Training method and device of game anomaly detection model, medium and equipment

Abstract

The invention discloses a game anomaly detection model training method and device, a medium and equipment, and the method comprises the steps: determining historical game data of a sample player, and determining data of a specified dimension according to the historical game data, and taking the data as first data; then determining a historical detection result of the sample player, and training a plurality of to-be-trained initial detection models according to the first data and the historical detection result to obtain each initial detection model; and then, determining a game anomaly detection model from the initial detection models. Through the first data and the historical detection result, the to-be-trained initial detection models of different model structures are trained, so that the detection result output by each trained initial detection model is more accurate. Moreover, the final game anomaly detection model is determined from the initial detection models, so that the detection result determined by the game anomaly detection model is more accurate, and the fairness and ecological environment of the game can be effectively prevented from being damaged by abnormal behaviors.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, medium and equipment for training a game anomaly detection model. Background Art

[0002] With the continuous development of technology, games are developing faster and faster, and more and more types of games are emerging.

[0003] At present, players usually log in to their game accounts through their devices to enter the game, and then perform tasks in the game according to the game rules. However, during the game, players may behave abnormally, thereby undermining the fairness and ecological environment of the game. Such abnormal behaviors may include using illegal or cheating means to gain experience, stealing other players' game accounts, and using third-party software to perform game tasks. Therefore, how to train a game anomaly detection model to detect whether players have abnormal behavior is a very important issue.

[0004] Based on this, this specification provides a method for training a game anomaly detection model. Summary of the invention

[0005] This specification provides a method, device, medium and equipment for training a game anomaly detection model to partially solve the above-mentioned problems existing in the prior art.

[0006] This manual adopts the following technical solutions:

[0007] This specification provides a method for training a game anomaly detection model, including:

[0008] Determine the historical game data of sample players;

[0009] Determine data of a specified dimension according to the historical game data and use the data as first data;

[0010] Determine the historical detection results of the sample players, and train a plurality of initial detection models to be trained according to the first data and the historical detection results to obtain each initial detection model; wherein the model structures of each initial detection model are different;

[0011] A game anomaly detection model is determined from the initial detection models.

[0012] Optionally, the historical game data at least includes an installation identifier and login data, and the login data includes several login times and several device information;

[0013] According to the historical game data, data of a specified dimension is determined as first data, specifically including:

[0014] Determine the time difference between the login times according to the login times in the login data; divide the device information in the login data to obtain data groups, and determine the first number of the data groups; wherein the device information in the data groups is the same;

[0015] Determine the login time of the sample player according to each time difference; determine the login device of the sample player according to the first number;

[0016] The login time situation, the login device situation and the installation identifier are used as the first data of the specified dimension.

[0017] Optionally, the historical game data includes a number of first dimension data;

[0018] According to the first data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model, specifically including:

[0019] For each first dimension of data included in the historical game data, determining an importance score corresponding to the first dimension of data according to a preset scoring rule corresponding to the first dimension of data;

[0020] Determining second data from the historical game data according to the importance scores respectively corresponding to the data of the first dimensions;

[0021] According to the first data, the second data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model.

[0022] Optionally, training a plurality of initial detection models to be trained according to the first data and the historical detection results to obtain each initial detection model specifically includes:

[0023] Determine a feature corresponding to the first data and use it as a sample feature;

[0024] Performing feature screening on the sample features according to the historical test results;

[0025] Based on the screened sample features and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model.

[0026] Optionally, the method further comprises:

[0027] Collect the game data to be tested corresponding to the players to be tested according to the specified period;

[0028] Determine the data of the specified dimension according to the game data to be detected, and use it as input data;

[0029] Inputting the input data into the game anomaly detection model to determine the target detection result corresponding to the player to be detected;

[0030] Determine, according to the target detection result, an exception handling strategy corresponding to the player to be detected;

[0031] According to the exception handling strategy, the player to be detected is managed and controlled.

[0032] Optionally, the method further comprises:

[0033] Obtaining feedback information from the player to be detected;

[0034] Adjusting the target detection result according to the feedback information;

[0035] Training each of the initial detection models according to the input data and the adjusted target detection results;

[0036] A first detection model is determined from each trained initial detection model, and the game abnormality detection model is replaced with the first detection model.

[0037] Optionally, determining a game anomaly detection model from the initial detection models specifically includes:

[0038] Determining a test sample and a test annotation corresponding to the test sample;

[0039] For each initial detection model, input the test sample into the initial detection model to determine the test result output by the initial detection model;

[0040] Determining a similarity between the test result and the test annotation;

[0041] The maximum similarity among the similarities is determined, and the initial detection model corresponding to the maximum similarity is used as the game anomaly detection model.

[0042] This specification provides a training device for a game anomaly detection model, including:

[0043] A first determination module is used to determine the historical game data of the sample players;

[0044] A second determination module, configured to determine data of a specified dimension according to the historical game data, and use the data as the first data;

[0045] A training module, used to determine the historical detection results of the sample players, and train a plurality of initial detection models to be trained according to the first data and the historical detection results to obtain each initial detection model; wherein the model structures of each initial detection model are different;

[0046] The third determination module is used to determine a game anomaly detection model from the initial detection models.

[0047] This specification provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the training method of the above-mentioned game anomaly detection model is implemented.

[0048] This specification provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-mentioned method for training a game anomaly detection model when executing the program.

[0049] At least one of the above technical solutions adopted in this specification can achieve the following beneficial effects:

[0050] The method for training a game anomaly detection model provided in this specification determines the historical game data of a sample player, and then determines the data of a specified dimension based on the historical game data and uses it as the first data. Then, the historical detection results of the sample player are determined, and based on the first data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model. Afterwards, a game anomaly detection model is determined from each initial detection model.

[0051] It can be seen from the above method that when training the game anomaly detection model, the present application can determine the historical game data of the sample players, and then determine the data of the specified dimension based on the historical game data, and use it as the first data. Then determine the historical detection results of the sample players, and train several initial detection models to be trained based on the first data and the historical detection results to obtain each initial detection model. Afterwards, determine the game anomaly detection model from each initial detection model. By training the initial detection models to be trained with different model structures through the first data and the historical detection results, the detection results output by each initial detection model after training can be made more accurate. In addition, determining the final game anomaly detection model from each initial detection model can make the detection results determined by the game anomaly detection model more accurate, which can effectively prevent abnormal behavior from destroying the fairness and ecological environment of the game. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] The drawings described herein are used to provide a further understanding of this specification and constitute a part of this specification. The illustrative embodiments and descriptions of this specification are used to explain this specification and do not constitute an improper limitation on this specification. In the drawings:

[0053] Figure 1 A flowchart of a method for training a game anomaly detection model provided in this specification;

[0054] Figure 2 A schematic diagram of a process of training each initial detection model to be trained provided in this specification;

[0055] Figure 3 A schematic diagram of a training device structure for a game anomaly detection model provided in this specification;

[0056] Figure 4 A method corresponding to the Figure 1 Schematic diagram of the structure of an electronic device. DETAILED DESCRIPTION

[0057] In order to make the purpose, technical solutions and advantages of this specification more clear, the technical solutions of this specification will be clearly and completely described below in combination with the specific embodiments of this specification and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of this specification, not all of them. Based on the embodiments in this specification, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this specification.

[0058] The technical solutions provided by the embodiments of this specification are described in detail below in conjunction with the accompanying drawings.

[0059] Figure 1 The flowchart of a method for training a game anomaly detection model provided in this specification includes the following steps:

[0060] S100: Determine historical game data of sample players.

[0061] In this specification, the device for training the game anomaly detection model can determine the historical game data of the sample players. The device for training the game anomaly detection model can be a server or an electronic device such as a desktop computer or a laptop computer. For ease of description, the following only takes the server as the execution subject to illustrate the training method of the game anomaly detection model provided in this specification.

[0062] The above-mentioned sample players may be players who have registered for the game in the past, and the sample players may be players who have had abnormal behavior in the past, or players who have not had abnormal behavior in the past. In order to better train the game anomaly detection model so that the trained game anomaly detection model can better detect the abnormal behavior of game players, the above-mentioned sample players may include players who have had abnormal behavior in the past and players who have not had abnormal behavior in the past. The above-mentioned abnormal behavior may be the use of third-party software, applications, scripts, etc. to perform game tasks, that is, the use of "plug-ins" to perform game tasks, thereby destroying the fairness and ecological environment of the game. Of course, the above-mentioned abnormal behavior may also include the use of illegal or cheating means to brush experience, such as using scripts to brush experience, and may also include stealing other players' game accounts, that is, "stealing accounts", and posting advertisements of other games in the game to divert traffic to other games. For each abnormal behavior, the server can train a model for detecting the abnormal behavior separately. For the sake of convenience, the following is an example of abnormal behavior including the use of "plug-ins" to perform game tasks.

[0063] The above historical game data is the data generated by the sample players in the game process in history, and the historical game data at least includes the installation identification and login data. The above installation identification indicates that the device used by the player has successfully installed the game, and the installation identification is unique, and the installation identification is a unique identification. The device can be a terminal, such as a mobile phone, or a computer or a simulator. The above login data may include several login times and several device information, and the login time is a corresponding relationship between the device information. The login time is the time when the sample player logs into the game each time in history, and the device information is the information corresponding to the device used by the sample player each time he logs into the game in history. The device information includes device identification, kernel, memory and central processing unit (CPU) information. Each time a sample player logs into the game, the time when the sample player logs into the game, that is, the login time, and the information of the device used when logging into the game, that is, the device information, will be recorded.

[0064] Of course, in addition to several login times and several device information, the above login data may also include account information and player information. The account information is the information corresponding to the game account of the sample player each time he logs into the game. The account information may include the account name, account identifier and zone information. The zone information is the information of the server selected by the sample player. The zone information includes the zone identifier and the zone name. The zone is the server partition in the game. Players can choose different servers to play the same game. Each zone is an independent game world. The zone can be divided according to region, language or version. The above player information may include game level, game experience value and winning rate. In addition to the installation identifier and login data, the above historical game data may also include game event data, game operation data and transaction data. The game event data includes data such as game tasks, game levels and activity performed by sample players. The game operation data includes the strength of pressing the device when the sample player performs the game task, the position and perspective of the virtual character in the game, etc. The virtual character is a character in the game. Each player in the game has a corresponding game character, that is, a virtual character. The virtual character can be pre-selected by the player. The above-mentioned position or perspective of the virtual character is the position of the virtual character in the game scene or the perspective corresponding to the virtual character. The above-mentioned transaction data includes the number of recharges and the recharge amount of the sample players.

[0065] S102: Determine data of a specified dimension based on the historical game data and use it as first data.

[0066] In this specification, the server can determine the data of the specified dimension according to the historical game data, and use it as the first data. Among them, the specified dimension can be preset by the server, and the data of the specified dimension can include the installation identification and the login time of the sample players. For players who use the simulator to run "plug-ins" and perform game tasks, that is, players with abnormal behavior, the player may repeatedly install the game many times, that is, perform the process of "installing the game-uninstalling the game" many times, so there may be multiple installation identifications, while players without abnormal behavior may only install the game once, so there may be only one installation identification. Therefore, the first data includes the installation identification, so that the subsequent detection results determined based on the installation identification are more accurate. In addition, the login time situation can reflect the fluctuation of the player's login time, so the first data includes the login time situation, which also makes the subsequent detection results determined based on the login time situation more accurate.

[0067] Specifically, the server can determine the time difference between each login time according to each login time in the login data. According to each time difference, the login time situation of the sample player is determined. Then the login time situation and the installation identifier are used as the first data of the specified dimension. Among them, the time difference between the above login times can be the time difference between each adjacent login time. For example, there are 4 login times, namely login time 1 to 4, and the time difference can be 4 time differences between login time 1 and login time 2, login time 2 and login time 3, and login time 3 and login time 4. When determining the login time situation of the sample player according to each time difference, the server can determine the mean corresponding to each time difference, determine the variance or standard deviation according to the mean, and then use the variance or standard deviation as the login time situation of the sample player. Of course, the server can also determine the login time situation of the sample player according to the determined variance or standard deviation, and the login time situation includes a large login time fluctuation and a small login time fluctuation.

[0068] In addition, the data of the above-mentioned specified dimension (i.e., the first data) may also include the login device status of the sample players. For players without abnormal behavior, one type of device is generally used to log in to the game, while players with abnormal behavior may use multiple types of devices to log in to the game. The login device status characterizes how many types of devices the player has used to log in to the game in history. Therefore, the first data includes the login device status, which can make the subsequent detection results determined based on the login device status more accurate. Based on this, the server can determine the time difference between each login time according to each login time in the login data. At the same time, the device information in the login data is divided to obtain each data group, and the first number of each data group is determined. Afterwards, the login time situation of the sample player is determined according to each time difference. And, according to the first number, the login device situation of the sample player is determined. Then the login time situation, login device situation and installation identification are used as the first data of the specified dimension.

[0069] Among them, the device information in the above data groups is the same, that is, the same device information in each device information is divided into one data group. When the device information in the login data is divided to obtain each data group, the server can determine other device information that is the same as the device information for each device information, and divide the device information and the determined other device information into one data group. Determine each data group, and the device information included in each data group is the same. The above first quantity is the number corresponding to each data group, and the number of data groups is the same as the first quantity. The above login device situation can be the first quantity, which represents how many devices the sample player has used to log in to the game in history.

[0070] S104: Determine the historical detection results of the sample players, and train a number of initial detection models to be trained based on the first data and the historical detection results to obtain each initial detection model; wherein the model structures of the initial detection models are different.

[0071] In this specification, the server can determine the historical detection results of the sample players, and train several initial detection models to be trained according to the first data and the historical detection results. Among them, the historical detection results can be one of the presence of abnormal behavior and the absence of abnormal behavior. The historical detection results can be marked by the risk control personnel, and the risk control personnel can mark the sample players according to the historical game data of the sample players to obtain the historical detection results of the sample players. Of course, the historical detection results can also be determined by other risk control means or risk control systems in history, which is not specifically limited in this specification. The model structures of the above-mentioned initial detection models to be trained or the initial detection models are all different. The initial detection models to be trained or the initial detection models can be models of the GPT (Generative Pre-trained Transformer) series, and can also be models of the BERT (Bidirectional Encoder Representations from Transformers) structure, or can be traditional machine learning models, i.e. linear regression models, logistic regression models, support vector machine (SVM) models, etc., and deep learning models, i.e. feedforward neural networks, recurrent neural networks, Transformer structure models, generative adversarial networks, etc., which are not specifically limited in this specification. The initial detection model to be trained may be any trained model or an untrained model, and this specification does not make any specific limitation.

[0072] In the above-mentioned case, when several initial detection models to be trained are trained according to the first data and the historical detection results to obtain each initial detection model, the server can input the first data into the initial detection model to be trained for each initial detection model to be trained, determine the output result of the initial detection model to be trained, and train the initial detection model to be trained according to the output result and the historical detection result to obtain a trained initial detection model. Among them, when the initial detection model to be trained is trained according to the output result and the historical detection result to obtain a trained initial detection model, the server can train the initial detection model to be trained with the goal of minimizing the difference between the output result and the historical detection result to obtain a trained initial detection model. Of course, the server can also determine the difference between the output result and the historical detection result, and determine the loss based on the difference, and train the trained initial detection model based on the loss to obtain a trained initial detection model. Specifically, it can be as follows Figure 2As shown, Figure 2 is a schematic diagram of a process of training each initial detection model to be trained provided in this specification, Figure 2 In the process shown, there are n initial detection models to be trained, namely, initial detection models 1 to n to be trained. Similarly, there are n initial detection models, namely, initial detection models 1 to n. The server can respectively train the initial detection models 1 to n to be trained based on the first data and the historical detection results, thereby obtaining the trained initial detection models 1 to n.

[0073] S106: Determine a game anomaly detection model from the initial detection models.

[0074] In this specification, the server may determine a game anomaly detection model from each initial detection model. The game anomaly detection model is a model in the above-mentioned initial detection models. Specifically, the server may randomly select an initial detection model from each initial detection model and use it as the game anomaly detection model. The game anomaly detection model may be used to determine the detection result of the player to be detected based on the game data of the player to be detected.

[0075] In addition, the server may also determine the test sample and the test annotation corresponding to the test sample, and then input the test sample into the initial detection model for each initial detection model, determine the test result output by the initial detection model, and determine the similarity between the test result and the test annotation. Then determine the maximum similarity among the similarities, and use the initial detection model corresponding to the maximum similarity as the game anomaly detection model. Among them, the above-mentioned test sample may be the game data corresponding to the historical players, and the test annotation may be one of the presence of abnormal behavior and the absence of abnormal behavior. When determining the similarity between the test result and the test annotation, the server may use any existing similarity algorithm or model to determine the similarity between the test result and the test annotation. The greater the similarity between the test result and the test annotation, the higher the accuracy of the result output by the initial detection model. The server may select the initial detection model with the highest accuracy (i.e., the initial detection model corresponding to the maximum similarity) from each initial detection model as the game anomaly detection model. When the test sample is input into the initial detection model and the test result output by the initial detection model is determined, the server may determine the data of the specified dimension according to the test sample and use it as the test data. Then the test data is input into the initial detection model to determine the test result output by the initial detection model. In addition, the server can also use any existing means to determine the accuracy of each initial detection model, and then select the initial detection model with the highest accuracy as the game anomaly detection model.

[0076] It can be seen from the above method that when training the game anomaly detection model, the server of this application can determine the historical game data of the sample players, and then determine the data of the specified dimension based on the historical game data, and use it as the first data. Then determine the historical detection results of the sample players, and train several initial detection models to be trained based on the first data and the historical detection results to obtain each initial detection model. Afterwards, determine the game anomaly detection model from each initial detection model. By training the initial detection models to be trained with different model structures through the first data and historical detection results, the detection results output by each initial detection model after training can be made more accurate. In addition, determining the final game anomaly detection model from each initial detection model can make the detection results determined by the game anomaly detection model more accurate, which can effectively prevent abnormal behavior from destroying the fairness and ecological environment of the game.

[0077] In this specification, in order to better train each initial detection model to be trained, in the above step S104, according to the first data and the historical detection results, several initial detection models to be trained are trained. When each initial detection model is obtained, the server may first determine the features corresponding to the first data and use them as sample features. According to the historical detection results, the sample features are feature screened. Based on the screened sample features and historical detection results, several initial detection models to be trained are trained to obtain each initial detection model. Among them, when determining the features corresponding to the first data, the server may use a pre-trained feature extraction layer to determine the features corresponding to the first data. The feature extraction layer may be a network layer pre-trained by the server, or any existing network layer, which is not specifically limited in this specification. Of course, the server may also input the first data into any initial detection model to be trained to determine the features corresponding to the first data, which is not specifically limited in this specification.

[0078] The above-mentioned sample features include sub-features of several dimensions, namely, each sub-feature. When the sample features are screened according to the historical test results, the server may use a pre-set correlation analysis method for each sub-feature to determine the correlation between the sub-feature and the historical test results. According to each correlation, the sample features are screened. Among them, the correlation analysis method may be any one of the Pearson correlation coefficient, Spearman rank correlation coefficient or chi-square test, etc. The specific correlation analysis method is not specifically limited in this specification. When the sample features are screened according to each correlation, the server may use each sub-feature as a target sub-feature when the correlation of the sub-feature is greater than a first threshold, and use each target sub-feature as a screened sample feature. The first threshold is a numerical value preset by the server.

[0079] In addition, when the sample features are screened according to the historical detection results, the server may also use a pre-trained feature evaluation model to determine the importance of each sub-feature, and perform feature screening on the sample features according to each importance. Wherein. The feature evaluation model may be a decision tree or a random forest. The feature evaluation model may be a model pre-trained by the server, or any existing model, and this specification does not make specific restrictions. When the sample features are screened according to each importance, the server may, for each sub-feature, use the sub-feature as the target sub-feature when the importance of the sub-feature is greater than the second threshold, and use each target sub-feature as the screened sample feature. The second threshold is a numerical value preset by the server. Of course, the server may also use any existing method to perform feature screening on the sample features based on the historical detection results, and this specification does not make specific restrictions.

[0080] Based on the screened sample features and historical detection results, several initial detection models to be trained are trained. When each initial detection model is obtained, the server can input the screened sample features into the initial detection model to be trained for each initial detection model to be trained, determine the output result of the initial detection model to be trained, and train the initial detection model to be trained according to the output result and historical detection results to obtain a trained initial detection model.

[0081] In this specification, in order to increase the diversity of training data and thus better train each initial detection model to be trained, in the above step S104, several initial detection models to be trained are trained according to the first data and historical detection results to obtain each initial detection model. The server can train several initial detection models to be trained according to the first data and historical game data to obtain each initial detection model.

[0082] Furthermore, in order to avoid interference of unimportant dimension data in the historical game data on the model, in the above step S104, several initial detection models to be trained are trained according to the first data and the historical detection results. When each initial detection model is obtained, the above historical game data includes several first dimension data. The server can determine the importance score corresponding to each first dimension data included in the historical game data according to the pre-set scoring rules corresponding to the first dimension data. According to the importance scores corresponding to each first dimension data, the second data is determined from the historical game data. According to the first data, the second data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model.

[0083] Among them, each data of the first dimension has a corresponding scoring rule, and the scoring rule can be used to determine the importance score corresponding to the data of the first dimension, and the scoring rule can be preset by the server. The scoring rule corresponding to the data of the first dimension can be to determine whether the data of the first dimension meets the conditions preset in the scoring rule, so as to determine the importance score corresponding to the data of the first dimension. Specifically, taking the data of the first dimension as the number of logins as an example, the condition preset in the scoring rule corresponding to the data of the first dimension is the first number, so the scoring rule corresponding to the data of the first dimension can be that when the number of logins is greater than the first number, the number of logins meets the preset condition, so the importance score corresponding to the data of the first dimension is the first score, and when the number of logins is not greater than the first number, the number of logins does not meet the preset condition, so the importance score corresponding to the data of the first dimension is the second score. The first score and the second score are both numerical values ​​preset by the server.

[0084] When determining the importance score corresponding to the data of the first dimension based on the pre-set scoring rules corresponding to the data of the first dimension, the server may also display the pre-set scoring rules corresponding to the data of the first dimension and the data of the first dimension to the risk control personnel, so that the risk control personnel can determine the importance score corresponding to the data of the first dimension based on the pre-set scoring rules corresponding to the data of the first dimension, and upload it to the server, so that the server can determine the importance score corresponding to the data of the first dimension in response to the upload scoring operation of the risk control personnel.

[0085] When determining the second data from the historical game data according to the importance scores corresponding to the data of each first dimension, the server may sort the data of each first dimension in descending order according to the importance scores corresponding to the data of each first dimension to obtain a first sequence. Afterwards, a specified number of data is determined according to the order of the first sequence and used as the second data. The specified number may be a value preset by the server. The server may also use the data of each first dimension as the second data when the importance score corresponding to the data of the first dimension is greater than a specified threshold. The specified threshold is a value preset by the server.

[0086] In the above-mentioned process, several initial detection models to be trained are trained based on the first data, the second data and the historical detection results. When each initial detection model is obtained, the server can input the first data and the second data into the initial detection model to be trained for each initial detection model to be trained, determine the output result of the initial detection model to be trained, and train the initial detection model to be trained based on the output result and the historical detection results to obtain a trained initial detection model.

[0087] In this specification, after obtaining the game anomaly detection model, the server can collect the data to be detected corresponding to the player to be detected in real time, determine the data of the specified dimension according to the data to be detected, and use it as input data. Then input the input data into the game anomaly detection model to determine the target detection result corresponding to the player to be detected. After that, determine the abnormality handling strategy corresponding to the player to be detected according to the target detection result. According to the abnormality handling strategy, the player to be detected is managed and controlled. Among them, the above-mentioned player to be detected may be a player who has registered for the game. The above-mentioned game data to be detected is the game data corresponding to the player to be detected. The above-mentioned process of determining the data of the specified dimension according to the data to be detected and using it as input data is similar to the content described in the above-mentioned step S102, and will not be repeated here. The above-mentioned target detection result may be one of the presence of abnormal behavior and the absence of abnormal behavior, and may also be the probability of the presence of abnormal behavior, which is not specifically limited in this specification. When the input data is input into the game anomaly detection model to determine the target detection result corresponding to the player to be detected, the server may input the game data to be detected and the input data into the game anomaly detection model to determine the target detection result corresponding to the player to be detected. The server can also determine the importance score corresponding to each second dimension data included in the game data to be detected according to the pre-set scoring rules corresponding to the second dimension data. According to the importance scores corresponding to the data of each second dimension, the third data is determined from the game data to be detected. The third data and the input data are input into the game anomaly detection model to determine the target detection result corresponding to the player to be detected. The game data to be detected includes a plurality of second dimension data.

[0088] When determining the exception handling strategy corresponding to the player to be detected based on the target detection result, the server can determine the exception handling strategy corresponding to the player to be detected from the pre-set first strategy library based on the target detection result. The first strategy library is pre-set by the server, and the first strategy library includes a number of exception handling strategies, and each exception handling strategy has a corresponding relationship with the target detection result. In addition, the server can also determine the game type corresponding to the game of the player to be detected, and determine the pre-set second strategy library corresponding to the game type, and then determine the exception handling strategy corresponding to the player to be detected from the second strategy library based on the target detection result. Each game type has a corresponding second strategy library, which is pre-set by the server, and the second strategy library includes a number of exception handling strategies, and each exception handling strategy has a corresponding relationship with the target detection result.

[0089] The above-mentioned exception handling strategy includes sending warning information to the player to be detected, banning the game account of the player to be detected, etc. When the player to be detected is controlled according to the above-mentioned exception handling strategy, the server can adopt the exception handling strategy to control the player to be detected.

[0090] In this specification, after obtaining the game anomaly detection model, the server can collect the game data to be detected corresponding to the player to be detected according to the specified period, and determine the data of the specified dimension according to the data to be detected, and use it as input data. Then input the input data into the game anomaly detection model to determine the target detection result corresponding to the player to be detected. After that, according to the target detection result, determine the exception handling strategy corresponding to the player to be detected. According to the exception handling strategy, the player to be detected is managed and controlled. Among them, the specified period is a period pre-set by the server, and the specified period can be one day or one week, which is not specifically limited in this specification.

[0091] In this specification, the server can also continue to train each initial detection model according to the data in the application process of the game anomaly detection model, and continue to determine a new game anomaly detection model. Based on this, the server can train each initial detection model according to the input data and the target detection result to obtain each trained initial detection model. Afterwards, the first detection model is determined from each trained initial detection model, and the game anomaly detection model is replaced with the first detection model. Among them, the above-mentioned process of training each initial detection model according to the input data and the target detection result to obtain each trained initial detection model is similar to the process of training several initial detection models to be trained according to the first data and the historical detection results in the above step S104 to obtain each initial detection model, and will not be repeated here. The above-mentioned process of determining the first detection model from each trained initial detection model is similar to the process of determining the game anomaly detection model from each initial detection model in the above step S106, and will not be repeated here.

[0092] In addition, in order to ensure the accuracy of the target detection results, the server can obtain the feedback information of the players to be detected, adjust the target detection results according to the feedback information, and then train each initial detection model according to the input data and the adjusted target detection results to obtain each trained initial detection model. Afterwards, the first detection model is determined from each trained initial detection model, and the game abnormality detection model is replaced with the first detection model. Among them, the feedback information can be the complaint information raised by the players to be detected after the management and control, and the feedback information can be the text entered by the players to be detected. When the target detection results are adjusted according to the feedback information, the server can display the feedback information and the target detection results to the risk control personnel, so that the risk control personnel can adjust the target detection results according to the feedback information, and upload the adjusted target detection results to the server, and the server can respond to the result upload operation of the risk control personnel to determine the adjusted target detection results. The adjusted target detection result can be the target detection result before adjustment, or it can be the target detection result adjusted by the risk control personnel.

[0093] The above process of training each initial detection model according to the input data and the adjusted target detection results to obtain each trained initial detection model is similar to the process of training a number of initial detection models to be trained according to the first data and the historical detection results in the above step S104 to obtain each initial detection model, and will not be repeated here. The above process of determining the first detection model from each trained initial detection model is similar to the process of determining the game anomaly detection model from each initial detection model in the above step S106, and will not be repeated here.

[0094] In this specification, the server can also periodically continue to train each initial detection model according to the data in the application process of the game anomaly detection model, and continue to determine a new game anomaly detection model. Based on this, the server can collect the input data and target detection results of each player to be detected according to a preset period, and train each initial detection model according to the input data and target detection results of each player to be detected, and obtain each trained initial detection model. After that, the first detection model is determined from each trained initial detection model, and the game anomaly detection model is replaced with the first detection model. Among them, the above-mentioned process of training each initial detection model according to the input data and target detection results of each player to be detected, and obtaining each trained initial detection model is similar to the process of training several initial detection models to be trained according to the first data and the historical detection results in the above step S104, and obtaining each initial detection model, which will not be repeated here. The above-mentioned process of determining the first detection model from each trained initial detection model is similar to the process of determining the game anomaly detection model from each initial detection model in the above step S106, and will not be repeated here.

[0095] The above are one or more implementation methods of this specification. Based on the same idea, this specification also provides a corresponding training device for the game anomaly detection model, such as Figure 3 shown.

[0096] Figure 3 A schematic diagram of a training device for a game anomaly detection model provided in this specification, comprising:

[0097] A first determination module 200 is used to determine historical game data of a sample player;

[0098] A second determination module 202 is used to determine data of a specified dimension according to the historical game data and use the data as the first data;

[0099] A training module 204 is used to determine the historical detection results of the sample players, and train a plurality of initial detection models to be trained according to the first data and the historical detection results to obtain each initial detection model; wherein the model structures of each initial detection model are different;

[0100] The third determination module 206 is used to determine a game anomaly detection model from the initial detection models.

[0101] Optionally, the historical game data at least includes an installation identifier and login data, and the login data includes several login times and several device information;

[0102] The second determination module 202 is specifically used to determine the time difference between each login time according to each login time in the login data; divide each device information in the login data to obtain each data group, and determine the first quantity of each data group; wherein the device information in the data group is the same; determine the login time situation of the sample player according to each time difference; determine the login device situation of the sample player according to the first quantity; and use the login time situation, the login device situation and the installation identifier as the first data of the specified dimension.

[0103] Optionally, the historical game data includes a number of first dimension data;

[0104] The training module 204 is specifically used to determine, for each first dimension of data included in the historical game data, an importance score corresponding to the first dimension of data according to a pre-set scoring rule corresponding to the first dimension of data; determine second data from the historical game data according to the importance scores corresponding to each first dimension of data; and train several initial detection models to be trained according to the first data, the second data and the historical detection results to obtain each initial detection model.

[0105] Optionally, the training module 204 is specifically used to determine the features corresponding to the first data and use them as sample features; perform feature screening on the sample features according to the historical detection results; and train several initial detection models to be trained based on the screened sample features and the historical detection results to obtain each initial detection model.

[0106] Optionally, the device further comprises:

[0107] The application module 208 is used to collect the game data to be detected corresponding to the player to be detected according to the specified period; determine the data of the specified dimension according to the game data to be detected and use it as input data; input the input data into the game anomaly detection model to determine the target detection result corresponding to the player to be detected; determine the exception handling strategy corresponding to the player to be detected according to the target detection result; and manage the player to be detected according to the exception handling strategy.

[0108] Optionally, the training module 204 is further used to obtain feedback information of the player to be detected;

[0109] According to the feedback information, the target detection result is adjusted; according to the input data and the adjusted target detection result, each initial detection model is trained; from each trained initial detection model, a first detection model is determined, and the game abnormality detection model is replaced by the first detection model.

[0110] Optionally, the third determination module 206 is specifically used to determine a test sample and a test annotation corresponding to the test sample; for each initial detection model, input the test sample into the initial detection model to determine the test result output by the initial detection model; determine the similarity between the test result and the test annotation; determine the maximum similarity among the similarities, and use the initial detection model corresponding to the maximum similarity as the game anomaly detection model.

[0111] This specification also provides a computer-readable storage medium, which stores a computer program, which can be used to execute the above Figure 1 A training method for a game anomaly detection model is provided.

[0112] This manual also provides Figure 4 The one shown corresponds to Figure 1 A schematic diagram of the electronic device. Figure 4 As shown, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and may also include other hardware required for the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs it to achieve the above Figure 1 The training method of the game anomaly detection model.

[0113] Of course, in addition to software implementation, this specification does not exclude other implementation methods, such as logic devices or a combination of software and hardware, etc., that is to say, the executor of the following processing flow is not limited to each logic unit, but can also be hardware or logic devices.

[0114] In the 1990s, improvements to a technology could be clearly distinguished as hardware improvements (for example, improvements to the circuit structure of diodes, transistors, switches, etc.) or software improvements (improvements to the method flow). However, with the development of technology, many improvements to the method flow today can be regarded as direct improvements to the hardware circuit structure. Designers almost always obtain the corresponding hardware circuit structure by programming the improved method flow into the hardware circuit. Therefore, it cannot be said that an improvement in a method flow cannot be implemented using a hardware entity module. For example, a programmable logic device (PLD) (such as a field programmable gate array (FPGA)) is such an integrated circuit whose logical function is determined by the user's programming of the device. Designers can "integrate" a digital system on a PLD by programming it themselves, without having to ask a chip manufacturer to design and produce a dedicated integrated circuit chip. Moreover, nowadays, instead of manually making integrated circuit chips, this kind of programming is mostly implemented by "logic compiler" software, which is similar to the software compiler used when developing and writing programs, and the original code before compilation must also be written in a specific programming language, which is called hardware description language (HDL). There is not only one HDL, but many kinds, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc. The most commonly used ones are VHDL (Very-High-Speed ​​Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should also know that it is only necessary to program the method flow slightly in the above-mentioned hardware description languages ​​and program it into the integrated circuit, and then it is easy to obtain the hardware circuit that implements the logic method flow.

[0115] The controller can be implemented in any appropriate manner, for example, the controller can take the form of a microprocessor or processor and a computer-readable medium storing a computer-readable program code (such as software or firmware) that can be executed by the (micro)processor, a logic gate, a switch, an application-specific integrated circuit (ASIC), a programmable logic controller, and an embedded microcontroller. Examples of controllers include, but are not limited to, the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20, and Silicone Labs C8051F320. The memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art also know that in addition to implementing the controller in a purely computer-readable program code manner, the controller can be implemented in the form of a logic gate, a switch, an application-specific integrated circuit, a programmable logic controller, and an embedded microcontroller by logically programming the method steps. Therefore, this controller can be considered as a hardware component, and the devices included therein for implementing various functions can also be regarded as structures within the hardware component. Or even, the devices for implementing various functions can be regarded as both software modules for implementing the method and structures within the hardware component.

[0116] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0117] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0118] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0119] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0123] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0124] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0125] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0126] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems or computer program products. Therefore, this specification may take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware. Moreover, this specification may take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0128] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the system embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0129] The above description is only an embodiment of the present specification and is not intended to limit the present specification. For those skilled in the art, the present specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification shall be included in the scope of the claims of the present specification.

Claims

1. A method for training a game anomaly detection model, characterized in that: include: Determine the historical game data of sample players; Determine data of a specified dimension according to the historical game data and use the data as first data; Determine the historical detection results of the sample players, and train a plurality of initial detection models to be trained according to the first data and the historical detection results to obtain each initial detection model; wherein the model structures of each initial detection model are different; A game anomaly detection model is determined from the initial detection models.

2. The method according to claim 1, characterized in that The historical game data at least includes an installation identifier and login data, and the login data includes several login times and several device information; According to the historical game data, data of a specified dimension is determined as first data, specifically including: Determine the time difference between the login times according to the login times in the login data; divide the device information in the login data to obtain data groups, and determine the first number of the data groups; wherein the device information in the data groups is the same; Determine the login time of the sample player according to each time difference; determine the login device of the sample player according to the first number; The login time situation, the login device situation and the installation identifier are used as the first data of the specified dimension.

3. The method according to claim 1, characterized in that The historical game data includes a number of first dimension data; According to the first data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model, specifically including: For each first dimension of data included in the historical game data, determining an importance score corresponding to the first dimension of data according to a preset scoring rule corresponding to the first dimension of data; Determining second data from the historical game data according to the importance scores respectively corresponding to the data of the first dimensions; According to the first data, the second data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model.

4. The method according to claim 1, characterized in that According to the first data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model, specifically including: Determine a feature corresponding to the first data and use it as a sample feature; Performing feature screening on the sample features according to the historical test results; Based on the screened sample features and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model.

5. The method according to claim 1, characterized in that The method further comprises: Collect the game data to be tested corresponding to the players to be tested according to the specified period; Determine the data of the specified dimension according to the game data to be detected, and use it as input data; Inputting the input data into the game anomaly detection model to determine the target detection result corresponding to the player to be detected; Determine, according to the target detection result, an exception handling strategy corresponding to the player to be detected; According to the exception handling strategy, the player to be detected is managed and controlled.

6. The method according to claim 5, characterized in that The method further comprises: Obtaining feedback information from the player to be detected; Adjusting the target detection result according to the feedback information; Training each of the initial detection models according to the input data and the adjusted target detection results; A first detection model is determined from each trained initial detection model, and the game abnormality detection model is replaced with the first detection model.

7. The method according to claim 1, characterized in that From the initial detection models, a game anomaly detection model is determined, specifically including: Determining a test sample and a test annotation corresponding to the test sample; For each initial detection model, input the test sample into the initial detection model to determine the test result output by the initial detection model; Determining a similarity between the test result and the test annotation; The maximum similarity among the similarities is determined, and the initial detection model corresponding to the maximum similarity is used as the game anomaly detection model.

8. A training device for a game anomaly detection model, characterized in that: include: A first determination module is used to determine the historical game data of the sample players; A second determination module, configured to determine data of a specified dimension according to the historical game data, and use the data as the first data; A training module, used to determine the historical detection results of the sample players, and train a plurality of initial detection models to be trained according to the first data and the historical detection results to obtain each initial detection model; wherein the model structures of each initial detection model are different; The third determination module is used to determine a game anomaly detection model from the initial detection models.

9. A computer-readable storage medium, characterized in that: The storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

Images