External hanging detection method and device, computer device and storage medium

Abstract

Embodiments of the present application disclose an external plug-in detection method and device, computer equipment and a storage medium. Embodiments of the present application obtain object feature data of a target object, the object feature data including discrete features at multiple time points and continuous features at multiple time points; convert the object feature data into multiple combined features, the combined features including discrete features at any time point and continuous features at any time point; perform time sequence feature extraction on the multiple combined features based on attention weights to obtain target features; and perform linear transformation on the target features to obtain an external plug-in detection result. In the embodiments of the present application, the discrete features and the continuous features of the target object are combined, multi-dimensional information of the target object based on time sequence can be mined, the accuracy of external plug-in detection is improved, and the attention weights are introduced to extract more key and important information, so that the external plug-in detection result is more accurate.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to methods, devices, computer equipment, and storage media for detecting add-ons. Background Technology

[0002] Cheating is rampant in games, especially competitive games, and it damages the game's ecosystem and experience. Some players use cheats to gain advantages beyond what is normal, easily profiting in the game, breaking the rules of fair play, and affecting the gaming experience of normal players.

[0003] However, existing technologies typically detect cheats by directly detecting abnormal game data or commands. This method is easily countered, leading to missed detections and low accuracy. Summary of the Invention

[0004] This application provides a method, apparatus, computer equipment, and storage medium for detecting cheats, which can improve the accuracy of cheat detection.

[0005] This application provides a method for detecting cheating software, comprising: acquiring object feature data of a target object, the object feature data including discrete features at multiple time points and continuous features at the multiple time points; converting the object feature data into multiple combined features, the combined features including discrete features at any time point and continuous features at any time point; performing temporal feature extraction on the multiple combined features based on attention weights to obtain target features; and performing a linear transformation on the target features to obtain a cheating software detection result.

[0006] This application embodiment also provides a cheat detection device, comprising: an acquisition unit for acquiring object feature data of a target object, the object feature data including discrete features at multiple time points and continuous features at the multiple time points; a conversion unit for converting the object feature data into multiple combined features, the combined features including discrete features at any time point and continuous features at any time point; an extraction unit for performing temporal feature extraction on the multiple combined features based on attention weights to obtain target features; and a transformation unit for performing a linear transformation on the target features to obtain a cheat detection result.

[0007] This application also provides a computer device, including a processor and a memory, wherein the memory stores a plurality of instructions; the processor loads instructions from the memory to execute the steps in any of the plug-in detection methods provided in this application.

[0008] This application also provides a computer-readable storage medium storing a plurality of instructions adapted for loading by a processor to execute steps in any of the plug-in detection methods provided in this application.

[0009] This application embodiment can obtain object feature data of a target object, the object feature data including discrete features at multiple time points and continuous features at the multiple time points; convert the object feature data into multiple combined features, the combined features including discrete features at any time point and continuous features at any time point; extract time-series features from the multiple combined features based on attention weights to obtain target features; and perform linear transformation on the target features to obtain cheat detection results.

[0010] In this application, discrete and continuous features of the target object can be combined for temporal feature extraction, which can uncover multi-dimensional information about the target object based on time, thereby improving the accuracy of cheat detection. Furthermore, during the temporal feature extraction process, attention weights can be introduced to assign different weights to each part of the multiple combined features, in order to extract more critical and important information, thus making the obtained cheat detection results more accurate. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1a This is a schematic diagram of a scenario for the cheat detection method provided in the embodiments of this application;

[0013] Figure 1b This is a flowchart illustrating the plug-in detection method provided in the embodiments of this application;

[0014] Figure 2a This is a schematic diagram of the plug-in detection model provided in the embodiments of this application;

[0015] Figure 2b This is a flowchart illustrating an external plugin detection method provided in another embodiment of this application;

[0016] Figure 3 This is a schematic diagram of the external detection device provided in the embodiments of this application;

[0017] Figure 4 This is a schematic diagram of the structure of the computer device provided in the embodiments of this application. Detailed Implementation

[0018] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0019] This application provides a method, apparatus, computer equipment, and storage medium for detecting add-ons.

[0020] Specifically, the external detection device can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet, smart Bluetooth device, laptop, or personal computer (PC); the server can be a single server or a server cluster consisting of multiple servers.

[0021] In some embodiments, the cheat detection device can also be integrated into multiple electronic devices. For example, the cheat detection device can be integrated into multiple servers, and the cheat detection method of this application can be implemented by multiple servers.

[0022] In some embodiments, the server may also be implemented as a terminal.

[0023] For example, refer to Figure 1a This paper presents a schematic diagram of a cheat detection scenario, demonstrating how the system can implement cheat detection methods. This scenario may include a terminal, a server, and a network.

[0024] The server can acquire object feature data of the target object, including discrete features at multiple time points and continuous features at multiple time points. It then converts this object feature data into multiple combined features, including discrete features at any given time point and continuous features at any given time point. Based on attention weights, it performs temporal feature extraction on these combined features to obtain the target features. Finally, it performs a linear transformation on the target features to obtain the cheat detection result. The network can be used for data transmission between the server and the terminal. The network can be a wireless or wired network, such as a wireless local area network (WLAN), local area network (LAN), cellular network, 2D network, 3G network, 4G network, 5G network, etc. The terminal can collect game data and send it to the server via the network.

[0025] The following sections provide detailed descriptions. It should be noted that the order of the following embodiments is not intended to limit the preferred order of the embodiments. It is understood that in the specific embodiments of this application, user-related data such as target objects, object feature data, static features, real-time features, simulation features, and game data are involved. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use, and processing of related data must comply with the relevant laws, regulations, and standards of the relevant countries and regions.

[0026] In this embodiment, a method for detecting cheats is provided, such as... Figure 1b As shown, the specific process of this cheat detection method can be as follows:

[0027] 110. Obtain the object feature data of the target object. The object feature data includes discrete features at multiple time points and continuous features at multiple time points.

[0028] The target object refers to the object to be detected for cheating. For example, the target object can be one or more virtual objects in the game scene that can be controlled by the player (user) through operations on their terminal. These virtual objects can be any virtual object in the game scene or a specified virtual object. The type of target object can differ in different game scenes; for example, the target object can be the car operated by the player in a racing game, or the virtual character controlled by the player in a parkour game.

[0029] For example, in practical applications, all virtual objects controlled by the player in a game can be used as target objects to obtain the feature data of all objects in the game. In this case, depending on the needs, the cheat detection results for each virtual object can be output, or the cheat detection results for the entire game can be output; alternatively, one virtual object can be selected as the target object, that is, only the object feature data of that virtual object can be obtained, and the cheat detection results for that virtual object can be output.

[0030] In this context, a time point refers to a single instant in time, which can be understood as a point on a timeline. A time point can be determined based on a preset time interval or by being triggered by a preset event. For example, in a game, it can be divided into multiple time points at 10-second intervals, or the event that triggers a preset game event can be used as a time point. This preset game event can include game events such as releasing a skill, achieving a kill, or winning.

[0031] Discrete features and continuous features refer to features defined by their numerical values. For example, discrete features are those whose numerical values ​​can only be represented by natural numbers, while continuous features can only be statistically represented by units of measurement. Discrete features can be levels, IDs (identifiers), etc. Continuous features are those that can take any value within a range, such as numbers between [0,1]. n numbers can be taken as the numerical values ​​of a continuous feature. Continuous features are obtained through measurement or measurement methods. Continuous features can be speed, position, deflection angle, etc.

[0032] In some implementations, discrete features include at least one of the following: attribute features of the target object, object events, operational behavior features, etc.

[0033] For example, taking racing games as an example, discrete features can include static features (attribute features of the target object) such as player level, car ID, track ID, nitro ID, and car rating; real-time features related to vehicle events (object events) such as whether a collision or wall-scratching occurred; and real-time features related to player actions (action features) such as whether the player turned left or right, used a skill, or accelerated or braked. It can be understood that discrete features at any given time point include the player's level, car ID, track ID, nitro ID, and car rating at that time.

[0034] In some implementations, features related to the movement of the target object in the game scene can be collected as continuous features. Specifically, continuous features include scene motion features of the target object, which are features related to the movement of the target object in the virtual scene.

[0035] For example, taking racing games as an example, continuous features can include game data (scene motion features) generated by the vehicle's movement in the game scene, such as time, 3D velocity, 3D coordinates, and yaw angle. It can be understood that continuous features corresponding to any given time point include the time, 3D velocity, 3D coordinates, and yaw angle at that time.

[0036] Obviously, scene motion features are feature data collected from the motion of a target object in a virtual scene. If the target object is using cheats, the directly collected object feature data will deviate from the game data when cheats are present. This significant deviation in features will affect the accuracy of feature processing. Therefore, in some implementations, theoretical motion features can be added to continuous features to compensate for the deviation caused by scene motion features when cheats are present, thereby improving the accuracy of cheat detection. Specifically, continuous features also include theoretical motion features, and before obtaining the object feature data of the target object, the following steps are also included:

[0037] The theoretical motion characteristics are calculated from the scene motion characteristics of the target object.

[0038] Among them, theoretical motion features are feature data obtained by calculating the motion of the target object in the virtual scene.

[0039] For example, taking racing games as an example, since cheats typically gain an advantage by modifying vehicle speed, acceleration, displacement, and other characteristic values, theoretical three-dimensional speed, acceleration, and displacement characteristic values ​​can be calculated from the time and three-dimensional coordinates in the scene's motion characteristics in a background environment unaffected by cheats. These values ​​can then be used as theoretical motion characteristics. Therefore, continuous characteristics corresponding to any given time point include the scene's motion characteristics at that time point and the theoretical motion characteristics calculated from those scene motion characteristics.

[0040] In some implementations, scene motion features include first motion features and second motion features, and theoretical motion features can be calculated from the first motion features. The first motion features are less affected by external plugins compared to the second motion features. For example, time and three-dimensional coordinates in the scene motion features can be used as the first motion features, and three-dimensional velocity and deflection angle can be used as the second motion features.

[0041] In some implementations, the target game can be divided into multiple game segments, and the discrete and continuous features of the target object can be determined for each game segment. Feature segmentation allows for a better understanding and identification of feature-related characteristics, leading to more accurate feature recognition and improved accuracy in cheat detection. Specifically, the method for obtaining object feature data includes:

[0042] The target game corresponding to the target object is divided into multiple game segments according to the preset duration;

[0043] Based on the game data of any game segment, determine a set of object feature data corresponding to that game segment.

[0044] The preset duration refers to the duration set according to actual needs or application scenarios. For example, different preset durations can be set for different target games or the game duration of target games.

[0045] The target game can refer to the game that the target object participates in. For example, the game duration of the target game can include one or more games that the target object participates in, or it can include games within a certain time period.

[0046] For example, each game can be divided into segments of 600 frames (with a step size of 120 frames) to obtain multiple game segments of that game. For each game segment, the discrete and continuous features of the target objects in that game segment can be determined, which is a set of object feature data corresponding to that game segment.

[0047] In some implementations, each time point is the time point corresponding to a frame, that is, the discrete features of any time point include all the discrete features of the frame corresponding to that time point, and the continuous features of any time point include all the continuous features of the frame corresponding to that time point.

[0048] 120. Convert object feature data into multiple combined features, which include discrete features at any time point and continuous features at any time point.

[0049] For example, discrete features corresponding to multiple time points and continuous features corresponding to multiple time points in the object feature data can be cross-combined to obtain multiple combined features. For example, discrete features 1, discrete features 2, ..., discrete features n at time points 1 to n, and continuous features 1, continuous features 2, ..., continuous features n can be cross-combined to obtain the combined feature "discrete feature i, continuous feature j", where discrete feature i represents the discrete feature at time point i, and continuous feature j represents the continuous feature at time point j.

[0050] In some implementations, continuous and discrete features can be quantized separately using two feature processing channels. Appropriate quantization processes and parameters can be matched to the characteristics of the continuous and discrete features, improving the accuracy of the quantization process. On one hand, the dual channels isolate the quantization processes of continuous and discrete features; on the other hand, the dual channels allow for parallel execution of the quantization processes of continuous and discrete features, improving the efficiency of the quantization process. Specifically, the object feature data is converted into multiple combined features, including:

[0051] Through the first feature processing channel, the continuous features at multiple time points are subjected to the first quantization process to obtain the first features at multiple time points;

[0052] The discrete features at multiple time points are subjected to a second quantization process through the second feature processing channel to obtain the second features at multiple time points.

[0053] By combining the first feature at any given time point with the second feature at any given time point, multiple combined features can be obtained.

[0054] Here, the first feature processing channel and the first quantization process refer to the feature processing channel and quantization process corresponding to discrete features, while the second feature processing channel and the second quantization process refer to the feature processing channel and quantization process corresponding to continuous features. A feature processing channel is a channel used for quantization processing of features. Quantization processing refers to the process of data processing of features. Quantization processing may include, but is not limited to, regularization, embedding, and linear transformation.

[0055] For example, continuous feature 1, continuous feature 2, ..., continuous feature n at time points 1 to n are sequentially passed through the first feature processing channel for first quantization processing to obtain the first features at time points 1 to n. Discrete features 1, 2, ..., n at time points 1 to n can be sequentially passed through the second feature processing channel for second quantization processing to obtain the second features at time points 1 to n. Then, the first features at time points 1 to n and the second features at time points 1 to n are cross-combined to obtain multiple combined features, any of which can be characterized as in, This represents the first feature at time point i. This represents the second characteristic of time point j.

[0056] In some implementations, the first feature processing channel includes a BatchNorm layer, and the first quantization process includes regularizing the continuous features through the regularization layer. Since there are differences in the magnitude of feature values ​​of different types or time points in the continuous features (e.g., large numerical differences due to different units), regularization can be used to change the variance and mean position, removing the influence of units and making the continuous features more consistent with the distribution of real data.

[0057] In some implementations, the second feature processing channel includes an embedding layer, and the second quantization process includes mapping discrete features through the embedding layer to map the discrete features into vectors of a specified dimension.

[0058] In some implementations, the second feature processing channel further includes a reshape layer. When mapping discrete features through the embedding layer, the discrete features can be mapped into 4×4 vectors through a mapping subspace. Different features correspond to different mapping subspaces. The mapped vectors are then concatenated to obtain a tensor. Since the dimension of the features increases after mapping through the mapping subspace, the second quantization process can use the reshape layer to reshape the tensor output by the embedding layer. By reshaping, the feature dimension is reduced. The reshape layer can change the dimension of the input features without changing the data.

[0059] In some implementations, a linear layer is added after the regularization layer of the first feature processing channel and the reconstruction layer of the second feature processing channel. The linear layer performs a linear transformation on the outputs of the regularization and reconstruction layers, ensuring that the dimensions of the first and second features output by the first and second feature processing channels are consistent. For example, the formula for the first quantization is... in, c represents the first feature at time point i.i The formula for the second quantization process represents the continuous characteristic at time point i, BN() represents regularization, and Linear() represents linear transformation. in, d represents the second characteristic of time point j. j This represents the discrete characteristics at time point j. `embed()` represents mapping, `Reshape()` represents reconstruction, and `Linear()` represents linear transformation. A linear layer can be a fully connected layer.

[0060] It should be noted that before using the first feature processing channel and the second feature processing channel for quantization, a large amount of object feature data can be used to train the first feature processing channel and the second feature processing channel in advance, so that the first feature processing channel and the second feature processing channel can perform the first quantization and the second quantization to obtain combined features, thereby improving the matching degree between the quantization parameters of each layer of each feature processing channel and the feature characteristics.

[0061] 130. Based on attention weights, perform temporal feature extraction on multiple combined features to obtain the target feature.

[0062] Here, attention weights refer to the weights in the attention mechanism. The purpose of the attention mechanism is to perform linear weighting on all input features (vectors). Attention weights are obtained by calculating the importance of each position in the input feature sequence. This application does not limit the attention mechanism or attention weights used. For example, the attention weights used in this application can be attention weights from hard attention, key-value pair attention, multi-head attention, self-attention, or other attention mechanisms.

[0063] Among them, time series features refer to features related to time series.

[0064] For example, one or more of Convolutional Neural Networks (CNN), Recurrent Neural Networks (RNN), and Residual Shrinking Networks (RSN) can be used to extract temporal features from combined features. During temporal feature extraction, attention weights from any attention mechanism (attention network) can be introduced. These attention weights assign different weights to different parts of the multiple combined features to extract more critical and important information, thereby making the obtained cheat detection results more accurate. Furthermore, the embodiments of this application combine the discrete and continuous features of the target object before performing temporal feature extraction, which can uncover multi-dimensional information about the target object based on time, improving the accuracy of cheat detection.

[0065] In some implementations, a feature dropout layer can be used to discard combined features, and then, based on attention weights, temporal features can be extracted from the discarded combined features to obtain the target features corresponding to each time point. The feature dropout layer can avoid overfitting and improve the accuracy of feature extraction.

[0066] In some implementations, the discard rate of the feature discard layer can be set to 0.1.

[0067] For example, Long Short-Term Memory (LSTM) neural networks can be used to extract temporal features from combined features. The LSTM model is a special type of recurrent neural network (RNN). LSTM allows useful information to be passed to subsequent time steps while useless information is discarded by forgetting existing information and remembering new information. At each time step, it outputs a hidden state. Forgetting, remembering, and output are controlled by forgetting gates, input gates, and output gates calculated from the previous hidden state and the current input. Specifically, a sequence of multiple combined features can be input into the LSTM network. The forgetting gate controls the degree to which the previous unit state is forgotten, the input gate controls what new information is added, and the output gate controls how much of the current unit state is filtered out. Finally, the temporal features are output, which are then input into an attention network for attention processing using attention weights. The output is then used as the target feature.

[0068] Before using an LSTM network, it can be trained with a large amount of object feature data in advance so that the LSTM network can extract temporal features from the combined features and obtain the target features corresponding to each time point.

[0069] In some implementations, a Bidirectional Long Short-Term Memory (BiLSTM) neural network can be used to extract temporal features from the combined features, thereby enhancing the expressive power of the target feature by incorporating information preceding and following it. Specifically, based on attention weights, temporal feature extraction is performed on multiple combined features to obtain the target feature, including:

[0070] Forward encoding is performed on multiple combined features to obtain forward latent vectors;

[0071] Back-encode multiple combined features to obtain the back-latent vector;

[0072] The forward latent vector and the backward latent vector are concatenated to obtain the temporal features;

[0073] Based on attention weights, temporal features are weighted to obtain target features.

[0074] For example, a BiLSTM network is composed of a forward LSTM and a backward LSTM. A sequence of multiple combined features can be input into a BiLSTM. This sequence is forward-encoded by a forward LSTM, and the encoded result is then input into an attention network. Attention weights are applied to this network to obtain the forward latent vector corresponding to each combined feature. This sequence is then backward-encoded by a backward LSTM. The forward and backward encoded results are then concatenated to obtain the temporal features. For example, if the forward latent vectors are {hL0, hL1, hL2} and the backward latent vectors are {hR0, hR1, hR2}, concatenating them yields {[hL0, hR2], [hL1, hR1], [hL2, hR0]}, where [hL0, hR2] represents the temporal features, containing contextual information. These temporal features are then input into the attention network, where attention weights are applied to obtain the target features.

[0075] Specifically, temporal features can be extracted from the combined features using h = LSTM(e), where h represents the temporal features, e represents multiple combined features, and LSTM() represents a BiLSTM network. Then, an attention mechanism is added to the time dimension using s = Softmaxt(Wh) * h to automatically capture the time points of cheating, where Wh represents the attention weights, and Softmaxt() represents the softmax function in the attention mechanism. The softmax function maps the attention weights to values ​​in the (0,1) range, and these values ​​are accumulated to 1. By multiplying the mapped attention values ​​with the temporal features, the attention weights are applied to each part of the temporal features to extract more critical and important information, thus making the obtained cheat detection results more accurate.

[0076] In some implementations, multiple combined features are sorted according to the time points of their continuous and discrete features, forming a feature sequence that is input into an LSTM network for temporal feature extraction.

[0077] 140. Perform a linear transformation on the target features to obtain the cheat detection results.

[0078] For example, a linear layer can be used to perform a linear transformation on the target features, outputting a linear predicted value, which is then used as the cheat detection result. If the linear predicted value is higher than a preset threshold, the target object is considered to have cheats; if it is lower than or equal to the preset threshold, the target object is considered not to have cheats.

[0079] In some implementations, when dividing the target game into multiple game segments, the cheat rate can be determined for a set of object feature data corresponding to each game segment. Linear regression prediction is then performed on the cheat rates corresponding to all game segments to achieve an overall evaluation of the cheat rates across all game segments, thus improving the accuracy of cheat detection results. Specifically, there are multiple sets of object feature data. A linear transformation is performed on the target features to obtain cheat detection results, including:

[0080] By performing a linear transformation on the target features corresponding to any set of object feature data, the cheating rate corresponding to any set of object feature data can be obtained.

[0081] Regression prediction is performed on the cheating rate corresponding to all object feature data to obtain the cheat detection results.

[0082] Regression prediction refers to the method of fitting two or more variables linearly or nonlinearly to determine the quantitative relationship of interdependence between the variables. Regression prediction methods can include linear regression, logistic regression, multinomial regression, or stepwise regression, etc.

[0083] For example, for each set of object feature data in a game (target game), a cheat rate p corresponding to that game segment can be obtained by linear transformation of its corresponding objective function. i A set of object feature data corresponds to a game segment. Therefore, for the entire game, we can obtain a sequence p = [p1, p2, ..., pn] consisting of the cheat rates of n game segments. n The sequence can be regressed and predicted using a regression model, and the prediction results can be used as the cheat detection results.

[0084] In some implementations, the regression prediction method is linear regression. For example, a logistic regression (LR) model can be used to predict the cheat rate sequence of multiple game segments. The LR model is a linear binary classification model, and also a generalized linear regression model, which can calculate the probability of an event occurring under a certain sample feature. That is, the LR model can perform linear regression on the cheat rate sequence and output a probability between 0 and 1, which is used to characterize the probability of sending cheats in the target game. If the probability is higher than a preset threshold, the target is considered to have cheats; if it is lower than or equal to the preset threshold, the target is considered not to have cheats.

[0085] Before using linear layers for linear transformations and regression models for regression predictions, the linear layers and regression models can be trained in advance using a large amount of object feature data so that they can be used for linear transformations and regression predictions.

[0086] In some implementations, the training set containing a large amount of object feature data can be divided into a first sub-training set and a second sub-training set. The first sub-training set is used to train the first feature processing channel, the second feature processing channel, the LSTM, and the linear layer, while the second sub-training set is used to train the regression model. The amount of object feature data in the first sub-training set is greater than the amount of object feature data in the second sub-training set.

[0087] In some implementations, the target features corresponding to each set of object feature data can be linearly transformed and normalized to convert the target features into probability values, thereby obtaining a quantified cheating rate. Specifically, performing a linear transformation on the target features corresponding to any set of object feature data to obtain the cheating rate corresponding to any set of object feature data includes:

[0088] The predicted features are obtained by linearly transforming the target features corresponding to any set of object feature data;

[0089] Normalize the predicted features to obtain the cheating rate corresponding to any set of object feature data.

[0090] For example, a fully connected layer can be used to linearly transform the target features obtained from each set of object feature data. The fully connected layer can extract and integrate useful information through feature space transformation (linear transformation), and then add non-linear mapping using activation functions such as LeakyReLU to obtain predicted features. Then, a normalization layer uses the softmax function to normalize the predicted features, obtaining the linear predicted value (cheating rate) corresponding to each set of object feature data.

[0091] In some implementations, the length of the data sequence can be adjusted to meet a preset sequence length, increasing the consistency of the input regression prediction model data and thus improving the accuracy of the regression prediction. Specifically, performing a linear transformation on the target features to obtain the cheat detection results also includes:

[0092] If the data sequence does not meet the preset sequence length, the data length of the data sequence is adjusted so that regression prediction can be performed on the adjusted data sequence. The data sequence includes the cheating rate corresponding to all object feature data.

[0093] The preset sequence length can refer to the data length set according to the application scenario or actual needs. For example, the data length can be represented by the number of cheating rates in the data sequence, and the preset sequence length can refer to the preset number of cheating rates in the data sequence.

[0094] For example, because the duration of each game is different, the number of game segments in each game is also different. This results in different numbers of cheat rates in the data sequences obtained from different games, meaning the lengths of the data sequences from different games are not equal. A preset sequence length is defined as follows: if the number of cheat rates in the data sequence is greater than or equal to a first quantity M and less than or equal to a second quantity N, where N is greater than M, then the tail of the data sequence with a cheat rate greater than N can be truncated to meet the preset sequence length. Similarly, the tail of the data sequence with a cheat rate less than M can be padded with zeros to meet the preset sequence length.

[0095] The cheat detection scheme provided in this application can be applied to various game scenarios. For example, taking racing games as an example, the scheme obtains the object feature data of the target object, which includes discrete features at multiple time points and continuous features at multiple time points; it converts the object feature data into multiple combined features, which include discrete features at any time point and continuous features at any time point; based on attention weights, it performs temporal feature extraction on the multiple combined features to obtain the target features; and it performs a linear transformation on the target features to obtain the cheat detection result.

[0096] As can be seen from the above, the embodiments of this application combine the discrete and continuous features of the target object and then perform temporal feature extraction, which can uncover multi-dimensional information of the target object based on time sequence, thereby improving the accuracy of cheat detection. Furthermore, during the temporal feature extraction process, attention weights can be introduced to assign different weights to each part of multiple combined features, in order to extract more critical and important information, thus making the obtained cheat detection results more accurate.

[0097] The method described in the above embodiments will be further described in detail below.

[0098] In this embodiment, the method of this application embodiment will be described in detail using the detection of speed-up cheats applied to racing games as an example.

[0099] The cheat detection method in this application embodiment can be implemented using a cheat detection model, such as... Figure 2aAs shown, the cheat detection model includes a first feature processing channel, a second feature processing channel, a temporal feature extraction module, and a regression prediction module. The first feature processing channel includes a regularization (BatchNorm) layer and a linear layer; the second feature processing channel includes an embedding layer, a reshape layer, and a linear layer; the temporal feature extraction module includes a feature discarding layer, a bidirectional long short-term memory (Bi-LSTM) network, an attention network, and a linear layer (connected to a LeakyReLU activation function and a softmax function); the regression prediction module includes an LR model.

[0100] like Figure 2b As shown, the specific process of a cheat detection method is as follows:

[0101] 210. Divide a game into multiple game segments according to the preset duration.

[0102] For example, for a racing game where you want to detect the presence of cheats, you can divide the game into segments of 600 frames each (120 frames per step) to model each segment and perform a supervised automatic detection task for racing speed cheats on each segment.

[0103] 220. Based on the game data of any game segment, determine a set of object feature data corresponding to any game segment.

[0104] For example, for each game segment, game data for all players in that segment can be obtained. This game data includes, but is not limited to, static features and real-time features. Static features include player level, car ID, track ID, nitro ID, car level, etc. Real-time features include: time, 3D speed, 3D coordinates, yaw angle, whether there was wall scrambling, whether there was a collision, and player actions (whether there was a left or right turn, whether a skill was used, whether there was acceleration or braking).

[0105] Since both static and real-time features are available in real-time during the game and are calculated assuming no cheating, these features may be insufficient to reflect the classification task in reality if cheating is present. Therefore, for supervised automatic detection of racing game acceleration cheats, in addition to the baseline features (static and real-time features), simulated features (theoretical motion features) can be introduced to compensate for the bias. Simulated features can include velocity, acceleration, and displacement features calculated based on time and coordinates.

[0106] After acquiring static, real-time, and simulated features, these features can be categorized into discrete and continuous features based on their numerical characteristics. These discrete and continuous features then constitute the object feature data corresponding to the game segment. Discrete features can include player level, car ID, track ID, nitro ID, car tier, collision status, and player actions (whether they turn left or right, use a skill, or accelerate / brake). Continuous actions can include time, 3D velocity, 3D coordinates, deflection angle, and velocity, acceleration, and displacement features calculated based on time and coordinates.

[0107] To verify the impact of adding simulated features on the cheat detection effect in this application embodiment, this application embodiment also compares the effects of Method 1 (the method of this application is used when the object feature data only includes static features and real-time features) and Method 2 (the method of this application is used when the object feature data includes static features, real-time features and simulated features), as shown in Table 1 below:

[0108] Table 1

[0109]

[0110]

[0111] Table 1 shows test sets 1 and 2, which consist of object feature data collected at different time periods and on different tracks. As can be seen from Table 1, compared to Method 1 without simulated features, Method 2 with simulated features improves both the accuracy and recall of cheat detection, with an accuracy increase of 8 percentage points and a recall increase of approximately 6 percentage points.

[0112] 230. Through the first feature processing channel, the continuous features at multiple time points are subjected to the first quantization process to obtain the first features at multiple time points.

[0113] For example, a dual-channel approach can be used to input discrete and continuous features into the time-series feature extraction module. Continuous features are input through the first feature processing channel, while discrete features are input through the second feature channel.

[0114] Specifically, since continuous features have different dimensions, a regularization (BatchNorm) layer is added directly at the input (same as the first feature processing) to remove the influence of dimensions. For example, the i-th first feature is: in, This represents the continuous characteristics at time point i.

[0115] 240. Through the second feature processing channel, the discrete features at multiple time points are subjected to second quantization processing to obtain the second features at multiple time points.

[0116] For example, the input process for discrete features can be as follows: each feature is trained through an embedding subspace mapping and then concatenated. This leads to inconsistent dimensions, so a reshape layer is added to reduce the dimensionality, facilitating fusion and concatenation with the continuous feature input layer. Both continuous and discrete features need to pass through their respective linear layers to ensure consistent dimensions in the last dimension, facilitating modeling by the temporal feature extraction module. For example, the j-th second feature is: in, d represents the discrete characteristics at time point j. j This represents the discrete characteristics at time point j. `embed()` represents mapping, `Resh()` represents reconstruction, and `Linear()` represents linear transformation. A linear layer can be a fully connected layer.

[0117] 250. Combine the first feature at any time point with the second feature at any time point to obtain multiple combined features.

[0118] For example, the combined feature obtained by concatenating the first and second features can be...

[0119] 260. Using the temporal feature extraction module, based on attention weights, temporal feature extraction is performed on multiple combined features to obtain the target feature.

[0120] For example, the temporal feature extraction module can be in the form of BiLSTM+attention. The first feature processing channel, the second feature processing channel, and the temporal feature extraction module can be trained in advance using the first sub-training set, and then the trained first feature processing channel, second feature processing channel, and temporal feature extraction module can be used in the processing steps 230 to 260.

[0121] Specifically, after the first and second features are concatenated after dual-channel processing, the time series relationship h = LSTM(e) is modeled by a bidirectional LSTM layer. An attention mechanism is added in the time dimension to automatically capture the time point of cheating: s = Softmaxt(Wh)...h, thus obtaining the target features.

[0122] 270. By using the time-series feature extraction module, the target features corresponding to any set of object feature data are linearly transformed to obtain the cheating rate corresponding to any set of object feature data.

[0123] For example, for the input target features, a linear layer (using LeakyReLU activation function) can be added, and finally a softmax layer can be connected to predict the probability of cheating in each game segment, so that each game segment can get a time series score.

[0124] 280. By using the regression prediction module, the cheat rate corresponding to all game segments is regressed and predicted to obtain the cheat detection results.

[0125] For example, the regression prediction module can be an LR (Logistic Regression) model. The LR model can be pre-trained using a second sub-training set, and then the trained LR model can be used to predict cheating in the global sequence (all game segments) based on the score sequence of each game. The amount of object feature data in the first sub-training set is greater than the amount of object feature data in the second sub-training set.

[0126] Specifically, each game segment, after passing through the LSTM module, yields a cheat probability p. i For the entire game, the sequence of cheat scores for each segment can be obtained as p = [p1, p2, ... p]. n For sequences whose lengths differ from the preset length, sequences that are too short are padded with draw points, while sequences that are too long are truncated. Finally, the probability of cheating in each game can be determined.

[0127] As shown above, in the detection of speed-up cheats in racing games, this application proposes a two-stage cheat rate prediction method based on a temporal feature extraction module and a regression prediction module, which can effectively improve the accuracy and recall of cheat detection. In the first stage, simulated speed and acceleration features are added during feature extraction to compensate for the bias in other features caused by cheats. A continuous and discrete dual-channel feature concatenation method is used in the modeling process, and a bidirectional LSTM and attention mechanism are used to effectively capture abnormal sequences. In the second stage, the scores of each game segment are used as features to train the LR model. Finally, the method with simulated features shows improved accuracy and recall compared to the method without simulated features, with an 8-point improvement in accuracy and a 6-point improvement in recall.

[0128] To better implement the above methods, this application also provides an external plug-in detection device, which can be integrated into an electronic device, such as a terminal or server. The terminal can be a mobile phone, tablet computer, smart Bluetooth device, laptop computer, or personal computer; the server can be a single server or a server cluster composed of multiple servers.

[0129] For example, in this embodiment, the method of this application embodiment will be described in detail by taking the specific integration of the external detection device into the server as an example.

[0130] For example, such as Figure 3As shown, the external detection device may include an acquisition unit 310, a conversion unit 320, an extraction unit 330, and a transformation unit 340, as follows:

[0131] (I) Acquisition Unit 310

[0132] This is used to obtain object feature data of the target object. The object feature data includes discrete features at multiple time points and continuous features at multiple time points.

[0133] In some implementations, the acquisition unit 310 may specifically be used for:

[0134] The target game corresponding to the target object is divided into multiple game segments according to the preset duration;

[0135] Based on the game data of any game segment, determine a set of object feature data corresponding to that game segment.

[0136] In some implementations, the continuous features include scene motion features of the target object and theoretical motion features. The scene motion features are features related to the motion of the target object in the virtual scene. The acquisition unit 310 can also be used for:

[0137] The theoretical motion characteristics are calculated from the scene motion characteristics of the target object.

[0138] (II) Conversion Unit 320

[0139] This is used to convert object feature data into multiple combined features, which include discrete features at any time point and continuous features at any time point.

[0140] In some implementations, the conversion unit 320 may specifically be used for:

[0141] Through the first feature processing channel, the continuous features at multiple time points are subjected to the first quantization process to obtain the first features at multiple time points;

[0142] The discrete features at multiple time points are subjected to a second quantization process through the second feature processing channel to obtain the second features at multiple time points.

[0143] By combining the first feature at any given time point with the second feature at any given time point, multiple combined features can be obtained.

[0144] (III) Extraction Unit 330

[0145] This is used to extract temporal features from multiple combined features based on attention weights, thereby obtaining the target feature.

[0146] In some implementations, the extraction unit 330 may specifically be used for:

[0147] Based on attention weights, multiple combined features are forward encoded to obtain forward latent vectors;

[0148] Based on attention weights, multiple combined features are backward encoded to obtain backward latent vectors;

[0149] The forward latent vector and the backward latent vector are concatenated to obtain the temporal features;

[0150] Based on attention weights, temporal features are weighted to obtain target features.

[0151] (iv) Transformation Unit 340

[0152] This is used to perform a linear transformation on the target features to obtain the cheat detection results.

[0153] In some implementations, the transformation unit 340 may specifically be used for:

[0154] By performing a linear transformation on the target features corresponding to any set of object feature data, the cheating rate corresponding to any set of object feature data can be obtained.

[0155] Regression prediction is performed on the cheating rate corresponding to all object feature data to obtain the cheat detection results.

[0156] In some implementations, a linear transformation is performed on the target features corresponding to any set of object feature data to obtain the cheating rate corresponding to any set of object feature data, including:

[0157] The predicted features are obtained by linearly transforming the target features corresponding to any set of object feature data;

[0158] Normalize the predicted features to obtain the cheating rate corresponding to any set of object feature data.

[0159] In some embodiments, the transformation unit 340 can also be used for:

[0160] If the data sequence does not meet the preset sequence length, the data length of the data sequence is adjusted so that regression prediction can be performed on the adjusted data sequence. The data sequence includes the cheating rate corresponding to all object feature data.

[0161] In practice, each of the above units can be implemented as an independent entity or can be arbitrarily combined to be implemented as the same or several entities. For the specific implementation of each of the above units, please refer to the previous method embodiments, which will not be repeated here.

[0162] Therefore, the embodiments of this application can combine the discrete and continuous features of the target object and then perform temporal feature extraction, thereby mining multi-dimensional information of the target object based on time sequence and improving the accuracy of cheat detection. Furthermore, during the temporal feature extraction process, attention weights can be introduced to assign different weights to each part of multiple combined features, in order to extract more critical and important information, thus making the obtained cheat detection results more accurate.

[0163] Accordingly, this application also provides a computer device, which can be a terminal or a server. The terminal can be a smartphone, tablet computer, laptop computer, touch screen, game console, personal computer, personal digital assistant (PDA) and other terminal devices.

[0164] like Figure 4 As shown, Figure 4 This is a schematic diagram of the structure of a computer device provided in an embodiment of this application. The computer device 400 includes a processor 410 with one or more processing cores, a memory 420 with one or more computer-readable storage media, and a computer program stored in the memory 420 and executable on the processor. The processor 410 is electrically connected to the memory 420. Those skilled in the art will understand that the computer device structure shown in the figure does not constitute a limitation on the computer device, and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0165] The processor 410 is the control center of the computer device 400. It connects various parts of the computer device 400 through various interfaces and lines. By running or loading software programs and / or modules stored in the memory 420, and calling data stored in the memory 420, it performs various functions of the computer device 400 and processes data, thereby monitoring the computer device 400 as a whole.

[0166] In this embodiment, the processor 410 in the computer device 400 loads the instructions corresponding to the processes of one or more applications into the memory 420 according to the following steps, and the processor 410 runs the applications stored in the memory 420 to achieve various functions:

[0167] The process involves: acquiring object feature data of the target object, including discrete features at multiple time points and continuous features at multiple time points; converting the object feature data into multiple combined features, including discrete features at any time point and continuous features at any time point; extracting temporal features from the multiple combined features based on attention weights to obtain the target features; and performing a linear transformation on the target features to obtain the cheat detection result.

[0168] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0169] Optional, such as Figure 4 As shown, the computer device 400 also includes: a touch screen display 430, a radio frequency circuit 440, an audio circuit 450, an input unit 460, and a power supply 470. The processor 410 is electrically connected to the touch screen display 430, the radio frequency circuit 440, the audio circuit 450, the input unit 460, and the power supply 470. Those skilled in the art will understand that... Figure 4 The computer device structure shown does not constitute a limitation on the computer device and may include more or fewer components than shown, or combine certain components, or have different component arrangements.

[0170] The touch display screen 430 can be used to display a graphical user interface (GUI) and receive operation commands generated by the user interacting with the GUI. The touch display screen 430 may include a display panel and a touch panel. The display panel can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces of the computer device. These graphical user interfaces can be composed of graphics, text, icons, video, and any combination thereof. Optionally, the display panel can be configured using a liquid crystal display (LCD), organic light-emitting diode (OLED), or other similar technologies. The touch panel can be used to collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near the touch panel), generate corresponding operation commands, and execute the corresponding program according to the operation commands. Optionally, the touch panel may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch location and the signal generated by the touch operation, transmitting the signal to the touch controller. The touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to the processor 410. It can also receive and execute commands from the processor 410. The touch panel can cover the display panel. When the touch panel detects a touch operation on or near it, it transmits the information to the processor 410 to determine the type of touch event. Subsequently, the processor 410 provides corresponding visual output on the display panel based on the type of touch event. In this embodiment, the touch panel and display panel can be integrated into the touch display screen 430 to achieve input and output functions. However, in some embodiments, the touch panel and display panel can be implemented as two independent components to achieve input and output functions. That is, the touch display screen 430 can also be used as part of the input unit 460 to achieve input functions.

[0171] In this embodiment, a game application is executed by processor 410 to generate a graphical user interface (GUI) on touch display screen 430. The virtual scene on the GUI includes at least one skill control area, and the skill control area includes at least one skill control. The touch display screen 430 is used to present the GUI and receive operation commands generated by the user interacting with the GUI.

[0172] The radio frequency circuit 440 can be used to transmit and receive radio frequency signals to establish wireless communication with network devices or other computer devices, and to transmit and receive signals with network devices or other computer devices.

[0173] Audio circuitry 450 can be used to provide an audio interface between a user and a computer device via a speaker and a microphone. Audio circuitry 450 can convert received audio data into electrical signals and transmit them to the speaker, where the speaker converts them into sound signals for output. Conversely, the microphone converts collected sound signals into electrical signals, which are then received by audio circuitry 450, converted back into audio data, and then processed by processor 410 before being transmitted via radio frequency circuitry 440 to, for example, another computer device, or output to memory 420 for further processing. Audio circuitry 450 may also include an earphone jack to facilitate communication between peripheral headphones and the computer device.

[0174] The input unit 460 can be used to receive input numbers, characters, or user characteristic information (such as fingerprints, iris, facial information, etc.), and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to user settings and function control.

[0175] Power supply 470 is used to supply power to various components of computer device 400. Optionally, power supply 470 can be logically connected to processor 410 through a power management system, thereby enabling functions such as charging, discharging, and power consumption management through the power management system. Power supply 470 may also include one or more DC or AC power supplies, recharging systems, power fault detection circuits, power converters or inverters, power status indicators, and other arbitrary components.

[0176] although Figure 4 As not shown in the diagram, computer equipment 400 may also include a camera, sensor, wireless fidelity module, Bluetooth module, etc., which will not be described in detail here.

[0177] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0178] As can be seen from the above, the computer device provided in this embodiment can combine the discrete and continuous features of the target object, and can mine multi-dimensional information of the target object based on time series, thereby improving the accuracy of cheat detection. The introduced attention weight can extract more critical and important information, so as to make the obtained cheat detection results more accurate.

[0179] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be performed by instructions, or by instructions controlling related hardware. These instructions can be stored in a computer-readable storage medium and loaded and executed by a processor.

[0180] Therefore, embodiments of this application provide a computer-readable storage medium storing a plurality of computer programs that can be loaded by a processor to execute the steps of any of the plug-in detection methods provided in embodiments of this application. For example, the computer program can execute the following steps:

[0181] The process involves: acquiring object feature data of the target object, including discrete features at multiple time points and continuous features at multiple time points; converting the object feature data into multiple combined features, including discrete features at any time point and continuous features at any time point; extracting temporal features from the multiple combined features based on attention weights to obtain the target features; and performing a linear transformation on the target features to obtain the cheat detection result.

[0182] For details on the implementation of each of the above operations, please refer to the previous examples, which will not be repeated here.

[0183] The storage medium may include: read-only memory (ROM), random access memory (RAM), disk or optical disk, etc.

[0184] Since the computer program stored in the storage medium can execute the steps in any of the plug-in detection methods provided in the embodiments of this application, the beneficial effects that any of the plug-in detection methods provided in the embodiments of this application can achieve can be realized. For details, please refer to the previous embodiments, which will not be repeated here.

[0185] The foregoing has provided a detailed description of an external plug-in detection method, apparatus, computer device, and storage medium provided in the embodiments of this application. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A method for detecting cheat software, characterized in that, include: Obtain object feature data of a target object, wherein the object feature data includes discrete features at multiple time points and continuous features at multiple time points, and the object feature data consists of multiple sets; The object feature data is converted into multiple combined features, the combined features including discrete features at any time point and continuous features at any time point; Based on attention weights, temporal feature extraction is performed on the multiple combined features to obtain the target feature; The target features are linearly transformed to obtain the cheat detection results; The step of performing a linear transformation on the target features to obtain the cheat detection result includes: By performing a linear transformation on the target features corresponding to any set of object feature data, the cheating rate corresponding to any set of object feature data is obtained. Regression prediction is performed on the cheating rate corresponding to all the object feature data to obtain the cheat detection result; The method for obtaining the object feature data includes: According to a preset duration, the target game corresponding to the target object is divided into multiple game segments; Based on the game data of any one of the game segments, determine a set of object feature data corresponding to any one of the game segments; The continuous features include the scene motion features and theoretical motion features of the target object. The scene motion features are features related to the motion of the target object in the virtual scene. Before obtaining the object feature data of the target object, the process further includes: The theoretical motion features are calculated from the scene motion features of the target object.

2. The external plug-in detection method as described in claim 1, characterized in that, The step of performing a linear transformation on the target features corresponding to any set of object feature data to obtain the cheating rate corresponding to any set of object feature data includes: The target features corresponding to any set of object feature data are linearly transformed to obtain the predicted features; The predicted features are normalized to obtain the cheating rate corresponding to any set of object feature data.

3. The external plug-in detection method as described in claim 1, characterized in that, The step of performing a linear transformation on the target features to obtain the cheat detection result further includes: If the data sequence does not meet the preset sequence length, the data length of the data sequence is adjusted so that regression prediction can be performed on the adjusted data sequence. The data sequence includes the cheating rate corresponding to all the object feature data.

4. The external plug-in detection method as described in claim 1, characterized in that, The step of converting the object feature data into multiple combined features includes: The first feature processing channel is used to perform a first quantization process on the continuous features of the multiple time points to obtain the first features of the multiple time points. The discrete features at the multiple time points are subjected to a second quantization process through the second feature processing channel to obtain the second features at the multiple time points. The first feature at any given time point and the second feature at any given time point are combined to obtain multiple combined features.

5. The method for detecting external plugins as described in any one of claims 1 to 4, characterized in that, The step of extracting temporal features from the multiple combined features based on attention weights to obtain target features includes: The multiple combined features are forward encoded to obtain the forward latent vector; The multiple combined features are back-encoded to obtain the back-latent vector; The forward latent vector and the backward latent vector are concatenated to obtain the temporal features; Based on attention weights, the temporal features are weighted to obtain the target features.

6. An external detection device, characterized in that, include: An acquisition unit is used to acquire object feature data of a target object. The object feature data includes discrete features at multiple time points and continuous features at multiple time points. The object feature data consists of multiple sets. A conversion unit is used to convert the object feature data into multiple combined features, the combined features including discrete features at any time point and continuous features at any time point; The extraction unit is used to extract temporal features from the multiple combined features based on attention weights to obtain the target features; The transformation unit is used to perform a linear transformation on the target features corresponding to any set of object feature data to obtain the cheating rate corresponding to the any set of object feature data; and to perform regression prediction on the cheating rates corresponding to all object feature data to obtain the cheat detection result. The acquisition unit is specifically used to divide the target game corresponding to the target object into multiple game segments according to a preset duration; and to determine a set of object feature data corresponding to any one of the game segments based on the game data of any one of the game segments. The continuous features include the scene motion features and theoretical motion features of the target object. The scene motion features are features related to the motion of the target object in the virtual scene. The acquisition unit is also used to calculate the theoretical motion features from the scene motion features of the target object.

7. A computer device, characterized in that, The device includes a processor and a memory, the memory storing multiple instructions; the processor loads instructions from the memory to execute the steps in the external device detection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a plurality of instructions adapted for loading by a processor to perform the steps of the cheat detection method according to any one of claims 1 to 5.

Images