Data acquisition method and apparatus, terminal, and storage medium

Abstract

The application discloses a data acquisition method and device, a terminal and a storage medium, and belongs to the technical field of computers. The method is executed by the terminal, a game client on the terminal is configured with a hook function, the game client comprises a filtering function and a processing function provided by a game engine; the method comprises the following steps: calling the filtering function, acquiring original operation data executed in the game client, filtering the original operation data to obtain target operation data, the execution frequency of the target operation data being consistent with a game frame rate in the game client; calling the processing function, acquiring the target operation data output by the filtering function, and determining instruction data triggered by the target operation data; and calling the hook function, acquiring the target operation data and the instruction data obtained by the processing function. Since the execution frequency of the target operation data is consistent with the game frame rate, the target operation data is effective operation data capable of generating game performance, and therefore the obtained target operation data is more accurate.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data acquisition method, apparatus, terminal and storage medium. Background Technology

[0002] With the rapid development of computer technology, video games have become an increasingly popular form of entertainment. In video games, users compete against each other to win. However, some users use cheat programs to gain an advantage, affecting the fairness of video games. To avoid this problem, user operation data can usually be collected and analyzed to identify abnormal behavior.

[0003] In related technologies, the operating system provides a collection function to detect operation data executed in the game. By hooking this collection function, the operation data can be obtained. However, since the operation data detected by this collection function includes all operation data performed by the user, and a single frame of the game screen is only affected by one operation data, some of these operation data are invalid and do not affect the game performance. Therefore, the operation data obtained by this method is not accurate enough. Summary of the Invention

[0004] This application provides a data acquisition method, apparatus, terminal, and storage medium, which can improve the accuracy of acquired operational data. The technical solution is as follows:

[0005] On one hand, a data acquisition method is provided, executed by a terminal, wherein a game client on the terminal is configured with a hook function, the game client including a filtering function and a processing function provided by a game engine, and the hook function is used to hook the processing function; the method includes:

[0006] During the operation of the game client, the filtering function is called to obtain the raw operation data executed in the game client, and the raw operation data is filtered to obtain the target operation data. The execution frequency of the target operation data is consistent with the game frame rate in the game client.

[0007] Call the processing function to obtain the target operation data output by the filtering function, and determine the instruction data triggered by the target operation data;

[0008] The hook function is invoked to obtain the target operation data and the instruction data obtained by the processing function.

[0009] On the other hand, a data acquisition device is provided, disposed in a terminal, wherein a game client on the terminal is configured with a hook function, the game client including a filtering function and a processing function provided by a game engine, and the hook function is used to hook the processing function; the device includes:

[0010] The data filtering module is used to call the filtering function during the operation of the game client, obtain the raw operation data executed in the game client, filter the raw operation data to obtain target operation data, and the execution frequency of the target operation data is consistent with the game frame rate in the game client.

[0011] The data processing module is used to call the processing function, obtain the target operation data output by the filtering function, and determine the instruction data triggered by the target operation data;

[0012] The data acquisition module is used to call the hook function to obtain the target operation data and the instruction data obtained by the processing function.

[0013] Optionally, the hook function includes a first hook function and a second hook function, and the processing function includes an input processing function and an instruction processing function;

[0014] The first hook function is used to hook the processing input function, and the processing input function is used to obtain the target operation data;

[0015] The second hook function is used to hook the processing instruction function, which is used to determine the instruction data triggered by the target operation data.

[0016] Optionally, the data acquisition module is used for:

[0017] Call the first hook function to obtain the input data of the processing input function, and obtain the target operation data;

[0018] The second hook function is called to obtain the output data of the processing instruction function, and the instruction data is obtained.

[0019] Optionally, the processing input function includes a key input function and an axis input function, and the target operation data includes key operation data and axis operation data; the data processing module is used for:

[0020] The button input function is called to obtain the button operation data output by the filtering function. The button operation data includes at least one of the following: keyboard click operation data, mouse click operation data, gamepad click operation data, or virtual button click operation data.

[0021] The axis input function is called to obtain the axis operation data output by the filtering function. The axis operation data includes at least one of the following: drag operation data of the mouse, shaking operation data of the gamepad, or sliding operation data on the screen.

[0022] Optionally, the data processing module is used for:

[0023] The processing instruction function is invoked to query the instruction data corresponding to the target operation data in the first mapping table, which is used to store any operation data and its corresponding instruction data.

[0024] Optionally, the device further includes:

[0025] The first storage module is used to add the target operation data to the operation data queue;

[0026] The second storage module is used to store the target operation data and the instruction data in a second mapping table, which is used to store the acquired operation data and the corresponding instruction data.

[0027] Optionally, the device further includes:

[0028] The query module is used to, when the number of occurrences of target instruction data found in the second mapping relationship table reaches the target number, clear the number of occurrences of the target instruction data to zero, and input the operation data queue into the behavior recognition model, wherein the target instruction data is any instruction data in the second mapping relationship table;

[0029] The identification module is used to call the behavior identification model and identify abnormal operation behaviors based on the operation data queue.

[0030] Optionally, the first storage module is configured to:

[0031] Delete the operation data with the earliest acquisition time in the operation data queue, and add the target operation data to the operation data queue.

[0032] Optionally, the data filtering module is used for:

[0033] The system calls a collection function provided by the operating system to detect the raw operation data executed in the game client.

[0034] The filtering function is invoked to obtain the raw operation data output by the collection function.

[0035] Optionally, the device further includes:

[0036] The rendering module is used to call the game functions provided by the game server, obtain the instruction data output by the processing function, and render the game screen based on the instruction data.

[0037] On the other hand, a terminal is provided, the terminal including a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to perform the operations performed by the data acquisition method as described above.

[0038] On the other hand, a computer-readable storage medium is provided that stores at least one computer program, which is loaded and executed by a processor to perform the operations performed by the data acquisition method described above.

[0039] On the other hand, a computer program product is provided, including a computer program that is loaded and executed by a processor to perform the operations performed by the data acquisition method as described above.

[0040] The solution provided in this application embodiment allows the game engine's filtering function to filter the original operation data, obtaining target operation data whose execution frequency matches the game's frame rate. The game engine's processing function receives this target operation data from the filtering function and determines the instruction data triggered by the target operation data. Therefore, by hooking the processing function with a hooking function, the filtered target operation data and corresponding instruction data can be obtained. Since the execution frequency of the target operation data matches the game's frame rate, and each target operation data is valid operation data capable of generating game performance, the target operation data obtained by hooking in this way is more accurate. Attached Figure Description

[0041] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a schematic diagram of an implementation environment provided in an embodiment of this application;

[0043] Figure 2 This is a flowchart of a data acquisition method provided in an embodiment of this application;

[0044] Figure 3 This is a flowchart of another data acquisition method provided in an embodiment of this application;

[0045] Figure 4 This is a schematic diagram of filtering operation data provided in an embodiment of this application;

[0046] Figure 5 This is a flowchart of another data acquisition method provided in an embodiment of this application;

[0047] Figure 6 This is a system architecture diagram of a data acquisition method provided in an embodiment of this application;

[0048] Figure 7 This is a schematic diagram of the structure of a data acquisition device provided in an embodiment of this application;

[0049] Figure 8 This is a schematic diagram of another data acquisition device provided in an embodiment of this application;

[0050] Figure 9 This is a schematic diagram of the structure of a terminal provided in an embodiment of this application. Detailed Implementation

[0051] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0052] It is understood that the terms "first," "second," etc., used in this application may be used to describe various concepts herein, but unless otherwise stated, these concepts are not limited by these terms. These terms are only used to distinguish one concept from another. For example, without departing from the scope of this application, a first hook function may be referred to as a second hook function, and similarly, a second hook function may be referred to as a first hook function.

[0053] In this context, "at least one" means one or more functions. For example, at least one function can be one function, two functions, three functions, or any integer number of functions greater than or equal to one. "Multiple" means two or more functions. For example, multiple functions can be two functions, three functions, or any integer number of functions greater than or equal to two. "Each" means each one of the at least one functions. For example, each function means each of the multiple functions. If the multiple functions are three functions, then each function means each of the three functions.

[0054] It is understood that in the embodiments of this application, data such as user information are involved. When the above embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0055] The data acquisition method provided in this application can be used in a terminal. Optionally, the terminal can be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, smart terminal, etc., but is not limited to these.

[0056] Figure 1 This is a schematic diagram of an implementation environment provided in an embodiment of this application. See also... Figure 1 The implementation environment includes: terminal 101 and server 102. Terminal 101 and server 102 are connected via a wireless or wired network.

[0057] This application embodiment applies to the field of video games. Server 102 sends a game client installation package to terminal 101. The game client installation package includes filtering and processing functions provided by the game engine. After installing the game client, terminal 101 calls the filtering and processing functions for processing. The filtering function is used to obtain the raw operation data executed in the game client, filter the raw operation data, and obtain target operation data whose execution frequency is consistent with the game frame rate. The processing function is used to obtain the target operation data output by the filtering function, determine the instruction data triggered by the target operation data, and subsequently render the game screen based on the instruction data.

[0058] In one possible implementation, the game client installation package sent by server 102 to terminal 101 also includes a hook function, which is configured during game client installation. Alternatively, after terminal 101 installs the game client, server 102 sends the hook function to the game client, and terminal 101 updates the game client, configuring the hook function within the game client. The hook function is used to hook the processing function to obtain the target operation data and instruction data obtained by the processing function, thereby achieving the collection of operation data and instruction data generated during the game.

[0059] The data acquisition method provided in this application can be applied to any scenario in a video game where operation data or instruction data needs to be collected.

[0060] In one possible implementation, this application embodiment is applied to a game anti-cheating scenario. The game can be a shooting game, a fighting game, or a strategy simulation game, etc. Taking a shooting game as an example, the scheme proposed in this application embodiment, which involves hooking the processing functions provided by the game engine, is used to collect the operation data performed by the player during the game. After collecting the player's operation data, this operation data is synchronized to the behavior recognition model on the local client at a specific time point. The behavior recognition model is then invoked to identify the player's abnormal operation behavior based on the operation data.

[0061] For example, such abnormal behavior includes using mouse macros, AFK behavior, or game vulnerabilities triggered by performing specific operations. Macro operation refers to an operation or a set of operations used to automatically perform a task, and mouse macro refers to macro operation implemented through the mouse.

[0062] Figure 2 This is a flowchart of a data acquisition method provided in an embodiment of this application. This embodiment is executed by a terminal. See also... Figure 2 The method includes:

[0063] 201. During the running of the game client, the terminal calls a filtering function to obtain the raw operation data executed in the game client, filters the raw operation data to obtain the target operation data, and the execution frequency of the target operation data is consistent with the game frame rate in the game client.

[0064] A game client is installed on the terminal. This game client is configured with a hook function, and also includes filtering and processing functions provided by the game engine. The hook function is used to hook the processing function. Specifically, the hook function adds new processing logic by modifying the original code without changing the original execution effect. The filtering function filters the collected raw operation data, and the processing function receives the filtered operation data and determines the instruction data triggered by the operation data.

[0065] It should be noted that the filtering and processing functions are provided by the game engine. Since the game engine is suitable for various games, these filtering and processing functions are also suitable for various games. They belong to the logic functions of the game engine layer. The logic functions of the game engine layer are code developed based on the game engine and are applicable to different games. That is, any game using this game engine can configure these filtering and processing functions in the game client.

[0066] In this embodiment, during the operation of the game client, the terminal calls the filtering function to obtain the raw operation data executed in the game client. This raw operation data refers to the operation data performed by the user. Since the user can perform multiple operations per second, operation data generated by multiple operations can be obtained per second. The game client can generate multiple game frames per second, and one game frame may correspond to the operation data generated by multiple operations. This results in a non-one-to-one correspondence between game frames and operation data; some operation data can affect the game frame, while others cannot, meaning there is redundant operation data. Therefore, the terminal calls the filtering function to filter the raw operation data, obtaining target operation data whose execution frequency matches the game client's frame rate. This ensures that the target operation data is consistent with the game frame rate, guaranteeing that all target operation data is valid and that there is no redundant operation data.

[0067] 202. The terminal calls the processing function to obtain the target operation data output by the filtering function and determines the instruction data triggered by the target operation data.

[0068] The output data of the filtering function is passed to the processing function as its input data. The terminal calls the processing function, obtains the target operation data output by the filtering function, and determines the instruction data triggered by the target operation data. For example, if the target operation data is to slide the mouse to the left, then the instruction data triggered by the target operation data is to control the virtual object to move to the left.

[0069] 203. The terminal calls the hook function to obtain the target operation data and instruction data obtained by the processing function.

[0070] Because the hook function is used to hook the processing function, calling the hook function allows the user to obtain the target operation data and instruction data received by the processing function. For example, the hook function obtains the input and output data of the processing function by hooking it. The target operation data is the input data of the processing function, and the instruction data is the output data of the processing function. Therefore, the hook function can obtain both the target operation data and the instruction data.

[0071] The method provided in this application embodiment allows the game engine's filtering function to filter raw operation data, obtaining target operation data whose execution frequency matches the game's frame rate. The game engine's processing function receives this target operation data from the filtering function and determines the instruction data triggered by the target operation data. Therefore, by hooking the processing function with a hooking function, the filtered target operation data and corresponding instruction data can be obtained. Since the execution frequency of the target operation data matches the game's frame rate, and each target operation data is valid operation data capable of generating game performance, the target operation data obtained by hooking in this way is more accurate.

[0072] Furthermore, since this hook function is linked to the processing function provided by the game engine, and the game engine is applicable to a variety of games, the processing function is also applicable to a variety of games. Therefore, only the hook function applicable to the processing function needs to be developed, and the hook function can be applied to a variety of games, thus improving applicability.

[0073] The above Figure 2 The illustrated embodiment briefly describes the process of acquiring operational data and instruction data. In the above... Figure 2 Based on the illustrated embodiment, the hook function can be divided into a first hook function and a second hook function, and the processing function can be divided into an input processing function and an instruction processing function. The detailed process of obtaining operation data and instruction data is described below. Figure 3 The example shown. Figure 3 This is a flowchart of a data acquisition method provided in an embodiment of this application. This embodiment is executed by a terminal. See also... Figure 3 The method includes:

[0074] 301. The terminal is running the game client.

[0075] A game client is installed on the terminal. This game client is configured with a hook function, and also includes filtering and processing functions provided by the game engine. The hook function is used to hook the processing function. In this embodiment, the hook function includes a first hook function and a second hook function, and the processing function includes an input processing function and a command processing function. The first hook function hooks the input processing function to obtain target operation data. The second hook function hooks the command processing function to determine the command data triggered by the target operation data.

[0076] It should be noted that the embodiments of this application do not limit the types of the processing input function and the processing instruction function, nor do they limit the hooking positions of the first hook function and the second hook function. For example, the processing input function can be the InputAxis function in Unreal Engine, or the GetAxis function in Unity (a game engine), etc.

[0077] In one possible implementation, the terminal downloads an installation package for the game client, which includes the hook function, the filtering function, and the processing function. The terminal installs the game client through the installation package, thereby configuring the filtering function, the processing function, and the hook function in the game client, and hooking the hook function to the processing function.

[0078] In another possible implementation, the terminal downloads the game client installation package, which includes the filtering and processing functions. The terminal installs the game client using the installation package, thereby configuring the filtering and processing functions within the game client. Subsequently, the terminal can download the hook function separately from the game server using the game client, configure the hook function in the game client, and hook the hook function to the processing function. The hook function is a piece of dynamic code that can be sent to the game client in real time, facilitating adjustments or modifications to the hook function.

[0079] 302. During the operation of the game client, the terminal calls a filtering function to obtain the raw operation data executed in the game client, filters the raw operation data to obtain the target operation data, and the execution frequency of the target operation data is consistent with the game frame rate in the game client.

[0080] During the running of the game client, the terminal calls this filtering function to obtain the raw operation data executed in the game client, filters the raw operation data to obtain target operation data whose execution frequency is consistent with the game client's frame rate, so that the target operation data is consistent with the game screen, ensuring that all target operation data is valid operation data and there is no redundant operation data.

[0081] In one possible implementation, the terminal's operating system provides a collection function, which is a logic function at the operating system layer. This logic function is code provided by the operating system on which the game client runs. During the game client's execution, the terminal calls this collection function to detect the raw operation data executed within the game client. This raw operation data is the data generated by any operation performed by the user associated with the game client. The terminal then calls a filtering function to obtain the raw operation data output by the collection function. The output data of the collection function is used as input data for the filtering function.

[0082] The collection function resides within the terminal's operating system, and the raw operation data collected by this function can be transmitted to any application running on the operating system. For example, using Windows as an example, the raw operation data collected by the collection function can be transmitted to the currently selected window. In this embodiment, when the terminal is running a game client, and the game window corresponding to the game client is selected, the raw operation data collected by the collection function will be passed to the filtering function within the game client.

[0083] Figure 4 This is a schematic diagram of a filtering operation data provided in an embodiment of this application, such as... Figure 4 As shown, the collection functions provided by the operating system collect the raw operational data. Figure 4 Taking the raw operation data, including raw operation data 1-6, as an example, the filtering function provided by the game engine filters these raw operation data. The filtering principle is to make the execution frequency of the remaining operation data consistent with the game frame rate. Figure 4 Taking filtering out original operation 1, original operation data 3, original operation data 4, and original operation data 6 as an example, the remaining original operation data 2 and original operation data 5 are used as target operation data. Subsequently, the triggered command data is determined based on this target operation data, and the game screen is rendered according to the command data, making the target operation data closer to the final game performance. For example, original operation data 1-6 is dragging the mouse downwards to control recoil. Within the duration corresponding to one frame of the game screen, multiple downward mouse dragging operation data will be detected. By filtering the operation data, original operation data 2 and original operation data 5 ultimately affect the game performance.

[0084] 303. The terminal calls the input processing function to obtain the target operation data output by the filtering function.

[0085] The target operation data output by the filtering function is passed to the processing input function. When the terminal calls the processing input function, it can obtain the target operation data output by the filtering function.

[0086] In one possible implementation, the input processing function includes a key input function and an axis input function, and the target operation data includes key operation data and axis operation data. The terminal then calls the processing function to obtain the target operation data output by the filtering function, including the following two cases.

[0087] In the first scenario, the terminal calls a key input function to obtain key operation data output by a filtering function. This key operation data includes at least one of the following: keyboard click data, mouse click data, gamepad click data, or virtual button click data. The key input function collects the filtered key operation data. The keyboard, mouse, and gamepad are different types of input devices connected to the terminal, and the virtual button refers to the virtual button displayed on the terminal's screen.

[0088] Optionally, the mouse button is considered a pivot. When the pivot is pushed to its maximum angle (i.e., pressed all the way down), a click operation is performed on the mouse. Mouse clicks are executed cyclically; that is, if a mouse button is pressed all the way down for a period of time, it will be repeatedly recognized as a click operation. Keyboard clicks, however, are not executed cyclically. Regardless of how long a keyboard key is pressed, it is always recognized as a click operation. Only when the key is released and then pressed again will it be recognized as a second click operation.

[0089] Optionally, the click operation data for the keyboard, mouse, gamepad, and virtual buttons includes key values ​​and key durations, with each key on the keyboard, mouse, and gamepad, as well as each virtual button on the terminal, corresponding to a key value.

[0090] The second scenario: The terminal calls the axis input function to obtain the axis operation data output by the filtering function. The axis operation data includes at least one of the following: drag operation data of the mouse, shaking operation data of the gamepad, or sliding operation data on the screen.

[0091] This includes data on mouse dragging, gamepad shaking, and screen sliding operations, such as movement displacement and duration. Detecting axis operation data can identify automatic auto-fire macros or recoil control macros.

[0092] Taking mouse drag operation data as an example, the mouse is simulated by the game engine as a device with two input axes, namely the X-axis and the Y-axis. This drag operation data package contains the drag operation data of the mouse on the X-axis and the drag operation data on the Y-axis.

[0093] 304. The terminal calls the first hook function to obtain the input data of the input processing function and obtain the target operation data.

[0094] Since the first hook function is used to hook the processing input function, before calling the processing input function to obtain the target operation data, the first hook function is first called to obtain the target operation data to be passed to the processing input function. After the first hook function obtains the target operation data, the processing input function is then called to obtain the target operation data. Essentially, calling the first hook function obtains the input data of the processing input function, and the input data of the processing input function is the target operation data; thus, the target operation data is obtained by calling the first hook function.

[0095] 305. The terminal calls the instruction processing function to determine the instruction data triggered by the target operation data.

[0096] The target operation data is also passed to the processing instruction function. The terminal calls the processing input function and the processing instruction function to determine the instruction data triggered by the target operation data.

[0097] Different operation data are used to trigger different command data. For example, clicking the fire button triggers the fire command data, clicking the weapon switch button triggers the weapon switch command data, clicking the jump button triggers the jump command data, clicking the crouch button triggers the crouch command data, sliding the mouse left triggers the command data to move the view to the left, sliding the mouse right triggers the command data to move the view to the right, sliding the mouse down triggers the command data to move the view down, sliding the mouse up triggers the command data to move the view up, and clicking the 'w' key on the keyboard triggers the command data to control the virtual object to move forward, etc.

[0098] In one possible implementation, the game client stores a first mapping table, which stores any operation data and its corresponding instruction data. The terminal calls a instruction processing function to look up the instruction data corresponding to the target operation data in the first mapping table.

[0099] 306. The terminal calls the second hook function to obtain the output data of the processing instruction function and obtain the instruction data.

[0100] Since the second hook function is used to hook the processing instruction function, after the processing instruction function is called to obtain the instruction data, the second hook function is called to obtain the output data of the processing instruction function. The output data of the processing instruction function is the instruction data, so the target instruction data is obtained by calling the second hook function.

[0101] In this embodiment, the hook function is hooked with the processing function provided by the game engine. Since the processing function obtains filtered target operation data, and the execution frequency of the target operation data is consistent with the game frame rate, the operation data obtained by hooking in this way is all effective operation data that can produce game performance, thus improving accuracy.

[0102] Furthermore, by hooking the hook function with the processing functions provided by the game engine, the instruction data determined by the game engine can be directly obtained, clearly identifying the instruction data triggered by each target operation. Since this game engine is applicable to multiple games, this method is also applicable to multiple games, improving the versatility of the data acquisition method. It eliminates the need to develop different hook functions for different games to perceive the instructions generated in the game, further assisting in confirming the actual meaning of each target operation data and effectively reducing the workload of game adaptation.

[0103] By executing steps 303-304 above, the terminal calls the processing function, obtains the target operation data output by the filtering function, determines the instruction data triggered by the target operation data, calls the hook function, and obtains the target operation data and instruction data obtained by the processing function.

[0104] The method provided in this application embodiment allows the game engine's filtering function to filter raw operation data, obtaining target operation data whose execution frequency matches the game's frame rate. The game engine's processing function receives this target operation data from the filtering function and determines the instruction data triggered by the target operation data. Therefore, by hooking the processing function with a hooking function, the filtered target operation data and corresponding instruction data can be obtained. Since the execution frequency of the target operation data matches the game's frame rate, and each target operation data is valid operation data capable of generating game performance, the target operation data obtained by hooking in this way is more accurate.

[0105] In the above Figure 2 and Figure 3 Based on the embodiments shown, after obtaining the target operation data and instruction data, abnormal operation behaviors can also be identified based on the target operation data and instruction data. For details, please refer to the embodiment shown in Figure 5 below. Figure 5 This is a flowchart of another data acquisition method provided in this application embodiment. This application embodiment is executed by a terminal. See also... Figure 5 The method includes:

[0106] 501. The terminal is running the game client.

[0107] The game client on the terminal is configured with hook functions. The game client includes filtering and processing functions provided by the game engine, and the hook functions are used to hook the processing functions. The process of step 501 is the same as that of step 301 above, and will not be described again here.

[0108] 502. During the operation of the game client, the terminal calls a filtering function to obtain the raw operation data executed in the game client, filters the raw operation data to obtain the target operation data, and the execution frequency of the target operation data is consistent with the game frame rate in the game client.

[0109] The process of step 502 is the same as that of steps 201 and 301 above, and will not be repeated here.

[0110] 503. The terminal calls the processing function to obtain the target operation data output by the filtering function and determines the instruction data triggered by the target operation data.

[0111] The process of step 503 is the same as that of steps 202, 303 and 305 above, and will not be repeated here.

[0112] 504. The terminal calls the hook function to obtain the target operation data and instruction data obtained by the processing function.

[0113] The process of step 504 is the same as that of steps 203, 304 and 306 above, and will not be repeated here.

[0114] 505. The terminal calls the game function provided by the game server, obtains the instruction data output by the processing function, and renders the game screen based on the instruction data.

[0115] The game client also includes game functions provided by the game server. These game functions are logic functions within the game layer, which are code logic written by the game developers and vary from game to game. These game functions are used to render game visuals based on instruction data. The terminal calls this game function, processes the instruction data output by the function, and then renders the game visuals matching the instructions. For example, if the instruction data instructs a virtual object to move left, then the rendered game visuals will show the virtual object moving left.

[0116] Since the execution frequency of the target operation data is consistent with the game frame rate, redundant data is filtered out. The instruction data is triggered by the target operation data, and the game screen is rendered based on the instruction data. This makes the target operation data closer to the game performance generated based on the instruction data. Therefore, the target operation data obtained in this application embodiment are all valid operation data.

[0117] 506. The terminal adds the target operation data to the operation data queue.

[0118] After the terminal obtains the target operation data by calling the hook function, it continues to call the hook function to add the target operation data to the operation data queue, which is used to store the obtained operation data. Optionally, the hook function includes a first hook function, which is used to obtain the target operation data, and the terminal calls the first hook function to add the target operation data to the operation data queue.

[0119] In one possible implementation, the terminal deletes the operation data with the earliest acquisition time from the operation data queue and adds the target operation data to the operation data queue. In this embodiment, whenever new operation data is added to the operation data queue, the old operation data in the queue is deleted. Therefore, the operation data queue can be a queue of fixed length, thereby ensuring that the latest operation data is recorded with minimal memory consumption.

[0120] Optionally, the operation data queue is a circular queue, in which the operation data is arranged in the order of acquisition time. The terminal deletes the last operation data in the operation data queue and adds the target operation data as the first operation data to the operation data queue.

[0121] Optionally, the target operation data includes key operation data and axis operation data, and the operation data queue includes a key operation data queue and an axis operation data queue. The terminal deletes the key operation data with the earliest acquisition time in the key operation data queue and adds the currently acquired key operation data to the key operation data queue. Similarly, the terminal deletes the axis operation data with the earliest acquisition time in the axis operation data queue and adds the currently acquired axis operation data to the axis operation data queue.

[0122] 507. The terminal stores the target operation data and instruction data into the second mapping table, which is used to store the acquired operation data and the corresponding instruction data.

[0123] After the terminal calls the hook function to obtain the target operation data and instruction data, it continues to call the hook function to store the target operation data and instruction data into the second mapping table. Optionally, the hook function includes a second hook function, which obtains the instruction data triggered by the target operation data, and the terminal calls the second hook function to store the target operation data and instruction data into the second mapping table.

[0124] In one possible implementation, the second mapping table is a key-value hash table. Since the query logic of a hash table is relatively simple, using a hash table to store the mapping relationship can reduce the impact of new logic corresponding to the hook function on game performance. This hash table is shown in Table 1 below.

[0125] Table 1

[0126] Operation data 1 Instruction Data 1 Operation data 2 Instruction Data 2 Operation data 3 Instruction Data 3 …… ……

[0127] As shown in Table 1, the operation data is stored in the hash table as the key and the instruction data is stored as the value. The operation data and instruction data are stored in a one-to-one correspondence.

[0128] 508. If the terminal finds that the number of occurrences of the target instruction data in the second mapping table has reached the target number, the number of occurrences of the target instruction data is cleared to zero, and the operation data queue is input into the behavior recognition model. The target instruction data is any instruction data in the second mapping table.

[0129] The terminal periodically queries the second mapping table for the occurrence count of each instruction data. When the terminal finds that the occurrence count of the target instruction data has reached the target number, it clears the occurrence count of the target instruction data to zero and inputs the operation data queue into the behavior recognition model.

[0130] The target instruction data can be any instruction data in the second mapping table. For example, if the target number of times is N (N is a positive integer), and the target instruction data is an instruction to control the virtual object to fire, then when the virtual object fires N times, the operation data queue is input into the behavior recognition model. Alternatively, if the target instruction data is an instruction for the virtual object to defeat an enemy, then when the number of enemies defeated by the virtual object reaches N, the operation data queue is input into the behavior recognition model. Or, if the target instruction data is an instruction for the virtual object to perform a target action, then when the number of times the virtual object performs the target action reaches N, the operation data queue is input into the behavior recognition model.

[0131] The behavior recognition model is used to identify abnormal operational behaviors based on an operation data queue. Optionally, if the behavior recognition model is stored in the game client, the terminal can directly input the operation data queue into the behavior recognition model. Alternatively, if the behavior recognition model is stored in the game server, the terminal reports the operation data queue to the game server, which then inputs the operation data queue into the behavior recognition model.

[0132] In one possible implementation, the game client also includes a data reporting function. This data reporting function and the hook function are issued and configured together in the game client. When the terminal calls the data reporting function and finds that the number of occurrences of the target instruction data in the second mapping table has reached the target number, the number of occurrences of the target instruction data is cleared to zero, and the operation data queue is input into the behavior recognition model.

[0133] In this embodiment, both the data reporting function and the hooking function are dynamic codes sent to the game client. The data reporting function iterates through the operation data queue maintained by the first hooking function and queries the occurrence count of each instruction data according to the second mapping table maintained by the second hooking function. If the occurrence count reaches the target count, the current operation data queue is sent to the behavior recognition model, and the occurrence count of the instruction data is cleared synchronously. When the occurrence count of the instruction data reaches the target count again, the current operation data queue is sent to the behavior recognition model again.

[0134] It should be noted that the execution logic of steps 506, 507 and 508 above is asynchronous, that is, independent of each other. This application embodiment does not limit the execution order of steps 506, 507 and 508 above.

[0135] 509. Terminal call behavior recognition model, based on operation data queue, identifies abnormal operation behavior.

[0136] The terminal invokes the behavior recognition model to identify the operation data in the operation data queue, thereby determining whether the current operation data was generated by abnormal operation behavior. This abnormal operation behavior includes using mouse macros, AFK (away from keyboard) behavior, or triggering game vulnerabilities through specific operations.

[0137] In one possible implementation, the training data for the behavior recognition model is also obtained using the data acquisition method provided in this application embodiment. Redundant operational data can cause differences in the feature distribution of the original operational data samples. Given a limited number of samples, the behavior recognition model may learn to capture feature changes caused by redundant data, even though these feature changes are not caused by abnormal operational behavior. This can lead to the behavior recognition model overfitting meaningless data for classification, affecting its accuracy. However, since the operational data obtained in this application embodiment is all valid operational data that affects game performance, training the behavior recognition model with the operational data obtained using the data acquisition method provided in this application embodiment avoids training the model on invalid operational data, thereby improving the accuracy of the behavior recognition model. Subsequent use of the behavior recognition model to identify the valid operational data obtained in this application embodiment can improve the accuracy of identifying abnormal operational behavior.

[0138] The method provided in this application embodiment allows the game engine's filtering function to filter raw operation data, obtaining target operation data whose execution frequency matches the game's frame rate. The game engine's processing function receives this target operation data from the filtering function and determines the instruction data triggered by the target operation data. Therefore, by hooking the processing function with a hooking function, the filtered target operation data and corresponding instruction data can be obtained. Since the execution frequency of the target operation data matches the game's frame rate, and each target operation data is valid operation data capable of generating game performance, the target operation data obtained by hooking in this way is more accurate.

[0139] Figure 6 This is a system architecture diagram of a data acquisition method provided in an embodiment of this application, such as... Figure 6 As shown, the game server sends dynamic code to the game client. This dynamic code includes a first hook function, a second hook function, and a data reporting function. The first and second hook functions are used to hook logic functions in the game engine layer. The first hook function retrieves an operation data queue to store the retrieved operation data. The second hook function retrieves a second mapping table to store the retrieved operation data and its corresponding instruction data. The data reporting function periodically queries the second mapping table. When the number of occurrences of the target instruction data in the second mapping table reaches a target number, it reports the operation data queue maintained by the first hook function to the game server. The game server then calls the behavior recognition model to identify abnormal behavior data based on this operation data queue.

[0140] The method provided in this application switches the logic for acquiring operation data from the operating system layer to the game engine layer, obtaining filtered operation data that better matches the game's performance. Switching the logic for acquiring instruction data from the game layer to the game engine layer eliminates the need to develop different acquisition logic for different games, reducing the workload of game adaptation.

[0141] Furthermore, by hooking the processing instruction functions provided by the game engine, it is possible not only to perceive the instruction data generated in the game, but also to perceive the operation data that triggers each instruction data. In other words, it is possible to perceive the correspondence between operation data and instruction data, which is beneficial for analyzing abnormal user behavior through operation data and corresponding instruction data.

[0142] To verify the effectiveness of the embodiments of this application, experiments were conducted using the operation data obtained by the methods provided by related technologies and the methods provided by this application to identify mouse macros in shooting games. The operation data obtained by the methods of related technologies is operation data obtained from the operating system layer, and the execution frequency of the operation data is higher than the game frame rate. The operation data obtained by the methods provided by this application is operation data obtained from the game engine layer, and the execution frequency of the operation data is consistent with the game frame rate.

[0143] The identification amount of operation data obtained by using related technologies and the identification amount of operation data obtained by using the method of this application embodiment are shown in Table 2 below.

[0144] Table 2

[0145] Repeated mouse click macro 73 38 recoil control mouse macro 147 33 Total 220 71

[0146] As shown in Table 2, the daily recognition volume of the embodiments of this application is significantly higher than that of related technologies.

[0147] The game adaptation time of the method using related technologies and the game adaptation time of the method in the embodiments of this application are shown in Table 3 below.

[0148] Table 3

[0149]

[0150] Games 1 and 2 are developed based on the same game engine. Therefore, using the method provided in this application, after Game 1 completes its adaptation to the game engine, only a small amount of time is needed for verification during the initial adaptation of Game 2. In contrast, using methods provided by related technologies, both Games 1 and 2 require a longer time to complete their initial adaptation. Furthermore, during game update adaptation, because related technologies hook the logic functions of the game layer, each update requires a significant amount of time to update the hook positions. This solution, however, hooks the logic functions of the game engine layer. Game updates do not cause changes to the logic functions of the game engine layer, therefore, there is no need to update the hook positions; only a small amount of time is needed to confirm the feasibility of the solution.

[0151] Figure 7 This is a schematic diagram of the structure of a data acquisition device provided in an embodiment of this application. See also... Figure 7 The device is installed in a terminal, and the game client on the terminal is configured with a hook function. The game client includes filtering and processing functions provided by the game engine, and the hook function is used to hook the processing function. The device includes:

[0152] The data filtering module 701 is used to call the filtering function during the running of the game client to obtain the raw operation data executed in the game client, filter the raw operation data to obtain the target operation data, and the execution frequency of the target operation data is consistent with the game frame rate in the game client.

[0153] The data processing module 702 is used to call the processing function, obtain the target operation data output by the filtering function, and determine the instruction data triggered by the target operation data;

[0154] The data acquisition module 703 is used to call the hook function to obtain the target operation data and the instruction data obtained by the processing function.

[0155] The data acquisition device provided in this application embodiment uses a filtering function provided by the game engine to filter the original operation data, obtaining target operation data whose execution frequency matches the game frame rate. The processing function provided by the game engine receives the target operation data provided by the filtering function and determines the instruction data triggered by the target operation data. Therefore, by hooking the processing function using a hooking function, the filtered target operation data and corresponding instruction data can be obtained. Since the execution frequency of the target operation data matches the game frame rate, and each target operation data is valid operation data capable of generating game performance, the target operation data obtained by hooking in this way is more accurate.

[0156] Optionally, see Figure 8 The hook function includes a first hook function and a second hook function, and the processing function includes an input processing function and an instruction processing function;

[0157] The first hook function is used to hook the processing input function, which is used to obtain the target operation data;

[0158] The second hook function is used to hook the processing instruction function, which is used to determine the instruction data triggered by the target operation data.

[0159] Optionally, see Figure 8 The data acquisition module 703 is used for:

[0160] Call the first hook function to obtain the input data of the processing input function and get the target operation data;

[0161] Call the second hook function to obtain the output data of the processing instruction function and get the instruction data.

[0162] Optionally, see Figure 8The input processing function includes a key input function and an axis input function; the target operation data includes key operation data and axis operation data; the data processing module 702 is used for:

[0163] Call the key input function to obtain the key operation data output by the filtering function. The key operation data includes at least one of the following: keyboard click operation data, mouse click operation data, gamepad click operation data, or virtual button click operation data.

[0164] Call the axis input function to obtain the axis operation data output by the filter function. The axis operation data includes at least one of the following: mouse drag operation data, gamepad shaking operation data, or screen sliding operation data.

[0165] Optionally, see Figure 8 The data processing module 702 is used for:

[0166] The processing instruction function is called to query the instruction data corresponding to the target operation data in the first mapping table. The first mapping table is used to store any operation data and its corresponding instruction data.

[0167] Optionally, see Figure 8 The device also includes:

[0168] The first storage module 704 is used to add the target operation data to the operation data queue;

[0169] The second storage module 705 is used to store the target operation data and the instruction data in a second mapping table, which is used to store the acquired operation data and the corresponding instruction data.

[0170] Optionally, see Figure 8 The device also includes:

[0171] The query module 706 is used to, when the number of occurrences of target instruction data found in the second mapping relationship table reaches the target number, clear the number of occurrences of the target instruction data to zero, and input the operation data queue into the behavior recognition model. The target instruction data is any instruction data in the second mapping relationship table.

[0172] The identification module 707 is used to call the behavior identification model and identify abnormal operation behaviors based on the operation data queue.

[0173] Optionally, see Figure 8 The first storage module 704 is used for:

[0174] Delete the operation data with the earliest acquisition time in the operation data queue, and add the target operation data to the operation data queue.

[0175] Optionally, see Figure 8 The data filtering module 701 is used for:

[0176] The system calls the collection function provided by the operating system to detect the raw operation data executed in the game client.

[0177] Call the filtering function to obtain the raw operation data output by the collection function.

[0178] Optionally, see Figure 8 The device also includes:

[0179] The rendering module 708 is used to call the game function provided by the game server, obtain the instruction data output by the processing function, and render the game screen based on the instruction data.

[0180] It should be noted that the data acquisition device provided in the above embodiments is only an example of the division of the above functional modules. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the terminal can be divided into different functional modules to complete all or part of the functions described above. In addition, the data acquisition device and the data acquisition method embodiments provided in the above embodiments belong to the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0181] This application also provides a terminal, which includes a processor and a memory. The memory stores at least one computer program, which is loaded and executed by the processor to perform the operations performed in the data acquisition method of the above embodiments.

[0182] Figure 9 A schematic diagram of the structure of a terminal 900 provided in an exemplary embodiment of this application is shown.

[0183] The terminal 900 includes a processor 901 and a memory 902.

[0184] Processor 901 may include one or more processing cores, such as a quad-core processor, an octa-core processor, etc. Processor 901 may be implemented using at least one hardware form selected from DSP (Digital Signal Processing), FPGA (Field Programmable Gate Array), and PLA (Programmable Logic Array). Processor 901 may also include a main processor and a coprocessor. The main processor, also known as a CPU (Central Processing Unit), is used to process data in the wake-up state; the coprocessor is a low-power processor used to process data in the standby state. In some embodiments, processor 901 may integrate a GPU (Graphics Processing Unit), which is responsible for rendering and drawing the content to be displayed on the screen. In some embodiments, processor 901 may also include an AI (Artificial Intelligence) processor, which is used to handle computational operations related to machine learning.

[0185] The memory 902 may include one or more computer-readable storage media, which may be non-transitory. The memory 902 may also include high-speed random access memory and non-volatile memory, such as one or more disk storage devices or flash memory devices. In some embodiments, the non-transitory computer-readable storage media in the memory 902 are used to store at least one computer program, which is used by the processor 901 to implement the data acquisition method provided in the method embodiments of this application.

[0186] In some embodiments, the terminal 900 may also optionally include a peripheral device interface 903 and at least one peripheral device. The processor 901, memory 902, and peripheral device interface 903 can be connected via a bus or signal line. Each peripheral device can be connected to the peripheral device interface 903 via a bus, signal line, or circuit board. Optionally, the peripheral device includes at least one of a radio frequency circuit 904, a display screen 905, a camera assembly 906, an audio circuit 907, and a power supply 908.

[0187] Peripheral device interface 903 can be used to connect at least one I / O (Input / Output) related peripheral device to processor 901 and memory 902. In some embodiments, processor 901, memory 902 and peripheral device interface 903 are integrated on the same chip or circuit board; in some other embodiments, any one or two of processor 901, memory 902 and peripheral device interface 903 can be implemented on separate chips or circuit boards, which is not limited in this embodiment.

[0188] The radio frequency (RF) circuit 904 is used to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The RF circuit 904 communicates with communication networks and other communication devices via electromagnetic signals. The RF circuit 904 converts electrical signals into electromagnetic signals for transmission, or converts received electromagnetic signals back into electrical signals. Optionally, the RF circuit 904 includes: an antenna system, an RF transceiver, one or more amplifiers, a tuner, an oscillator, a digital signal processor, a codec chipset, a user identity module card, etc. The RF circuit 904 can communicate with other devices through at least one wireless communication protocol. This wireless communication protocol includes, but is not limited to: metropolitan area networks (MANs), various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks (WLANs), and / or WiFi (Wireless Fidelity) networks. In some embodiments, the RF circuit 904 may also include circuitry related to NFC (Near Field Communication), which is not limited in this application.

[0189] Display screen 905 is used to display a UI (User Interface). This UI may include graphics, text, icons, videos, and any combination thereof. When display screen 905 is a touch display screen, it also has the ability to collect touch signals on or above its surface. These touch signals can be input as control signals to processor 901 for processing. In this case, display screen 905 can also be used to provide virtual buttons and / or a virtual keyboard, also known as soft buttons and / or a soft keyboard. In some embodiments, there may be one display screen 905, disposed on the front panel of terminal 900; in other embodiments, there may be at least two display screens 905, disposed on different surfaces of terminal 900 or in a folded design; in other embodiments, display screen 905 may be a flexible display screen, disposed on a curved or folded surface of terminal 900. Furthermore, display screen 905 may be configured as a non-rectangular irregular shape, i.e., a non-rectangular screen. Display screen 905 may be made of materials such as LCD (Liquid Crystal Display) or OLED (Organic Light-Emitting Diode).

[0190] The camera assembly 906 is used to acquire images or videos. Optionally, the camera assembly 906 includes a front-facing camera and a rear-facing camera. The front-facing camera is disposed on the front panel of the terminal 900, and the rear-facing camera is disposed on the back of the terminal 900. In some embodiments, there are at least two rear-facing cameras, which are any one of a main camera, a depth-sensing camera, a wide-angle camera, and a telephoto camera, to achieve background blurring by fusion of the main camera and the depth-sensing camera, panoramic shooting by fusion of the main camera and the wide-angle camera, VR (Virtual Reality) shooting, or other fusion shooting functions. In some embodiments, the camera assembly 906 may also include a flash. The flash may be a single-color temperature flash or a dual-color temperature flash. A dual-color temperature flash refers to a combination of a warm light flash and a cool light flash, which can be used for light compensation at different color temperatures.

[0191] The audio circuit 907 may include a microphone and a speaker. The microphone is used to collect sound waves from the user and the environment, converting them into electrical signals that are input to the processor 901 for processing, or to the radio frequency circuit 904 for voice communication. For stereo sound acquisition or noise reduction purposes, multiple microphones may be used, each positioned at a different location on the terminal 900. The microphone may also be an array microphone or an omnidirectional microphone. The speaker is used to convert electrical signals from the processor 901 or the radio frequency circuit 904 into sound waves. The speaker may be a conventional diaphragm speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, it can convert electrical signals not only into audible sound waves but also into inaudible sound waves for purposes such as distance measurement. In some embodiments, the audio circuit 907 may also include a headphone jack.

[0192] Power supply 908 is used to power the various components in terminal 900. Power supply 908 can be AC ​​power, DC power, a disposable battery, or a rechargeable battery. When power supply 908 includes a rechargeable battery, the rechargeable battery can support wired or wireless charging. The rechargeable battery can also be used to support fast charging technology.

[0193] In some embodiments, the terminal 900 further includes one or more sensors 909. The one or more sensors 909 include, but are not limited to, an accelerometer 910, a gyroscope 911, a pressure sensor 912, an optical sensor 913, and a proximity sensor 914.

[0194] Accelerometer 910 can detect the magnitude of acceleration on the three coordinate axes of a coordinate system established by terminal 900. For example, accelerometer 910 can be used to detect the components of gravitational acceleration on the three coordinate axes. Processor 901 can control display screen 905 to display the user interface in either a landscape or portrait view based on the gravitational acceleration signal acquired by accelerometer 910. Accelerometer 910 can also be used for games or for acquiring user motion data.

[0195] The gyroscope sensor 911 can detect the orientation and rotation angle of the terminal 900. The gyroscope sensor 911, in conjunction with the accelerometer sensor 910, can collect the user's 3D movements on the terminal 900. Based on the data collected by the gyroscope sensor 911, the processor 901 can perform the following functions: motion sensing (e.g., changing the UI based on the user's tilt), image stabilization during shooting, game control, and inertial navigation.

[0196] The pressure sensor 912 can be disposed on the side bezel of the terminal 900 and / or the lower layer of the display screen 905. When the pressure sensor 912 is disposed on the side bezel of the terminal 900, it can detect the user's grip signal on the terminal 900, and the processor 901 can perform left / right hand recognition or quick operation based on the grip signal collected by the pressure sensor 912. When the pressure sensor 912 is disposed on the lower layer of the display screen 905, the processor 901 can control the operable controls on the UI interface based on the user's pressure operation on the display screen 905. The operable controls include at least one of button controls, scroll bar controls, icon controls, and menu controls.

[0197] An optical sensor 913 is used to collect ambient light intensity. In one embodiment, the processor 901 can control the display brightness of the display screen 905 based on the ambient light intensity collected by the optical sensor 913. Optionally, when the ambient light intensity is high, the display brightness of the display screen 905 is increased; when the ambient light intensity is low, the display brightness of the display screen 905 is decreased. In another embodiment, the processor 901 can also dynamically adjust the shooting parameters of the camera assembly 906 based on the ambient light intensity collected by the optical sensor 913.

[0198] The proximity sensor 914, also known as the distance sensor, is installed on the front panel of the terminal 900. The proximity sensor 914 is used to detect the distance between the user and the front of the terminal 900. In one embodiment, when the proximity sensor 914 detects that the distance between the user and the front of the terminal 900 is gradually decreasing, the processor 901 controls the display screen 905 to switch from a screen-on state to a screen-off state; when the proximity sensor 914 detects that the distance between the user and the front of the terminal 900 is gradually increasing, the processor 901 controls the display screen 905 to switch from a screen-off state to a screen-on state.

[0199] Those skilled in the art will understand that Figure 9 The structure shown does not constitute a limitation on terminal 900, and may include more or fewer components than shown, or combine certain components, or use different component arrangements.

[0200] This application also provides a computer-readable storage medium storing at least one computer program, which is loaded and executed by a processor to implement the operations performed by the data acquisition method of the above embodiments.

[0201] This application also provides a computer program product, including a computer program that is loaded and executed by a processor to perform the operations performed by the data acquisition method of the above embodiments.

[0202] Those skilled in the art will understand that all or part of the steps of the above embodiments can be implemented by hardware or by a program instructing related hardware. The program can be stored in a computer-readable storage medium, such as a read-only memory, a disk, or an optical disk.

[0203] The above description is only an optional embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present application should be included within the protection scope of the present application.

Claims

1. A data acquisition method, characterized in that, Executed by a terminal, the game client on the terminal is configured with a hook function, the game client includes a filtering function and a processing function provided by the game engine, and the hook function is used to hook the processing function; The method includes: During the operation of the game client, the filtering function is called to obtain the raw operation data executed in the game client, and the raw operation data is filtered to obtain the target operation data. The execution frequency of the target operation data is consistent with the game frame rate in the game client. Call the processing function to obtain the target operation data output by the filtering function, and determine the instruction data triggered by the target operation data; The hook function is invoked to obtain the target operation data and the instruction data obtained by the processing function.

2. The method according to claim 1, characterized in that, The hook function includes a first hook function and a second hook function, and the processing function includes an input processing function and an instruction processing function; The first hook function is used to hook the processing input function, and the processing input function is used to obtain the target operation data; The second hook function is used to hook the processing instruction function, which is used to determine the instruction data triggered by the target operation data.

3. The method according to claim 2, characterized in that, The step of calling the hook function to obtain the target operation data and the instruction data obtained by the processing function includes: Call the first hook function to obtain the input data of the processing input function, and obtain the target operation data; The second hook function is called to obtain the output data of the processing instruction function, and the instruction data is obtained.

4. The method according to claim 2, characterized in that, The input processing function includes a key input function and an axis input function, and the target operation data includes key operation data and axis operation data; the step of calling the processing function to obtain the target operation data output by the filtering function includes: The button input function is called to obtain the button operation data output by the filtering function. The button operation data includes at least one of the following: keyboard click operation data, mouse click operation data, gamepad click operation data, or virtual button click operation data. The axis input function is called to obtain the axis operation data output by the filtering function. The axis operation data includes at least one of the following: drag operation data of the mouse, shaking operation data of the gamepad, or sliding operation data on the screen.

5. The method according to claim 2, characterized in that, The instruction data for determining the target operation data trigger includes: The processing instruction function is invoked to query the instruction data corresponding to the target operation data in the first mapping table, which is used to store any operation data and its corresponding instruction data.

6. The method according to claim 1, characterized in that, After calling the hook function to obtain the target operation data and the instruction data obtained by the processing function, the method further includes: Add the target operation data to the operation data queue; The target operation data and the instruction data are stored in a second mapping table, which is used to store the acquired operation data and the corresponding instruction data.

7. The method according to claim 6, characterized in that, The method further includes: If the number of occurrences of the target instruction data found in the second mapping table reaches the target number, the number of occurrences of the target instruction data is cleared to zero, and the operation data queue is input into the behavior recognition model. The target instruction data is any instruction data in the second mapping table. The behavior recognition model is invoked to identify abnormal operation behaviors based on the operation data queue.

8. The method according to claim 6, characterized in that, Adding the target operation data to the operation data queue includes: Delete the operation data with the earliest acquisition time in the operation data queue, and add the target operation data to the operation data queue.

9. The method according to any one of claims 1-8, characterized in that, The step of calling the filtering function to obtain the raw operation data executed in the game client includes: The system calls a collection function provided by the operating system to detect the raw operation data executed in the game client. The filtering function is invoked to obtain the raw operation data output by the collection function.

10. The method according to any one of claims 1-8, characterized in that, After calling the processing function, obtaining the target operation data output by the filtering function, and determining the instruction data triggered by the target operation data, the method further includes: The game functions provided by the game server are called to obtain the instruction data output by the processing function, and the game screen is rendered based on the instruction data.

11. A data acquisition device, characterized in that, The game client on the terminal is configured with a hook function, which includes filtering and processing functions provided by the game engine. The hook function is used to hook the processing function. The device includes: The data filtering module is used to call the filtering function during the operation of the game client, obtain the raw operation data executed in the game client, filter the raw operation data to obtain target operation data, and the execution frequency of the target operation data is consistent with the game frame rate in the game client. The data processing module is used to call the processing function, obtain the target operation data output by the filtering function, and determine the instruction data triggered by the target operation data; The data acquisition module is used to call the hook function to obtain the target operation data and the instruction data obtained by the processing function.

12. A terminal, characterized in that, The terminal includes a processor and a memory, the memory storing at least one computer program, which is loaded and executed by the processor to perform the operations performed by the data acquisition method as described in any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one computer program, which is loaded and executed by a processor to perform the operations of the data acquisition method as described in any one of claims 1 to 10.

14. A computer program product, comprising a computer program, characterized in that, The computer program is loaded and executed by a processor to perform the operations performed by the data acquisition method as described in any one of claims 1 to 10.

Images