A data processing method and apparatus

Abstract

The application provides a data processing method and related device. The method comprises the following steps: first, obtaining attribute statistical data, behavior sequence data and binding information of a target object; then, taking the attribute statistical data as the input of a statistical feature fusion network, outputting an attribute feature vector; taking the behavior sequence data as the input of a sequence feature extraction network, outputting a sequence feature vector; taking the attribute feature vector and the sequence feature vector as the input of a threshold network, outputting an object feature vector; then, taking the binding information and the object feature vector as the input of a binding relationship graph attention network, outputting a binding information vector; finally, taking the object feature vector and the binding information vector as the input of a multi-source feature fusion network, outputting a classification prediction result of whether the target object is abnormal. The method provided by the application improves the accuracy of target object anomaly recognition.

Description

Technical Field

[0001] This application relates to the field of artificial intelligence technology, and in particular to a data processing method and apparatus. Background Technology

[0002] Users manipulate applications through script code or plug-ins to obtain assets, virtual equipment, or upgrade application objects. Such cheating targets are also known as black market objects. Black market objects can cause unfair situations for other users in the program and also cause certain economic losses to the application development company.

[0003] Currently, the common methods for identifying malicious actors mainly rely on rules. For example, daily online time and weekly online days are used as identification criteria. If an actor's cumulative weekly online time exceeds 150 hours and daily online time exceeds 20 hours, then the actor is identified as a malicious actor. However, this method relies too heavily on key features and experience. Malicious actors can use their experience to circumvent the rules and continue their cheating activities. Therefore, the accuracy of identifying malicious actors based on rules is relatively low. Summary of the Invention

[0004] This application provides a data processing method and related apparatus. By using a statistical feature fusion network, a sequence feature extraction network, and a binding relationship graph attention network to calculate elements such as attribute statistical data, behavioral sequence data, and binding information, the method obtains the classification prediction result of the target object, thereby determining whether the target object is abnormal and improving the accuracy of target object anomaly identification.

[0005] One aspect of this application provides a data processing method, comprising:

[0006] Obtain the attribute statistics, behavior sequence data and binding information of the target object. The attribute statistics are used to represent the data obtained after performing relevant attribute statistics on the target object within a preset time. The behavior sequence data are used to represent the data generated based on the target object's target behavior within a preset time.

[0007] The attribute statistics data are used as input to the statistical feature fusion network, and the statistical feature fusion network outputs attribute feature vectors.

[0008] The behavioral sequence data is used as input to the sequence feature extraction network, which then outputs a sequence feature vector.

[0009] The attribute feature vector and sequence feature vector are used as inputs to the threshold network, and the threshold network outputs the object feature vector.

[0010] The binding information and object feature vectors are used as input to the binding relationship graph attention network, and the binding information vector is output through the binding relationship attention network.

[0011] The object feature vector and binding information vector are used as inputs to a multi-source feature fusion network, which outputs the classification prediction result of the target object.

[0012] Another aspect of this application provides a data processing apparatus, comprising:

[0013] The target object data acquisition module is used to acquire the target object's attribute statistics, behavior sequence data and binding information. The attribute statistics are used to represent the data obtained after performing relevant attribute statistics on the target object within a preset time. The behavior sequence data is used to represent the data generated based on the target object's target behavior within a preset time.

[0014] The statistical feature fusion network module is used to take attribute statistics data as input to the statistical feature fusion network and output attribute feature vectors through the statistical feature fusion network.

[0015] The sequence feature extraction network module is used to take behavioral sequence data as input to the sequence feature extraction network and output a sequence feature vector through the sequence feature extraction network.

[0016] The threshold network module is used to take attribute feature vectors and sequence feature vectors as input to the threshold network, and output the object feature vector through the threshold network;

[0017] The binding relationship graph attention network module is used to take binding information and object feature vectors as input to the binding relationship graph attention network, and output the binding information vector through the binding relationship attention network;

[0018] The multi-source feature fusion network module is used to take the object feature vector and binding information vector as input to the multi-source feature fusion network, and output the classification prediction result of the target object through the multi-source feature fusion network.

[0019] In another implementation of this application embodiment, the statistical feature fusion network includes a feature mapping layer and a feature cross layer;

[0020] The statistical feature fusion network module is also used for:

[0021] Generate attribute feature sub-vectors based on the data characteristics and attribute statistics of the attribute statistics.

[0022] The attribute feature vector is used as the input of the feature mapping layer, and the first-order attribute feature vector is output through the feature mapping layer. The feature mapping layer is used to add the corresponding elements in the attribute feature vector.

[0023] The attribute feature vectors are used as input to the feature cross layer, and the second-order attribute feature vectors are output through the feature cross layer. The feature cross layer is used to multiply corresponding elements in the attribute feature vectors and add the results of the corresponding element-wise multiplication.

[0024] The attribute feature vector is obtained by concatenating the first-order sub-vector of the attribute feature with the second-order sub-vector of the attribute feature.

[0025] In another implementation of this application embodiment, the sequence feature extraction network includes convolutional layers and feature filtering layers;

[0026] The sequence feature extraction network module is also used for:

[0027] The behavior sequence data is used as the input to the convolutional layer, and the convolutional layer outputs P behavior sequence segments, where each behavior sequence segment consists of at least one element from the behavior sequence data, and P is an integer greater than 1.

[0028] By merging the P behavioral sequence segments using the merge function, a behavioral convolution sequence is obtained.

[0029] The behavior convolution sequence is used as the input to the feature filtering layer, and the feature filtering layer outputs the sequence feature vector.

[0030] In another implementation of this application, the threshold network includes a feature fusion layer and a fully connected layer;

[0031] Threshold network modules are also used for:

[0032] The concatenated vector of attribute feature vector and sequence feature vector is used as the input of the feature fusion layer, and the concatenated feature vector is output through the feature fusion layer.

[0033] The concatenated feature vector is used as the input to the fully connected layer, and the fully connected layer outputs the object feature vector.

[0034] In another implementation of this application embodiment, the object binding information includes a user-associated object, and the user-associated object and the target object correspond to the same user information; the device binding information includes a device-associated object, and the device-associated object and the target object correspond to the same device information;

[0035] The binding graph attention network includes an object binding graph attention layer and a device binding graph attention layer;

[0036] The binding relationship graph attention network module is also used for:

[0037] The object binding information and object feature vector are used as input to the object binding graph attention layer, and the object binding vector is output through the object binding graph attention layer.

[0038] The device binding information and object feature vector are used as inputs to the device binding relationship graph attention layer, and the device binding vector is output through the device binding relationship graph attention layer.

[0039] The object binding vector and device binding vector are used as inputs to the binding fusion network, and the binding information vector is output through the binding fusion network.

[0040] The binding information vector includes: a secondary device binding global vector of the fused object binding information, and a secondary object binding global vector of the fused device binding information; the secondary device binding global vector of the fused object binding information is obtained based on the object binding information and the device binding vector, and the secondary object binding global vector of the fused device binding information is obtained based on the device binding information and the object binding vector.

[0041] In another implementation of this application embodiment, the multi-source feature fusion network includes a feature extraction layer and a binary classification layer;

[0042] The multi-source feature fusion network module is also used for:

[0043] The object feature vector and the binding information vector are concatenated to obtain the global vector of the target object.

[0044] The global vector is used as the input to the feature extraction layer, and the target feature vector is output by the feature extraction layer.

[0045] The target feature vector is used as the input to the binary classification layer, and the binary classification layer outputs the classification prediction result of the target object.

[0046] In another implementation of this application embodiment, the data processing apparatus further includes a training module, used for:

[0047] Obtain N first training datasets and M second training datasets. The N first training datasets correspond to N first training objects. Each first training dataset carries N labels, which are used to indicate whether the N first training objects are abnormal. Each first training dataset includes the first attribute statistics, the first row sequence data, and the first binding information of the first training object. The M second training datasets correspond to M second training objects. Each second training dataset includes the second attribute statistics, the second row sequence data, and the second binding information of the second training object. N and M are both integers greater than 1.

[0048] The statistical feature fusion network takes N first attribute statistics and M first attribute statistics as inputs and outputs N first attribute feature vectors and M second attribute feature vectors.

[0049] The sequence feature extraction network takes N first-row sequence data and M first-row sequence data as input and outputs N first-row feature vectors and M second-row feature vectors.

[0050] The N first attribute feature vectors and N first sequence feature vectors are used as inputs to the threshold network, and the threshold network outputs N first object feature vectors. The M second attribute feature vectors and M second sequence feature vectors are used as inputs to the threshold network, and the threshold network outputs M second object feature vectors.

[0051] The binding relationship graph attention network takes N first binding information, N first object feature vectors, M second binding information, and M second object feature vectors as input and outputs N first binding information vectors and M second binding information vectors. The N first binding information vectors are obtained from the N first binding information and N first object feature vectors, and the M second binding information vectors are obtained from the M second binding information and M second object feature vectors.

[0052] The network takes N first object feature vectors and N first binding information vectors as input to a multi-source feature fusion network, and outputs the classification prediction results of N first training objects through the multi-source feature fusion network. The network also takes M second object feature vectors and M second binding information vectors as input to a multi-source feature fusion network, and outputs the classification prediction results of M second training objects through the multi-source feature fusion network.

[0053] The loss result is calculated based on the classification prediction results of N first training objects and N labels;

[0054] The parameters of the statistical feature fusion network, sequence feature extraction network, threshold network, binding graph attention network, and multi-source feature fusion network are optimized based on the loss results.

[0055] Another aspect of this application provides a computer device, comprising:

[0056] Memory, transceiver, processor, and bus system;

[0057] The memory is used to store programs;

[0058] The processor is used to execute programs in memory, including methods for performing the aspects mentioned above;

[0059] Bus systems are used to connect memory and processor to enable communication between them.

[0060] Another aspect of this application provides a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the methods described above.

[0061] Another aspect of this application provides a computer program product or computer program including computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the methods provided in the above aspects.

[0062] As can be seen from the above technical solutions, the embodiments of this application have the following advantages:

[0063] This application provides a data processing method and related apparatus. The method includes: First, acquiring attribute statistics, behavior sequence data, and binding information of a target object, wherein the attribute statistics are used to characterize the data obtained after performing relevant attribute statistics on the target object within a preset time period, and the behavior sequence data are used to characterize the data generated based on the target object's target behavior within the preset time period; Next, using the attribute statistics as input to a statistical feature fusion network, and outputting attribute feature vectors through the statistical feature fusion network; Second, using the behavior sequence data as input to a sequence feature extraction network, and outputting sequence feature vectors through the sequence feature extraction network; Third, using the attribute feature vectors and sequence feature vectors as input to a threshold network, and outputting object feature vectors through the threshold network; Then, using the binding information and object feature vectors as input to a binding relationship graph attention network, and outputting binding information vectors through the binding relationship attention network; Finally, using the object feature vectors and binding information vectors as input to a multi-source feature fusion network, and outputting the classification prediction result of the target object through the multi-source feature fusion network. The method provided in this application calculates attribute statistics, behavioral sequence data and binding information by using a statistical feature fusion network, a sequence feature extraction network and a binding relationship graph attention network to obtain the classification prediction result of the target object, thereby determining whether the target object is abnormal and improving the accuracy of target object anomaly identification. Attached Figure Description

[0064] Figure 1 A schematic diagram of the architecture of a data processing system provided in one embodiment of this application;

[0065] Figure 2 A flowchart illustrating a data processing method provided in one embodiment of this application;

[0066] Figure 3 This is a structural diagram of a data processing model provided in one embodiment of this application;

[0067] Figure 4 A flowchart illustrating a data processing method provided in another embodiment of this application;

[0068] Figure 5 A schematic diagram illustrating an attribute feature sub-vector generation method provided in a certain embodiment of this application;

[0069] Figure 6 A schematic diagram of a statistical feature fusion network provided in one embodiment of this application;

[0070] Figure 7 A flowchart illustrating a data processing method provided in another embodiment of this application;

[0071] Figure 8 This is a structural diagram of a sequence feature extraction network provided in one embodiment of this application;

[0072] Figure 9 A flowchart illustrating a data processing method provided in another embodiment of this application;

[0073] Figure 10 A flowchart illustrating a data processing method provided in another embodiment of this application;

[0074] Figure 11 This is a schematic diagram of the object binding relationship graph attention layer and the device binding relationship graph attention layer provided in a certain embodiment of this application;

[0075] Figure 12 This is a structural diagram of a binding relationship graph attention network provided in one embodiment of this application;

[0076] Figure 13 A flowchart illustrating a data processing method provided in another embodiment of this application;

[0077] Figure 14 This is a structural diagram of a multi-source feature fusion network provided in one embodiment of this application;

[0078] Figure 15 A flowchart illustrating a data processing method provided in another embodiment of this application;

[0079] Figure 16 A schematic diagram illustrating the training and prediction of a multi-dimensional data semi-supervised model provided in a certain embodiment of this application;

[0080] Figure 17 This is a schematic diagram of the structure of a data processing apparatus provided in one embodiment of this application;

[0081] Figure 18 This is a schematic diagram of the structure of a data processing apparatus provided in another embodiment of this application;

[0082] Figure 19This is a schematic diagram of a server structure provided in one embodiment of this application. Detailed Implementation

[0083] This application provides a data processing method and related apparatus. By using a statistical feature fusion network, a sequence feature extraction network, and a binding relationship graph attention network to calculate elements such as attribute statistical data, behavioral sequence data, and binding information, the method obtains the classification prediction result of the target object, thereby determining whether the target object is abnormal and improving the accuracy of target object anomaly identification.

[0084] The terms “first,” “second,” “third,” “fourth,” etc. (if present) in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a particular order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented, for example, in orders other than those illustrated or described herein. Furthermore, the terms “comprising” and “corresponding to,” and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0085] Artificial intelligence (AI) is the theory, methods, technology, and application systems that use digital computers or machines controlled by digital computers to simulate, extend, and expand human intelligence, perceive the environment, acquire knowledge, and use that knowledge to achieve optimal results. In other words, AI is a comprehensive technology within computer science that attempts to understand the essence of intelligence and produce a new kind of intelligent machine that can react in a way similar to human intelligence. AI studies the design principles and implementation methods of various intelligent machines, enabling them to possess the functions of perception, reasoning, and decision-making.

[0086] Artificial intelligence (AI) is a comprehensive discipline encompassing a wide range of fields, including both hardware and software technologies. Fundamental AI technologies generally include sensors, dedicated AI chips, cloud computing, distributed storage, big data processing, operating / interactive systems, and mechatronics. AI software technologies primarily include computer vision, speech processing, natural language processing, and machine learning / deep learning.

[0087] Machine Learning (ML) is a multidisciplinary field involving probability theory, statistics, approximation theory, convex analysis, and algorithm complexity theory. It specifically studies how computers can simulate or implement human learning behavior to acquire new knowledge or skills and reorganize existing knowledge structures to continuously improve their performance. Machine learning is the core of artificial intelligence and the fundamental way to endow computers with intelligence; its applications span all areas of artificial intelligence. Machine learning and deep learning typically include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and instructional learning.

[0088] The solutions provided in this application involve technologies such as machine learning in artificial intelligence, and are specifically illustrated through the following embodiments:

[0089] To facilitate understanding of the technical solutions provided in the embodiments of this application, some key terms used in the embodiments of this application will be explained below:

[0090] Game black market targets: also known as game black market accounts. In games, users use script code or cheat programs to manipulate the game to obtain in-game assets, virtual equipment, or improve the game account level, and then sell the obtained assets and virtual equipment to other players, or sell game accounts with high levels to others. Accounts that engage in this kind of cheating behavior are called game black market accounts.

[0091] Game black market gangs: Users use script code or cheat programs to perform game actions on hundreds or thousands of accounts on hundreds or thousands of computers or emulators without any time difference. This kind of collective cheating behavior is also called game black market gangs, which means that there are physical connections, such as game accounts being bound to the same person's identification number, or logging in on the same device or within the same IP.

[0092] Heterogeneous account relationships: Accounts owned by the same bound ID are associated with each other, and each account has logged into the same device as another account. There are two kinds of relationships between accounts: whether they belong to the same bound ID and whether they have logged into the same device.

[0093] In gaming scenarios, malicious users need large-scale and automated operational processes to generate significant profits at low cost. Malicious accounts typically exhibit similar gaming behaviors and attribute characteristics, and differ from legitimate accounts. Common methods for identifying malicious accounts are rule-based, which primarily utilize business experience in the game and data analysis to set conditions based on certain key attributes to filter abnormal accounts, such as an excessive number of accounts logging in from a single IP address or identical attributes. However, this approach relies too heavily on key characteristics and experience, making it easy for malicious users to circumvent these rules by summarizing their gaming experience and developing their own identification criteria.

[0094] Besides exhibiting different gaming behaviors and attributes compared to legitimate accounts, black market accounts also show characteristics of organized crime, meaning they are physically connected. For example, accounts may be linked to the same individual's identification number, or they may all log in from the same device or IP address. Black market identification strategies or models designed solely based on single-dimensional behavioral data are easily exploited by black market users who can deduce identification criteria based on their gaming experience, thus circumventing the rules and continuing their cheating activities. It's difficult to catch low-profile black market users who don't exhibit obvious cheating, such as players with similar login behaviors but who aren't online 24 / 7. Even if there are clusters, the number of clusters may not reach a high level of suspicion, or these may be user groups clustered only through second-order relationships. Therefore, a comprehensive model integrating multi-dimensional features is needed to accurately identify more existing black market users.

[0095] Therefore, this application comprehensively considers both multi-dimensional game data and model structure, and designs a semi-supervised data processing method that integrates multiple game behavior sequences, object attributes, and heterogeneous object relationship networks. First, for the characteristics of game black market objects, attribute statistics containing discrete and continuous categories are designed, and first-order and second-order cross-feature modules are used for feature mapping to obtain fused attribute feature vectors. Simultaneously, based on user recent game type activity sequences, daily active time sequences, and other behavioral sequence data, a sequence feature extraction network is used to transform and compress various variable-length behavioral sequence data into fixed-length sequence feature vectors. Next, a threshold network (e.g., a Highway structure) is used to fuse the attribute feature vectors and sequence feature vectors to obtain the object feature vector of a single node. Then, based on the binding information composed of multiple edge relationships such as same-binding relationships and same-device login between object nodes, a binding relationship graph attention network capable of traversing similar edge relationships is designed. Finally, the overall model structure better considers similar attribute data and behavioral sequence data of black market targets, and can extend from first-order associated users with single object and device binding relationships to second-order or even multi-order associated object binding information with a wider range of connections. Moreover, this model is based on adaptive modeling using data characteristics combined with an attention mechanism, exhibiting stronger generalization and versatility, thus enabling the identification of more black market targets. Experimental results and online performance also demonstrate that this method has excellent predictive performance in identifying black market targets.

[0096] For easier understanding, please refer to Figure 1 , Figure 1 This is a diagram illustrating the application environment of the data processing method in the embodiments of this application, such as... Figure 1 As shown, the data processing method in this embodiment is applied to a data processing system. The data processing system includes a server and terminal devices. The server can be an independent physical server, a server cluster consisting of multiple physical servers, or a distributed system. It can also be a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. The terminal and server can be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment.

[0097] The server first acquires the target object's attribute statistics, behavior sequence data, and binding information. The attribute statistics represent data obtained after statistically analyzing the target object's relevant attributes over a preset time period, while the behavior sequence data represents data generated based on the target object's game behavior over the preset time period. Next, the attribute statistics are used as input to a statistical feature fusion network, which outputs attribute feature vectors. Simultaneously, the behavior sequence data is used as input to a sequence feature extraction network, which outputs sequence feature vectors. Then, the attribute feature vectors and sequence feature vectors are used as input to a threshold network, which outputs an object feature vector. Next, the binding information is used as input to a binding relationship graph attention network, which outputs a binding information vector. Finally, the object feature vector and binding information vector are used as input to a multi-source feature fusion network, which outputs the target object's classification prediction result.

[0098] The data processing methods in this application will be described below from the server's perspective. Please refer to [link / reference needed]. Figure 2 The data processing method provided in this application includes steps S110 to S160. It should be noted that steps S120 and S130 are parallel steps; in actual execution, steps S120 and S130 are executed simultaneously and do not have a specific order of execution. Specifically:

[0099] S110. Obtain the target object's attribute statistics, behavior sequence data, and binding information.

[0100] Among them, attribute statistics data are used to represent the data obtained after performing relevant attribute statistics on the target object within a preset time period, and behavior sequence data are used to represent the data generated based on the game behavior of the target object within a preset time period.

[0101] It should be noted that the target object can be the target account, and the attribute statistics include, but are not limited to: the game type with the longest online time, the online time, the number of active objects with the same binding relationship, the number of objects logged in on the same device, and some general game behaviors that are strongly related to the target, which are obtained after statistics are collected within a preset time period; the statistical methods include, but are not limited to, mean, variance, maximum, sum, etc.

[0102] Behavioral sequence data includes, but is not limited to: online sequences for each hour of a day, game type sequences over multiple days, and attribute state change sequences, etc. Through truncation processing, the state sequences within a preset time period are retained.

[0103] Binding information includes, but is not limited to, object binding information and device binding information. Object binding information refers to the relationship information between game objects bound to the same user's identification number. For example, if a QQ account or WeChat account bound to the same person's ID card number or mobile phone number is used as two objects logging into the game, the game object corresponding to the QQ account and the game object corresponding to the WeChat account have object binding information. Device binding information refers to the relationship information between game objects logging in on the same device or from the same IP address. For example, 1000 game objects logging in on the same device or from the same IP address have device binding information. The binding information is converted into an adjacency matrix and sparsified to reduce storage.

[0104] It is understandable that attribute statistics, behavior sequence data, and binding information can be obtained from the logs of the corresponding target objects generated by the user during the game.

[0105] S120. Use the attribute statistics data as input to the statistical feature fusion network, and output the attribute feature vector through the statistical feature fusion network.

[0106] It should be noted that the statistical feature fusion network performs feature fusion on attribute statistical data. The feature fusion methods include, but are not limited to, first-order feature fusion and second-order feature fusion. The results obtained from first-order feature fusion and second-order feature fusion are concatenated and fused through a fully connected layer to obtain the attribute feature vector.

[0107] S130. Use behavioral sequence data as input to the sequence feature extraction network, and output the sequence feature vector through the sequence feature extraction network.

[0108] Understandably, sequence feature extraction networks extract features from behavioral sequence data to obtain sequence feature vectors.

[0109] S140. Use the attribute feature vector and sequence feature vector as input to the threshold network, and output the object feature vector through the threshold network.

[0110] It should be noted that in the threshold network, the attribute feature vector and the sequence feature vector are first concatenated, and then the concatenated vector is fused through the HighWay structure. The dimensionality of the fused vector is then reduced to obtain the object feature vector.

[0111] S150. The binding information and object feature vector are used as input to the binding relationship graph attention network, and the binding information vector is output through the binding relationship attention network.

[0112] It should be noted that the binding information and object feature vector in graph form are used as input to the binding relationship graph attention network, and the binding information vector is output through the binding relationship attention network.

[0113] S160. The object feature vector and binding information vector are used as inputs to the multi-source feature fusion network, and the classification prediction result of the target object is output through the multi-source feature fusion network.

[0114] It should be noted that the object feature vector and the binding information vector are concatenated. The concatenated vector is then further fused and redundant is removed through a Highway structure. Finally, binary classification prediction is performed through a fully connected layer and a normalized exponential function (Softmax), and the classification prediction result of the target object is output. The classification prediction result is used to indicate whether the target object is abnormal.

[0115] Understandably, please refer to Figure 3 , Figure 3 This is a structural diagram of the data processing model provided in this application embodiment. It should be noted that the data processing model is a multi-dimensional heterogeneous graph semi-supervised model, including a statistical feature fusion network, a sequence feature extraction network, a threshold network, a binding relationship graph attention network, and a multi-source feature fusion network. In this application embodiment, the threshold network is a Highway feature fusion structure.

[0116] The method provided in this application calculates attribute statistics, behavioral sequence data and binding information by using a statistical feature fusion network, a sequence feature extraction network and a binding relationship graph attention network to obtain the classification prediction result of the target object, thereby determining whether the target object is abnormal and improving the accuracy of target object anomaly identification.

[0117] In this application Figure 2 In one optional embodiment of the data processing method provided in the corresponding implementation, the statistical feature fusion network includes a feature mapping layer and a feature cross layer; please refer to... Figure 4 Step S120 includes sub-steps S1201 to S1204. Specifically:

[0118] S1201. Generate attribute feature sub-vectors based on the data characteristics and attribute statistics of the attribute statistics.

[0119] Understandably, attribute statistics can be divided into discrete and continuous data. Using conventional methods—that is, mapping discrete variables using object-based embeddings and continuous variables using fully connected mappings—requires different embedding methods for different variables, leading to complex model coding and poor scalability.

[0120] Please see Figure 5 , Figure 5 This diagram illustrates the attribute feature sub-vector generation method provided in this application embodiment. This application embodiment proposes a novel mapping method based on a unified feature representation structure that multiplies attribute statistical data (also known as feature IDs) and data features (also known as feature values). First, different feature IDs are assigned to the data. Then, the feature value of discrete variables is set to 1, and the feature value of continuous variables is its own numerical value. Finally, the feature ID is multiplied by the feature value to obtain the feature representation. Regarding the understanding of feature IDs, both discrete and continuous variables are considered as a new feature dimension, and different feature IDs are uniformly assigned. Regarding the understanding of feature values, the feature value of discrete variables is 1 by default, and the feature value of continuous variables is the numerical value of the feature itself; here, the feature value has been normalized. For example, the game type played the longest is a discrete variable with a feature value of 1. The vector embedded with the game type feature ID and the feature value 1 is still the vector itself, meaning the attribute feature sub-vector is the feature ID of the game type. The duration of playing games within a day is a continuous variable. The vector of the feature ID of the duration of playing games within a day is multiplied by its own feature value to obtain the embedded vector representation of the continuous variable; that is, the attribute feature sub-vector is the feature ID of the game type multiplied by its own feature value. The attribute feature vector is a parameter matrix that needs to be learned and optimized.

[0121] S1202. Use the attribute feature sub-vector as input to the feature mapping layer, and output the first-order attribute feature sub-vector through the feature mapping layer.

[0122] The feature mapping layer is used to add corresponding elements in the attribute feature sub-vectors.

[0123] It should be noted that the feature mapping layer is a first-order feature mapping structure, which adds the corresponding elements in the attribute feature sub-vectors to obtain the first-order attribute feature sub-vectors.

[0124] S1203. Use the attribute feature sub-vector as input to the feature cross layer, and output the attribute feature second-order sub-vector through the feature cross layer.

[0125] The feature cross layer is used to multiply corresponding elements in the attribute feature vectors and then add the results of the element-wise multiplication.

[0126] It should be noted that the feature cross layer is a second-order feature mapping structure, which multiplies the corresponding elements in the attribute feature sub-vectors and adds the results of the corresponding element-wise multiplication to obtain the second-order attribute feature sub-vectors.

[0127] It is understandable that the calculation principle for the second-order cross feature is as shown in the following formula (1), where x i and x j E represents the original eigenvalues. i and Ej This represents the embedding vector of statistical features, where F represents the number of features. ⊙ indicates element-wise multiplication. That is, all feature vectors are multiplied element-wise in pairs, and then the element-wise sums are applied.

[0128]

[0129] To improve computational efficiency, the calculation method for second-order cross features can be further optimized. Its principle is similar to the second-order cross solution method for input features in classic algorithms (Neural Factorization Machines, NFM) and Deep Factor Machines (Deep FM) in recommender systems. Its equivalent formula is as follows (2). That is, it directly sums the corresponding elements of all feature vectors and then calculates the sum of squares, avoiding the operation of traversing all features twice in the feature cross calculation.

[0130]

[0131] S1204. Concatenate the first-order sub-vectors of the attribute features with the second-order sub-vectors of the attribute features to obtain the attribute feature vector.

[0132] It is understandable that the attribute feature vector is obtained by concatenating the first-order sub-vectors of the attribute features with the second-order sub-vectors of the attribute features and then fusing them through a fully connected layer.

[0133] Please see Figure 6 , Figure 6 The statistical feature fusion network provided in this application embodiment is illustrated in the following diagram. First, attribute feature sub-vectors are generated based on the data features and attribute statistics of the attribute statistics data. Then, first-order feature mapping and second-order feature crossing are performed on the attribute feature sub-vectors to obtain first-order attribute feature sub-vectors and second-order attribute feature sub-vectors, respectively. Finally, the first-order attribute feature sub-vectors and second-order attribute feature sub-vectors are concatenated to obtain the attribute feature vector.

[0134] The method provided in this application embodiment uses a unified feature mapping for discrete and continuous data, thereby unifying the data structure of discrete and continuous data. The data with the unified data structure is then subjected to first-order feature mapping and second-order feature crossing, and multiple data are spliced ​​and fused to obtain attribute feature vectors. This lays the foundation for subsequent data processing and improves the accuracy of anomaly identification of target objects.

[0135] In this application Figure 2 In one optional embodiment of the data processing method provided in the corresponding implementation, the sequence feature extraction network includes convolutional layers and feature filtering layers; please refer to... Figure 7Step S130 includes sub-steps S1301 to S1303. Specifically:

[0136] S1301. Take the behavioral sequence data as the input of the convolutional layer, and output P behavioral sequence segments through the convolutional layer.

[0137] The behavior sequence segment consists of elements from at least one behavior sequence data, where P is an integer greater than 1.

[0138] It is understood that the convolutional layer in the embodiments of this application includes at least two convolutional layers. First, the behavioral sequence data is input into the first convolutional layer, and then the output of the first convolutional layer is input into the second convolutional layer to obtain multiple behavioral sequence segments.

[0139] S1302. By using the merging function, P behavioral sequence segments are merged to obtain a behavioral convolution sequence.

[0140] S1303. Use the behavior convolution sequence as input to the feature filtering layer, and output the sequence feature vector through the feature filtering layer.

[0141] It should be noted that the convolutional sequence is deredundant through a feature filtering layer.

[0142] Understandably, because the behavioral sequence data of a target object consists of multiple segments, it is difficult to explicitly and intuitively identify important segments from the behavioral sequence data. Therefore, sliding convolution operations based on one-dimensional convolutions in sequence feature extraction networks are used to extract features from each segment, and then max pooling is used to find important behavioral sequence segments. Simultaneously, since the length of behavioral sequence segments is also variable, one-dimensional convolution operations of multiple scales are needed to capture features from multiple segments simultaneously. Furthermore, because the CNN structure has the function of abstracting features layer by layer, and the multi-layer structure can expand the receptive field, increase the segment length, and see longer behavioral sequence segments. Please refer to [link / reference]. Figure 8 , Figure 8 This is a structural diagram of the sequence feature extraction network provided in the embodiments of this application. The sequence feature extraction network includes multi-scale one-dimensional CNN convolutional layers and high-way feature filtering layers. The high-way feature filtering layers transform, compress, and fuse the sequence features of multiple behavioral sequence segments output by the convolutional layers to obtain sequence feature vectors.

[0143] Figure 8 The sequence feature extraction network uses a multi-scale two-layer one-dimensional convolutional module to extract behavioral sequence data, transforming the behavioral sequence data into multiple behavioral sequence fragments of fixed dimensions. Its specific operating principle is described below:

[0144] First, a one-dimensional sliding convolution operation is performed row-wise on the action sequence data through the first convolutional layer to extract shallow features. The one-dimensional convolutional kernel uses convolutional windows of various widths to represent multi-scale one-dimensional convolutional operations. For example... Figure 8 In the diagram, conv1_1 to conv1_k represent the K different widths of one-dimensional convolutional operations in the first layer, extracting features from 1 to k-grams in the behavioral sequence data. Each width of convolutional operation is performed independently, and there are multiple kernels for each width (32 kernels in this embodiment), indicating that different kernel parameters can extract different aspects of features. Therefore, each width of convolutional kernel can produce 32 feature sequences of length L. Alternatively, it can be described as a 32-dimensional feature vector of length L, with K possible widths, so the output of the first convolutional layer is (K, L, 32).

[0145] Similarly, the second convolutional layer is superimposed on the output of the first convolutional layer. Its convolutional operations are similar to those of the first layer, with conv2_1 to conv2_k representing K different widths of one-dimensional convolutional operations in the second layer. Through multiple layers of superimposed convolutional operations, features are abstracted hierarchically to obtain high-level sequence features, i.e., behavioral sequence fragments. The output feature of the second convolutional layer is (K, L, 32).

[0146] Then, further feature filtering is performed on the output features of the second convolutional layer at each scale to highlight key sequence features. Here, for each width of the second convolutional layer, a 32-dimensional feature vector of sequence length L is output. Max pooling is then performed based on the sequence length L to obtain a 32-dimensional output vector. Since there are K different widths of convolutional types, the output is K 32-dimensional vectors, which is equivalent to obtaining a K*32 sequence feature vector.

[0147] The following will use 2-gram convolution as an example to explain in detail the specific operation process of a one-dimensional CNN module. First, the bottom layer is to perform convolution and addition on two ID mapping vectors whose channels are sequentially connected in the action sequence data, as defined in equation (3). This means that the template parameters W1 and W2 are respectively convolved with the sequence ID embedding vector T. i and T i+1 Perform element-wise multiplication and summation, then sum the elements to obtain a real value. Since a single convolutional layer has 32 different kernel parameters, there are 32 output values. The element values ​​obtained from the convolution operation are passed through the ReLU activation function using equation (4) to obtain a 32-dimensional output vector C. iAt this point, the operation of the first convolutional layer is complete, and a total of L different 32-dimensional output vectors of sequence length are obtained. Subsequent CNN convolutional layers use the convolutional output matrix of the previous layer as input, and their convolutional operations and output results are the same as those in formulas (3) and (4), where the subscript i represents the sequence length L, and the subscript j represents the number of convolutional kernels used.

[0148]

[0149]

[0150] Finally, the max pooling operation for the output of the second convolution layer is based on the maximum value of the elements in the sequence length L dimension, as defined by the following formula (5). Therefore, the output of the 32 convolution kernels in each scale is a 32-dimensional vector after max pooling.

[0151]

[0152] For the multi-scale one-dimensional convolutional operations at the upper layer, multiple action sequence segments of different lengths are extracted based on the player's game action sequence. These multiple scales need to be manually set, and the important features of each segment are extracted separately, requiring further fusion. The Highway structure's feature filtering layer can better fuse multiple action sequence segments and enhance the prominence of some important action sequence segments through a gating mechanism. Therefore, the Highway structure's feature filtering layer can further fuse and transform the features extracted by the upper-layer CNN structure to obtain a fixed-dimensional global semantic vector of the player's game actions.

[0153] Element-level gating and global feature fusion are performed on the behavioral sequence segments output by the convolutional layers. This is equivalent to further gating and feature transformation of the output of each convolutional kernel. After all, different convolutional window widths are hyperparameters, which can further adaptively fuse multi-scale features and feature elements of each dimension, making the results more robust. Here, the Highway network structure is referenced, as shown in formulas (6) to (8), where Input represents the input vector, that is, the N*32-dimensional feature vector. and These are weight parameters.

[0154]

[0155]

[0156] output=trans*gate+Input*(1-gate) (8)

[0157] For each behavioral sequence segment, the above... Figure 8The system uses multi-scale CNN convolutional layers with non-shared parameters to obtain each type of behavioral sequence fragment. Since the dimensions and meanings of these fragments differ, a separate multi-scale CNN sequence fusion module is used. In practice, the number of layers in the multi-scale CNN structure can be adjusted according to the complexity of the behavioral sequence data for each type. Finally, the various behavioral sequence fragments are converted into fixed-dimensional sequence feature vectors.

[0158] The method provided in this application process behavioral sequence data through convolutional layers and feature filtering layers to obtain sequence feature vectors with important features, laying the foundation for subsequent data processing and improving the accuracy of target object anomaly identification.

[0159] In this application Figure 2 In one optional embodiment of the data processing method provided in the corresponding implementation, the threshold network includes a feature fusion layer and a fully connected layer; please refer to... Figure 9 Step S140 includes sub-steps S1401 to S1402. Specifically:

[0160] S1401. The concatenated vector of attribute feature vector and sequence feature vector is used as the input of the feature fusion layer, and the concatenated feature vector is output through the feature fusion layer.

[0161] Understandably, the first step is to concatenate the attribute feature vector with the sequence feature vector to obtain a concatenated vector. Then, the concatenated vector is processed by a feature fusion layer to obtain a concatenated feature vector.

[0162] S1402. Use the concatenated feature vector as input to the fully connected layer, and output the object feature vector through the fully connected layer.

[0163] It is understandable that the object feature vector is obtained by reducing the dimensionality of the concatenated feature vector through a fully connected layer.

[0164] The attribute feature vector output by the statistical feature fusion network and the sequence feature vector output by the sequence feature extraction network are concatenated. Then, the attribute feature vector and the sequence feature vector are fused through a HighWay structure. Finally, a fully connected layer is used to reduce the dimensionality and output the object feature vector of the target object.

[0165] The method provided in this application process attribute feature vectors and sequence feature vectors through a feature fusion layer and a fully connected layer to obtain object feature vectors of the target object, laying the foundation for subsequent data processing and improving the accuracy of target object anomaly identification.

[0166] In this application Figure 2In one optional embodiment of the data processing method provided in the corresponding implementation, the binding information includes object binding information and device binding information. The object binding information includes a user-associated object, which corresponds to the same user information as the target object. The device binding information includes a device-associated object, which corresponds to the same device information as the target object. The binding relationship graph attention network includes an object binding relationship graph attention layer and a device binding relationship graph attention layer. Please refer to [link to relevant documentation]. Figure 10 Step S150 includes sub-steps S1501 to S1503. Specifically:

[0167] S1501. The object binding information and object feature vector are used as input to the object binding relationship graph attention layer, and the object binding vector is output through the object binding relationship graph attention layer.

[0168] It is understandable that object binding information is used to indicate the binding relationship between the target object and other game objects that are bound to the same user's unique identifier or mobile phone number.

[0169] S1502. Take the device binding information and object feature vector as input to the device binding relationship graph attention layer, and output the device binding vector through the device binding relationship graph attention layer.

[0170] It is understandable that device binding information is used to indicate the binding relationship between the target object's login device and other game objects on the same login device.

[0171] S1503. The object binding vector and device binding vector are used as inputs to the binding fusion network, and the binding information vector is output through the binding fusion network.

[0172] The binding information vector includes: a secondary device binding global vector of the fused object binding information, and a secondary object binding global vector of the fused device binding information; the secondary device binding global vector of the fused object binding information is obtained based on the object binding information and the device binding vector, and the secondary object binding global vector of the fused device binding information is obtained based on the device binding information and the object binding vector.

[0173] It is understandable that there are multiple binding relationships for the target object, such as object binding relationships and device binding relationships. Since each relationship has a certain degree of independence, it is more complicated to learn by directly mixing them together, which can easily weaken the connection strength between individual relationships. Therefore, in the embodiments of this application, different binding relationship graphs are established and attention layers are used to learn the binding information between objects respectively.

[0174] Please see Figure 11 , Figure 11This is a schematic diagram of the object binding graph attention layer and the device binding graph attention layer provided in this application embodiment. For target object A, which has associated objects B, C, and D with object binding information, the object binding graph attention layer performs edge relationship fusion on the target object's own fused feature vector, enabling target object A to integrate the group features of surrounding objects bound to the same relationship and output the object binding vector of target object A. For target object A, which has associated objects E, F, and G with device binding information, the device binding graph attention layer enables target object A to integrate the group features of surrounding objects bound to the same relationship and output the device binding vector of target object A. To reduce computational resources and memory usage, a sparse encoding implementation of the adjacency matrix and attention mechanism is specifically implemented. To better learn the multifaceted features between transaction users, the graph attention module uses a 4-head attention mechanism and a single-layer attention structure with residual structure.

[0175] Please see Figure 12 , Figure 12 This is a structural diagram of the binding relationship graph attention network provided in this application embodiment. It further fuses object binding vectors and device binding vectors through vector concatenation. Because game black market groups, in order to bypass group detection, will disperse objects to different relationships, but these dispersedly bound objects will log in to the same device, meaning game black market groups may be associated through two different levels of relationships: object binding and device binding. Therefore, the object binding vector and device binding vector of the same target object are first concatenated and fused through a fully connected layer, maintaining the same dimension. Then, the fused vector is added to the residual of either the object binding vector or the device binding vector. Finally, the graph attention structure is further utilized to learn the relationships between adjacent users with the fused vector. This is equivalent to the relationship between two-level connected devices, or a two-level connected binding relationship, or a second-order connection relationship where device relationship precedes binding relationship, or a second-order connection relationship where binding relationship precedes device relationship. Multiple heterogeneous relationships are fused in the binding relationship graph attention network. Furthermore… Figure 12 This fusion structure can be further extended to heterogeneous graphs containing more than three relationships. First, multiple relationships are concatenated and fused through a fully connected layer. Then, the relationship that is dominant is used as the input to the subsequent attention structure, and the feature vector of that relationship is added to the residual to strengthen the feature vector information.

[0176] The method provided in this application learns object binding information and device binding information through an object binding graph attention layer and a device binding graph attention layer, respectively, laying the foundation for subsequent data processing and improving the accuracy of target object anomaly identification.

[0177] In this application Figure 2 In one optional embodiment of the data processing method provided in the corresponding implementation, the multi-source feature fusion network includes a feature extraction layer and a binary classification layer; please refer to... Figure 13 Step S160 includes sub-steps S1601 to S1603. Specifically:

[0178] S1601. Concatenate the object feature vector and the binding information vector to obtain the global vector of the target object.

[0179] S1602. Use the global vector as the input to the feature extraction layer, and use the output of the feature extraction layer to target the feature vector.

[0180] S1603. Use the target feature vector as input to the binary classification layer, and output the classification prediction result of the target object through the binary classification layer.

[0181] Understandably, please refer to Figure 14 , Figure 14 This is a structural diagram of the multi-source feature fusion network provided in the embodiments of this application. The object feature vector output by the threshold network and the binding information vector output by the binding relationship attention network are further fused and redundant are removed by the multi-source feature fusion network. Then, the classification prediction result of the target object is obtained through a fully connected layer and a binary classification layer.

[0182] The method provided in this application improves the accuracy of anomaly identification by outputting the classification prediction result of the target object through a multi-source feature fusion network.

[0183] In this application Figure 2 In one optional embodiment of the object data processing method provided in the corresponding implementation, please refer to... Figure 15 The data processing method also includes steps S210 to S280. It should be noted that steps S210 to S280 are training steps. Specifically:

[0184] S210. Obtain N first training datasets and M second training datasets.

[0185] Among them, N first training datasets correspond to N first training objects. The N first training datasets carry N labels. The N labels are used to indicate whether the N first training objects are abnormal. Each first training dataset includes the first attribute statistics, the first row sequence data and the first binding information of the first training object. M second training datasets correspond to M second training objects. Each second training dataset includes the second attribute statistics, the second row sequence data and the second binding information of the second training object. N and M are both integers greater than 1.

[0186] It should be noted that the N first training objects and the M second training objects have object binding relationships or device binding relationships.

[0187] S220. Take N first attribute statistical data and M first attribute statistical data as input to the statistical feature fusion network, and output N first attribute feature vectors and M second attribute feature vectors through the statistical feature fusion network.

[0188] S230. Take N first-row sequence data and M first-row sequence data as input to the sequence feature extraction network, and output N first sequence feature vectors and M second sequence feature vectors through the sequence feature extraction network.

[0189] S240. Take N first attribute feature vectors and N first sequence feature vectors as input to a threshold network, and output N first object feature vectors through the threshold network. Also, take M second attribute feature vectors and M second sequence feature vectors as input to a threshold network, and output M second object feature vectors through the threshold network.

[0190] S250. Take N first binding information, N first object feature vectors, M second binding information and M second object feature vectors as input to the binding relationship graph attention network, and output N first binding information vectors and M second binding information vectors through the binding relationship attention network.

[0191] Among them, the N first binding information vectors are obtained based on the N first binding information and the N first object feature vectors, and the M second binding information vectors are obtained based on the M second binding information and the M second object feature vectors.

[0192] S260. Take N first object feature vectors and N first binding information vectors as input to the multi-source feature fusion network, and output the classification prediction results of N first training objects through the multi-source feature fusion network. Also, take M second object feature vectors and M second binding information vectors as input to the multi-source feature fusion network, and output the classification prediction results of M second training objects through the multi-source feature fusion network.

[0193] S270. Calculate the loss result based on the classification prediction results of N first training objects and N labels.

[0194] S280. Optimize the parameters of the statistical feature fusion network, sequence feature extraction network, threshold network, binding graph attention network, and multi-source feature fusion network based on the loss results.

[0195] Understandably, please refer to Figure 16 , Figure 16This is a schematic diagram illustrating the training and prediction of a multi-dimensional data semi-supervised model provided in this application embodiment. Users generate log data during gameplay. For behavioral sequence data, such as hourly online activity, daily game types played, and changes in player attributes, the method provided in this application embodiment can adapt to various behavioral sequence data, regardless of whether the input is a continuous or discrete variable sequence. It can also support N discrete and continuous statistical variables, where N can be set via a configuration file. Furthermore, for multiple binding information, such as belonging to the same binding relationship, logging in from the same device, or logging in from the same IP address, the model can be preprocessed, and the heterogeneous graph module in the model can automatically adapt by reading the configuration file. Then, it is automatically trained using the multi-dimensional data semi-supervised model of this application, and the model with the best performance in the validation set is saved.

[0196] Semi-supervised training refers to training data that contains some labeled data and some unlabeled data, such as... Figure 11 In the binding relationship, objects A, B, and G are training objects carrying labels, while objects C, D, E, and F are training objects without labels.

[0197] By leveraging game log data databases and combining business understanding to extract key behavioral sequence data, attribute statistics, and object binding information, along with black, white, and uncertain labels for each object using other methods, and adaptively generating training data samples that meet model input through a general data preprocessing workflow, model training can begin with a single click. The multi-dimensional data semi-supervised model proposed in this paper adaptively learns the relationship between the multi-dimensional feature data of all users and black and white labels, automatically selecting the optimal model, achieving integrated, streamlined, and automated model training.

[0198] The object dataset modeling scheme is constructed as follows: Based on the blacklist and whitelist user labels obtained by intersecting blacklist and whitelist databases, as well as some user data with unknown labels, a multidimensional heterogeneous graph semi-supervised model structure and training process are constructed. Attribute feature vectors and sequence feature vectors are obtained through a statistical feature fusion network and a sequence feature extraction network. Object feature vectors are obtained through a Highway-structured gate network. Binding relationship graph attention network is used to fuse objects and associated accounts with binding information to obtain binding information vectors. Finally, the binding information vectors and object feature vectors of objects are used for prediction by a classification module. During training, only labeled data is processed using the cross-entropy loss function and gradient descent Adam optimization algorithm to optimize the network parameters of each module in the entire neural network structure end-to-end. During prediction, after inputting multidimensional data containing edge relationships, the model directly outputs the predicted probability of whether each user is abnormal.

[0199] The multidimensional heterogeneous graph semi-supervised model is formed by connecting various processing modules end-to-end. Model training is optimized using a Softmax binary classification cross-entropy objective function, specifically employing the Adam algorithm to optimize the parameters of each layer, with a learning rate set to 0.0001. To avoid overfitting, regularization is applied to the weights of the final fully connected layer. During model training, unlabeled data is used in the surrounding user fusion for graph attention. When the number of neighboring nodes is too large, 500 nodes are randomly selected from each training batch. The model's input is all user data with edge relationships, including black-and-white labeled data and unlabeled data. Unlabeled data is masked during loss calculation and optimization of the objective function, but it still plays a supporting role in optimizing labeled data; this is essentially a form of semi-supervised training.

[0200] Model training and validation were performed using data from the entire game. A test was conducted on a specific day with a black-to-white ratio of 7,867,888:436,446, demonstrating the superior performance of the multidimensional heterogeneous graph semi-supervised model. As shown in Table 1, the multidimensional heterogeneous graph semi-supervised model proposed in this application achieved the best results. Furthermore, different fusion structures for various relationships were explored. In the non-interactive representation, each relationship used an attention module separately without intermediate fusion vector processing, and the various relationship vectors were finally fused. Comparison of model performance revealed that the model containing the relationship fusion structure performed better.

[0201]

[0202] Because the method provided in the application embodiments does not require separate feature engineering and rules based on a specific game, but only general game attribute features, behavior sequences, and relationships, a model can be trained at low cost and high efficiency through a general feature engineering module and data preprocessing and transformation module. Then, by selecting the method of loading the pre-trained model, online prediction can be performed.

[0203] The method provided in this application not only ensures the accuracy of identifying abnormal transit objects but also improves the coverage of abnormal objects, enabling the capture of some abnormal objects that cannot be covered by relying solely on attribute features or sequence features. Based on the model's predicted probability, highly suspicious abnormal objects are identified by setting thresholds, allowing for subsequent penalties such as account bans, zero-reward sanctions, and reduced credit scores. This effectively identifies and addresses black market users, purifies the gaming environment, and reduces the cost of game operation.

[0204] The data processing apparatus in this application is described in detail below. Please refer to [link / reference]. Figure 17 . Figure 17 This is a schematic diagram of one embodiment of the data processing apparatus 10 in this application. The data processing apparatus 10 includes:

[0205] The target object data acquisition module 110 is used to acquire attribute statistics, behavior sequence data, and binding information of the target object. The attribute statistics represent data obtained after performing relevant attribute statistics on the target object within a preset time period; the behavior sequence data represents data generated based on the target object's game behavior within the preset time period; and the binding information includes object binding information and device binding information.

[0206] The statistical feature fusion network module 120 is used to take attribute statistics data as input to the statistical feature fusion network and output attribute feature vectors through the statistical feature fusion network.

[0207] The sequence feature extraction network module 130 is used to take behavioral sequence data as input to the sequence feature extraction network and output a sequence feature vector through the sequence feature extraction network.

[0208] The threshold network module 140 is used to take attribute feature vectors and sequence feature vectors as inputs to the threshold network and output object feature vectors through the threshold network.

[0209] The binding relationship graph attention network module 150 is used to take binding information and object feature vectors as input to the binding relationship graph attention network, and output binding information vectors through the binding relationship attention network.

[0210] The multi-source feature fusion network module 160 is used to take the object feature vector and the binding information vector as input to the multi-source feature fusion network, and output the classification prediction result of the target object through the multi-source feature fusion network. The classification prediction result is used to indicate whether the target object is abnormal.

[0211] The apparatus provided in this application calculates attribute statistics data, behavioral sequence data, and binding information by using a statistical feature fusion network, a sequence feature extraction network, and a binding relationship graph attention network to obtain the classification prediction result of the target object, thereby determining whether the target object is abnormal and improving the accuracy of target object anomaly identification.

[0212] In this application Figure 17 In an optional embodiment of the data processing apparatus provided in the corresponding embodiment, the statistical feature fusion network includes a feature mapping layer and a feature cross layer; the statistical feature fusion network module 120 is further used for:

[0213] Generate attribute feature sub-vectors based on the data characteristics and attribute statistics of the attribute statistics.

[0214] The attribute feature vector is used as the input of the feature mapping layer, and the first-order attribute feature vector is output through the feature mapping layer. The feature mapping layer is used to add the corresponding elements in the attribute feature vector.

[0215] The attribute feature vectors are used as input to the feature cross layer, and the second-order attribute feature vectors are output through the feature cross layer. The feature cross layer is used to multiply corresponding elements in the attribute feature vectors and add the results of the corresponding element-wise multiplication.

[0216] The attribute feature vector is obtained by concatenating the first-order sub-vector of the attribute feature with the second-order sub-vector of the attribute feature.

[0217] The apparatus provided in this application uses a unified feature mapping for discrete and continuous data, thereby unifying the data structure of the discrete and continuous data. It performs first-order feature mapping and second-order feature crossing on the data with the unified data structure, and splices and fuses multiple data to obtain attribute feature vectors, laying the foundation for subsequent data processing and improving the accuracy of anomaly identification of target objects.

[0218] In this application Figure 17 In an optional embodiment of the data processing apparatus provided in the corresponding embodiment, the sequence feature extraction network includes convolutional layers and feature filtering layers; the sequence feature extraction network module 130 is further used for:

[0219] The behavior sequence data is used as the input to the convolutional layer, and the convolutional layer outputs P behavior sequence segments, where each behavior sequence segment consists of at least one element from the behavior sequence data, and P is an integer greater than 1.

[0220] By merging the P behavioral sequence segments using the merge function, a behavioral convolution sequence is obtained.

[0221] The behavior convolution sequence is used as the input to the feature filtering layer, and the feature filtering layer outputs the sequence feature vector.

[0222] The apparatus provided in this application process behavioral sequence data through convolutional layers and feature filtering layers to obtain sequence feature vectors with important features, laying the foundation for subsequent data processing and improving the accuracy of target object anomaly identification.

[0223] In this application Figure 17 In an optional embodiment of the data processing apparatus provided in the corresponding embodiment, the threshold network includes a feature fusion layer and a fully connected layer; the threshold network module 140 is further used for:

[0224] The concatenated vector of attribute feature vector and sequence feature vector is used as the input of the feature fusion layer, and the concatenated feature vector is output through the feature fusion layer.

[0225] The concatenated feature vector is used as the input to the fully connected layer, and the fully connected layer outputs the object feature vector.

[0226] The apparatus provided in this application process attribute feature vectors and sequence feature vectors through a feature fusion layer and a fully connected layer to obtain object feature vectors of the target object, laying the foundation for subsequent data processing and improving the accuracy of target object anomaly identification.

[0227] In this application Figure 17 In an optional embodiment of the data processing apparatus provided in the corresponding embodiment, the object binding information includes a user-associated object, wherein the user-associated object and the target object correspond to the same user information; the device binding information includes a device-associated object, wherein the device-associated object and the target object correspond to the same device information; the binding relationship graph attention network includes an object binding relationship graph attention layer and a device binding relationship graph attention layer; the binding relationship graph attention network module 150 is further used for:

[0228] The object binding information and object feature vector are used as input to the object binding graph attention layer, and the object binding vector is output through the object binding graph attention layer.

[0229] The device binding information and object feature vector are used as inputs to the device binding relationship graph attention layer, and the device binding vector is output through the device binding relationship graph attention layer.

[0230] The object binding vector and device binding vector are used as inputs to the binding fusion network, which outputs a binding information vector.

[0231] The apparatus provided in this application learns object binding information and device binding information through an object binding graph attention layer and a device binding graph attention layer, respectively, laying the foundation for subsequent data processing and improving the accuracy of target object anomaly identification.

[0232] In this application Figure 17 In one optional embodiment of the data processing apparatus provided in the corresponding embodiment, the multi-source feature fusion network includes a feature extraction layer and a binary classification layer; the multi-source feature fusion network module 160 is further used for:

[0233] The object feature vector and the binding information vector are concatenated to obtain the global vector of the target object.

[0234] The global vector is used as the input to the feature extraction layer, and the target feature vector is output by the feature extraction layer.

[0235] The target feature vector is used as the input to the binary classification layer, and the binary classification layer outputs the classification prediction result of the target object.

[0236] The apparatus provided in this application improves the accuracy of anomaly identification of target objects by outputting classification prediction results of target objects through a multi-source feature fusion network.

[0237] In this application Figure 17 In one alternative embodiment of the data processing apparatus provided in the corresponding embodiment, please refer to Figure 18 The data processing device also includes a training module 200, used for:

[0238] Obtain N first training datasets and M second training datasets. The N first training datasets correspond to N first training objects. Each first training dataset carries N labels, which are used to indicate whether the N first training objects are abnormal. Each first training dataset includes the first attribute statistics, the first row sequence data, and the first binding information of the first training object. The M second training datasets correspond to M second training objects. Each second training dataset includes the second attribute statistics, the second row sequence data, and the second binding information of the second training object. N and M are both integers greater than 1.

[0239] The statistical feature fusion network takes N first attribute statistics and M first attribute statistics as inputs and outputs N first attribute feature vectors and M second attribute feature vectors.

[0240] The sequence feature extraction network takes N first-row sequence data and M first-row sequence data as input and outputs N first-row feature vectors and M second-row feature vectors.

[0241] The N first attribute feature vectors and N first sequence feature vectors are used as inputs to the threshold network, and the threshold network outputs N first object feature vectors. The M second attribute feature vectors and M second sequence feature vectors are used as inputs to the threshold network, and the threshold network outputs M second object feature vectors.

[0242] The binding relationship graph attention network takes N first binding information, N first object feature vectors, M second binding information, and M second object feature vectors as inputs and outputs N first binding information vectors and M second binding information vectors.

[0243] Among them, the N first binding information vectors are obtained based on the N first binding information and the N first object feature vectors, and the M second binding information vectors are obtained based on the M second binding information and the M second object feature vectors;

[0244] The network takes N first object feature vectors and N first binding information vectors as input to a multi-source feature fusion network, and outputs the classification prediction results of N first training objects through the multi-source feature fusion network. The network also takes M second object feature vectors and M second binding information vectors as input to a multi-source feature fusion network, and outputs the classification prediction results of M second training objects through the multi-source feature fusion network.

[0245] The loss result is calculated based on the classification prediction results of N first training objects and N labels;

[0246] The parameters of the statistical feature fusion network, sequence feature extraction network, threshold network, binding graph attention network, and multi-source feature fusion network are optimized based on the loss results.

[0247] The device provided in this application embodiment ensures the accuracy of abnormal transfer object identification while improving the coverage of abnormal objects, and can capture some abnormal objects that cannot be covered by relying solely on attribute features or sequence features. Based on the predicted probability of the model, highly suspicious abnormal objects are found by setting a threshold, and subsequent penalties such as account bans, zero-reward sanctions, and reduction of credit scores can be imposed, effectively identifying and dealing with black market users, purifying the game environment, and reducing the cost of game operation.

[0248] Figure 19 This is a schematic diagram of a server structure provided in an embodiment of this application. The server 300 can vary significantly due to different configurations or performance. It may include one or more central processing units (CPUs) 322 (e.g., one or more processors) and memory 332, and one or more storage media 330 (e.g., one or more mass storage devices) for storing application programs 342 or data 344. The memory 332 and storage media 330 can be temporary or persistent storage. The program stored in the storage media 330 may include one or more modules (not shown in the diagram), each module may include a series of instruction operations on the server. Furthermore, the CPU 322 may be configured to communicate with the storage media 330 and execute the series of instruction operations stored in the storage media 330 on the server 300.

[0249] Server 300 may also include one or more power supplies 326, one or more wired or wireless network interfaces 350, one or more input / output interfaces 358, and / or one or more operating systems 341, such as Windows Server. TM Mac OS X TM Unix TM Linux TMFreeBSD TM etc.

[0250] The steps performed by the server in the above embodiments can be based on this Figure 19 The server structure shown.

[0251] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0252] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces, or indirect coupling or communication connection between apparatuses or units, and may be electrical, mechanical, or other forms.

[0253] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0254] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit.

[0255] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or all or part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0256] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit it. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A data processing method, characterized by, include: The system acquires attribute statistics, behavior sequence data, and binding information of a target object. The attribute statistics represent data obtained after performing relevant attribute statistics on the target object within a preset time period. The behavior sequence data represents data generated based on the target object's target behavior within the preset time period. The binding information includes object binding information and device binding information. The object binding information includes a user-associated object, where the user-associated object corresponds to the same user information as the target object. The device binding information includes a device-associated object, where the device-associated object corresponds to the same device information as the target object. The attribute statistics data are used as input to the statistical feature fusion network, and the statistical feature fusion network outputs attribute feature vectors. The behavioral sequence data is used as input to the sequence feature extraction network, which then outputs a sequence feature vector. The attribute feature vector and the sequence feature vector are used as inputs to a threshold network, and the threshold network outputs an object feature vector. The binding information and the object feature vector are used as input to the binding relationship graph attention network, and the binding information vector is output through the binding relationship graph attention network. The object feature vector and the binding information vector are used as inputs to a multi-source feature fusion network, which then outputs the classification prediction result of the target object.

2. The data processing method of claim 1, wherein, The statistical feature fusion network includes a feature mapping layer and a feature cross layer; The step of using the attribute statistics data as input to a statistical feature fusion network and outputting attribute feature vectors through the statistical feature fusion network includes: Based on the data characteristics of the attribute statistics and the attribute statistics data, an attribute feature sub-vector is generated; The attribute feature sub-vector is used as the input of the feature mapping layer, and the first-order attribute feature sub-vector is output through the feature mapping layer. The feature mapping layer is used to add corresponding elements in the attribute feature sub-vector. The attribute feature sub-vectors are used as input to the feature cross layer, and the second-order attribute feature sub-vectors are output through the feature cross layer. The feature cross layer is used to multiply corresponding elements in the attribute feature sub-vectors and add the results of the corresponding element-wise multiplication. The attribute feature vector is obtained by concatenating the first-order sub-vector of the attribute feature with the second-order sub-vector of the attribute feature.

3. The data processing method of claim 1, wherein, The sequence feature extraction network includes convolutional layers and feature filtering layers; The step of using the behavioral sequence data as input to a sequence feature extraction network and outputting a sequence feature vector through the sequence feature extraction network includes: The behavior sequence data is used as the input to the convolutional layer, and P behavior sequence segments are output by the convolutional layer, wherein each behavior sequence segment is composed of at least one element from the behavior sequence data, and P is an integer greater than 1. The P behavioral sequence segments are merged using a merging function to obtain a behavioral convolution sequence; The behavior convolution sequence is used as the input to the feature filtering layer, and the sequence feature vector is output through the feature filtering layer.

4. The data processing method of claim 1, wherein, The threshold network includes a feature fusion layer and a fully connected layer; The step of using the attribute feature vector and the sequence feature vector as input to a threshold network, and outputting an object feature vector through the threshold network, includes: The concatenated vector of the attribute feature vector and the sequence feature vector is used as the input of the feature fusion layer, and the concatenated feature vector is output through the feature fusion layer. The concatenated feature vector is used as the input to the fully connected layer, and the object feature vector is output through the fully connected layer.

5. The data processing method as described in claim 1, characterized in that, The binding graph attention network includes an object binding graph attention layer and a device binding graph attention layer; The step of using the binding information and the object feature vector as input to the binding relationship graph attention network, and outputting the binding information vector through the binding relationship graph attention network, includes: The object binding information and the object feature vector are used as inputs to the object binding graph attention layer, and the object binding vector is output through the object binding graph attention layer. The device binding information and the object feature vector are used as inputs to the attention layer of the device binding relationship graph, and the device binding vector is output through the attention layer of the device binding relationship graph. The object binding vector and the device binding vector are used as inputs to the binding fusion network, and the binding information vector is output through the binding fusion network. The binding information vector includes a secondary device binding global vector of the fused object binding information and a secondary object binding global vector of the fused device binding information. The secondary device binding global vector of the fused object binding information is obtained based on the object binding information and the device binding vector, and the secondary object binding global vector of the fused device binding information is obtained based on the device binding information and the object binding vector.

6. The data processing method of claim 1, wherein, The multi-source feature fusion network includes a feature extraction layer and a binary classification layer; The step of using the object feature vector and the binding information vector as input to a multi-source feature fusion network, and outputting the classification prediction result of the target object through the multi-source feature fusion network, includes: The object feature vector and the binding information vector are concatenated to obtain the global vector of the target object; The global vector is used as the input to the feature extraction layer, and the target feature vector is output by the feature extraction layer. The target feature vector is used as the input to the binary classification layer, and the classification prediction result of the target object is output by the binary classification layer.

7. The data processing method of claim 1, wherein, Also includes: Obtain N first training datasets and M second training datasets, wherein the N first training datasets correspond to N first training objects, the N first training datasets carry N labels, the N labels are used to indicate whether the N first training objects are abnormal, each first training dataset includes first attribute statistics, first behavior sequence data and first binding information of the first training object, and the M second training datasets correspond to M second training objects, each second training dataset includes second attribute statistics, second behavior sequence data and second binding information of the second training object, where N and M are both integers greater than 1; The statistical feature fusion network takes N first attribute statistical data and M second attribute statistical data as input and outputs N first attribute feature vectors and M second attribute feature vectors. The N first-row sequence data and M second-row sequence data are used as input to the sequence feature extraction network, and the sequence feature extraction network outputs N first sequence feature vectors and M second sequence feature vectors. The N first attribute feature vectors and the N first sequence feature vectors are used as inputs to a threshold network, and the threshold network outputs N first object feature vectors. The M second attribute feature vectors and the M second sequence feature vectors are used as inputs to a threshold network, and the threshold network outputs M second object feature vectors. The N first binding information, N first object feature vectors, M second binding information, and M second object feature vectors are used as input to the binding relationship graph attention network. The binding relationship graph attention network outputs N first binding information vectors and M second binding information vectors, wherein the N first binding information vectors are obtained based on the N first binding information and the N first object feature vectors, and the M second binding information vectors are obtained based on the M second binding information and the M second object feature vectors. The N first object feature vectors and the N first binding information vectors are used as inputs to a multi-source feature fusion network, which outputs the classification prediction results of the N first training objects. The M second object feature vectors and the M second binding information vectors are used as inputs to a multi-source feature fusion network, which outputs the classification prediction results of the M second training objects. The loss result is calculated based on the classification prediction results of the N first training objects and the N labels; The parameters of the statistical feature fusion network, the sequence feature extraction network, the threshold network, the binding graph attention network, and the multi-source feature fusion network are optimized based on the loss results.

8. A data processing apparatus, characterized by, include: The target object data acquisition module is used to acquire attribute statistics, behavior sequence data, and binding information of the target object. The attribute statistics are used to represent the data obtained after performing relevant attribute statistics on the target object within a preset time. The behavior sequence data is used to represent the data generated based on the target object's target behavior within the preset time. The binding information includes object binding information and device binding information. The object binding information includes a user-associated object, which corresponds to the same user information as the target object. The device binding information includes a device-associated object, which corresponds to the same device information as the target object. The statistical feature fusion network module is used to take the attribute statistics data as input to the statistical feature fusion network and output attribute feature vectors through the statistical feature fusion network. A sequence feature extraction network module is used to take the behavioral sequence data as input to the sequence feature extraction network and output a sequence feature vector through the sequence feature extraction network. A threshold network module is used to take the attribute feature vector and the sequence feature vector as input to the threshold network, and output the object feature vector through the threshold network. The binding relationship graph attention network module is used to take the binding information and the object feature vector as input to the binding relationship graph attention network, and output the binding information vector through the binding relationship graph attention network; The multi-source feature fusion network module is used to take the object feature vector and the binding information vector as input to the multi-source feature fusion network, and output the classification prediction result of the target object through the multi-source feature fusion network.

9. A computer device, comprising: include: Memory, transceiver, processor, and bus system; The memory is used to store programs; The processor is configured to execute a program in the memory, including executing the data processing method as described in any one of claims 1 to 7; The bus system is used to connect the memory and the processor to enable communication between the memory and the processor.

10. A computer-readable storage medium comprising instructions that, when executed on a computer, cause the computer to perform the data processing method as claimed in any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, The computer program is executed by a processor using the data processing method as described in any one of claims 1 to 7.

Images