clicks is determined as the maximum number of clicks for the target game account; For each target object in the game scene, the click time corresponding to the target object is determined based on the operation time of the target object and the corresponding click operation data; The average of the sum of the click times of multiple target objects is determined as the average click time of the target game account.

4. The method according to claim 1, characterized in that, The basic operational features include the static attribute features of the target game account; the static attribute features include pathfinding operation features; The steps of processing the operational data using the white-box model to determine the basic operational characteristics of the target game account include: The motion path data in the operation data is obtained through the white-box model. Identify repetitive sub-path data from the motion path data; Based on the length and repetition count of the sub-path data, the pathfinding operation characteristics of the target game account are determined.

5. The method according to claim 1, characterized in that, The basic operational features include the static attribute features of the target game account; the static attribute features include the task time feature; The steps of processing the operational data using the white-box model to determine the basic operational characteristics of the target game account include: The white-box model is used to determine the operation data corresponding to the target task in the game scene from the operation data; Based on the operation data corresponding to the target task, the execution time of the target task is determined; Based on the execution time of the target task, the task time characteristics of the target game account are determined.

6. The method according to claim 5, characterized in that, The execution time includes the duration of at least one execution of the target task; The step of determining the task time characteristics of the target game account based on the execution time of the target task includes: Based on the time length for executing the target task, determine the variance of the execution time; The ratio of the number of times the target task is executed to the variance of the execution time is determined as the task time characteristic of the target game account.

7. The method according to claim 1, characterized in that, The steps of inputting the operation data and scene information in the game scene into a preset black-box model, and processing the operation data and scene information in the game scene through the black-box model to determine the temporal operation characteristics of the target game account include: The operation data is preprocessed to obtain preprocessed operation data; The preprocessed operation data and the scene information in the game scene are input into a preset black box model. The black box model processes the preprocessed operation data and the scene information to determine the temporal operation characteristics of the target game account.

8. The method according to claim 7, characterized in that, The step of preprocessing the operation data to obtain preprocessed operation data includes: The operation data is simplified to obtain simplified operation data for the target game account; Based on the simplified operation data of the target game account, the time-series operation parameters of the target game account are generated; The simplified operation data and the timing operation parameters are determined as the preprocessed operation data.

9. The method according to claim 8, characterized in that, The step of simplifying the operation data to obtain simplified operation data for the target game account includes: Remove operation data that is irrelevant to the game scene from the operation data; Duplicate data in the removed operation data is merged to obtain simplified operation data for the target game account; the duplicate data indicates that the target game account performs repetitive actions in the game scene.

10. The method according to claim 8, characterized in that, The step of generating time-series operation parameters for the target game account based on simplified operation data of the target game account includes: Based on the simplified operation data, basic information and the order of multiple game behaviors of the target game account are determined; the basic information includes one or more of the following: time, number of times, average interval, and relative map coordinates corresponding to the game behavior; Based on the basic information and order of the multiple game actions, an absolute position code is generated; the absolute position code indicates the absolute order of the multiple game actions. Obtain the correlation of the game behavior; Based on the basic information corresponding to related game behaviors, a relative position code is generated; the relative position code indicates the relative position between related game behaviors. The basic information of the game behavior, the absolute position code, and the relative position code are determined as the timing operation parameters of the target game account.

11. The method according to claim 1, characterized in that, The black-box model is trained in the following way: Training data is determined from a preset sample set; the training data includes positive samples and negative samples; the positive samples include operation data that is determined by a preset algorithm to have cheating behavior; the negative samples include operation data that is determined by a preset algorithm not to have cheating behavior. The positive and negative samples are input into the initial model to obtain the processing result output by the initial model; The initial model is based on a bidirectional long short-term memory network. The loss value of the initial model is determined by the adaptive moment estimation optimizer based on the processing results; The model parameters of the initial model are updated based on the loss value; Continue executing the step of determining training data from the preset sample data until the loss value converges, and determine the initial model after the loss value converges as the trained black box model.

12. The method according to claim 1, characterized in that, The model for determining cheat behavior is based on the Boosting algorithm.

13. The method according to claim 12, characterized in that, The method further includes: The contribution parameters of the basic operational features and the temporal operational features of the cheat behavior determination model to the probability parameters of the target game account sending cheat behavior are determined by the cheat behavior determination model. Based on the basic operational features and the contribution parameters of the temporal operational features, a suspicion map corresponding to the probability parameters is generated.

14. A device for detecting game cheating behavior, characterized in that, The device includes: The operation data acquisition module is used to acquire the operation data of the target game account in the game scene; A basic operation feature determination module is used to input the operation data into a preset white-box model, process the operation data through the white-box model, and determine the basic operation features of the target game account; wherein, the white-box model has a preset data processing algorithm; the basic operation features include: the real-time operation features and / or static attribute features of the target game account; the real-time operation features include click operation features; the click operation features include the maximum number of clicks on the target object and the average click time on the target object; the static attribute features include: pathfinding operation features and / or task time features; the pathfinding operation features are used to characterize: the degree of repetition of the movement path of the target game account in the game scene; The timing operation feature determination module is used to input the operation data and scene information in the game scene into a preset black box model, and process the operation data and scene information in the game scene through the black box model to determine the timing operation features of the target game account; wherein, the black box model is trained through a preset neural network model; The cheat behavior determination module is used to input the basic operation features and the temporal operation features into a pre-trained cheat behavior determination model, process the basic operation features and the temporal operation features through the cheat behavior determination model to obtain the probability parameters of the target game account sending cheat behavior; and determine whether the target game account has engaged in cheat behavior based on the probability parameters.

15. An electronic device, characterized in that, The method includes a processor and a memory, the memory storing machine-executable instructions that can be executed by the processor, the processor executing the machine-executable instructions to implement the game cheat behavior detection method according to any one of claims 1-13.

16. A machine-readable storage medium, characterized in that, The machine-readable storage medium stores machine-executable instructions, which, when invoked and executed by a processor, cause the processor to implement the game cheat behavior detection method according to any one of claims 1-13.

Images