A method, device, medium and equipment for training a game anomaly detection model

Abstract

The specification discloses a game anomaly detection model training method, device, medium and equipment. The method comprises the following steps: determining historical game data of a sample player, and then determining data of a specified dimension as first data according to the historical game data. Historical detection results of the sample player are determined, and then a plurality of initial detection models to be trained are trained according to the first data and the historical detection results, so as to obtain the initial detection models. Then, a game anomaly detection model is determined from the initial detection models. The initial detection models to be trained with different model structures are trained according to the first data and the historical detection results, so that the detection results output by the trained initial detection models are more accurate. Furthermore, the final game anomaly detection model is determined from the initial detection models, so that the detection results determined by the game anomaly detection model are more accurate, and the abnormal behaviors can be effectively prevented from destroying the fairness and ecological environment of the game.

Description

TECHNICAL FIELD

[0001] The present specification relates to the technical field of computer technology, and particularly relates to a game anomaly detection model training method and device, medium and equipment. BACKGROUND

[0002] With the continuous development of technology, games are developing more and more rapidly, and more and more types of games are appearing.

[0003] At present, a player generally logs in a game account through a device to enter a game, and performs a task in the game according to a game rule. However, in the game process, the player may make an abnormal behavior, thereby destroying the fairness and ecological environment of the game. The abnormal behavior can include using illegal or cheating means to brush experience, stealing a game account of another player, and using a third-party software to perform a game task. Therefore, how to train a game anomaly detection model to detect whether a player has an abnormal behavior is a very important problem.

[0004] Based on this, the present specification provides a game anomaly detection model training method. SUMMARY

[0005] The present specification provides a game anomaly detection model training method, device, medium and equipment to partially solve the above problems existing in the prior art.

[0006] The present specification adopts the following technical solutions:

[0007] The present specification provides a game anomaly detection model training method, which comprises:

[0008] determining historical game data of a sample player;

[0009] determining data of a specified dimension according to the historical game data, and taking the data as first data;

[0010] determining a historical detection result of the sample player, and training a plurality of initial detection models to be trained according to the first data and the historical detection result to obtain each initial detection model; wherein the model structures of the initial detection models are different;

[0011] determining a game anomaly detection model from the initial detection models.

[0012] Optionally, the historical game data at least includes installation identification and login data, and the login data includes a plurality of login times and a plurality of device information.

[0013] determining data of a specified dimension according to the historical game data, and taking the data as first data, specifically comprising:

[0014] According to each login time in the login data, determine a time difference between the login times; divide each device information in the login data to obtain each data group, and determine a first number of the data groups; wherein the device information in the data group is the same;

[0015] According to each time difference, determine a login time condition of the sample player; according to the first number, determine a login device condition of the sample player;

[0016] Take the login time condition, the login device condition and the installation identifier as first data of specified dimensions.

[0017] Optionally, the historical game data includes data of a plurality of first dimensions;

[0018] According to the first data and the historical detection result, train a plurality of initial detection models to be trained to obtain each initial detection model, specifically including:

[0019] For each data of a first dimension included in the historical game data, according to a pre-set scoring rule corresponding to the data of the first dimension, determine an importance score corresponding to the data of the first dimension;

[0020] According to the importance score corresponding to each data of a first dimension, determine second data from the historical game data;

[0021] According to the first data, the second data and the historical detection result, train a plurality of initial detection models to be trained to obtain each initial detection model.

[0022] Optionally, according to the first data and the historical detection result, train a plurality of initial detection models to be trained to obtain each initial detection model, specifically including:

[0023] Determine the features corresponding to the first data as sample features;

[0024] According to the historical detection result, perform feature screening on the sample features;

[0025] Based on the screened sample features and the historical detection result, train a plurality of initial detection models to be trained to obtain each initial detection model.

[0026] Optionally, the method further includes:

[0027] According to the specified period, collect the to-be-detected game data corresponding to the to-be-detected player;

[0028] According to the to-be-detected game data, determine the data of the specified dimensions as input data;

[0029] inputting the input data into the game anomaly detection model to determine a target detection result corresponding to the to-be-detected player;

[0030] According to the target detection result, an abnormal processing strategy corresponding to the to-be-detected player is determined.

[0031] According to the abnormal processing strategy, the to-be-detected player is managed and controlled.

[0032] Optionally, the method further comprises:

[0033] Obtaining feedback information of the to-be-detected player;

[0034] According to the feedback information, the target detection result is adjusted;

[0035] According to the input data and the adjusted target detection result, the initial detection models are trained;

[0036] From each trained initial detection model, a first detection model is determined, and the game anomaly detection model is replaced by the first detection model.

[0037] Optionally, from the initial detection models, a game anomaly detection model is determined, specifically comprising:

[0038] A test sample and a test label corresponding to the test sample are determined.

[0039] For each initial detection model, the test sample is input into the initial detection model to determine a test result output by the initial detection model;

[0040] The similarity between the test result and the test label is determined.

[0041] The maximum similarity in the similarities is determined, and the initial detection model corresponding to the maximum similarity is taken as the game anomaly detection model.

[0042] The present specification provides a training device of a game anomaly detection model, comprising:

[0043] A first determination module is configured to determine historical game data of a sample player.

[0044] A second determination module is configured to determine data of a specified dimension according to the historical game data, and take the data as first data.

[0045] A training module is configured to determine a historical detection result of the sample player, and train a plurality of to-be-trained initial detection models according to the first data and the historical detection result to obtain initial detection models; wherein the model structures of the initial detection models are different.

[0046] The third determining module is configured to determine the game anomaly detection model from the initial detection models.

[0047] The present specification provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement the game anomaly detection model training method.

[0048] The present specification provides an electronic device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the game anomaly detection model training method when executing the program.

[0049] The above at least one technical solution adopted by the present specification can achieve the following beneficial effects:

[0050] The game anomaly detection model training method provided by the present specification determines the historical game data of the sample player, and then determines the data of a specified dimension as first data according to the historical game data. Then, the historical detection result of the sample player is determined, and a plurality of initial detection models to be trained are trained according to the first data and the historical detection result to obtain each initial detection model. Then, the game anomaly detection model is determined from each initial detection model.

[0051] As can be seen from the above method, when training the game anomaly detection model, the historical game data of the sample player can be determined, and the data of a specified dimension can be determined as first data according to the historical game data. Then, the historical detection result of the sample player is determined, and a plurality of initial detection models to be trained are trained according to the first data and the historical detection result to obtain each initial detection model. Then, the game anomaly detection model is determined from each initial detection model. By training the initial detection models to be trained with different model structures according to the first data and the historical detection result, the detection results output by each initial detection model after training can be more accurate. Moreover, the final game anomaly detection model is determined from each initial detection model, which can make the detection result determined by the game anomaly detection model more accurate, and can effectively prevent abnormal behaviors from destroying the fairness and ecological environment of the game. BRIEF DESCRIPTION OF DRAWINGS

[0052] The accompanying drawings, which are included to provide a further understanding of the present specification, constitute a part of the present specification, and the illustrative embodiments of the present specification and their description serve to explain the present specification, and do not constitute an improper limitation on the present specification. In the drawings:

[0053] Figure 1 A flowchart of the game anomaly detection model training method provided in the present specification is shown in the figure;

[0054] Figure 2 a schematic diagram of a process for training an initial detection model of each to-be-trained in the present specification;

[0055] Figure 3 a schematic diagram of a training device structure of a game anomaly detection model provided in the present specification;

[0056] Figure 4 a schematic diagram of a structure of an electronic device corresponding to Figure 1 the present specification. DETAILED DESCRIPTION

[0057] In order to make the purposes, technical solutions and advantages of the present specification clearer, the technical solutions of the present specification will be described below in conjunction with specific embodiments of the present specification and corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present specification, rather than all the embodiments. Based on the embodiments in the present specification, all other embodiments obtained by those of ordinary skill in the art without creative labor shall fall within the scope of protection of the present specification.

[0058] The technical solutions provided by the embodiments of the present specification will be described in detail below in conjunction with the drawings.

[0059] Figure 1 a schematic diagram of a game anomaly detection model training method provided in the present specification, comprising the following steps:

[0060] S100: determining historical game data of a sample player.

[0061] In the present specification, the device for training the game anomaly detection model can determine the historical game data of the sample player. The device for training the game anomaly detection model can be a server, or an electronic device such as a desktop computer, a notebook computer, etc. For the convenience of description, the game anomaly detection model training method provided in the present specification will be described below taking the server as the execution subject.

[0062] The sample player can be a player who has registered the game in history, a player who has abnormal behavior in history, or a player who does not have abnormal behavior in history. In order to better train the game anomaly detection model, so that the trained game anomaly detection model can better detect the abnormal behavior of the game player, the sample player can include a player who has abnormal behavior in history and a player who does not have abnormal behavior in history. The abnormal behavior can be to perform a game task by using a third-party software, application, script, etc., that is, to perform a game task by using an "external hanging", thereby destroying the fairness and ecological environment of the game. Of course, the abnormal behavior can also include using illegal or cheating means to brush experience, such as using a script to brush experience, and can also include stealing other players' game accounts, that is, "stealing accounts", and publishing other games in the game, and introducing traffic for other games. For each type of abnormal behavior, the server can train a model for detecting the type of abnormal behavior. For ease of illustration, the following is described by taking the abnormal behavior including using an "external hanging" to perform a game task as an example.

[0063] The historical game data is data generated by the sample player in the game process in history, and the historical game data at least includes installation identification and login data. The installation identification represents that the player successfully installs the game on the device, and the installation identification has uniqueness, and the installation identification is a unique identification. The device can be a terminal such as a mobile phone, or a computer or an emulator. The login data can include a plurality of login times and a plurality of device information, the login time has a corresponding relationship with the device information, the login time is the time when the sample player logs in the game each time, and the device information is the information corresponding to the device used by the sample player each time when logging in the game, the device information includes device identification, kernel, memory, and central processing unit (CPU) information. Each time the sample player logs in the game, the time when the sample player logs in the game, that is, the login time, and the information of the device used when logging in the game, that is, the device information, are recorded.

[0064] Of course, in addition to the login data described above, the login data can include account information and player information. The account information is information corresponding to a game account of the sample player each time the sample player logs into the game. The account information can include an account name, an account identifier, and zone server information. The zone server information is information of a server selected by the sample player. The zone server information includes a zone server identifier and a zone server name. The zone server is a server partition in the game. Players can select different servers to play the same game. Each zone server is an independent game world. The zone server can be divided according to regions, languages, or versions. The player information can include a game level, a game experience value, and a win rate, and the like. In addition to the installation identifier and the login data, the historical game data can include game event data, game operation data, and transaction data. The game event data includes data such as game tasks performed by the sample player, a game level, and an activity level. The game operation data includes data such as a force of a device pressed by the sample player during performance of a game task, a position of a virtual character in the game, a perspective, and the like. The virtual character is a character in the game. Each player has a corresponding game character, i.e., a virtual character, in the game. The virtual character can be preselected by the player. The position of the virtual character or the perspective of the virtual character is a position of the virtual character in a game scene or a perspective corresponding to the virtual character. The transaction data includes data such as a number of times of recharging by the sample player and a recharging amount.

[0065] S102: According to the historical game data, determine data of a specified dimension as first data.

[0066] In this specification, the server can determine data of a specified dimension as first data according to historical game data. The specified dimension can be pre-set by the server. The data of the specified dimension can include an installation identifier and login time information of a sample player. For a player who uses a simulator to run an “external plug-in” and perform a game task, i.e., a player with abnormal behavior, the player can repeatedly install the game multiple times, i.e., perform a process of “installing the game-uninstalling the game” multiple times. Therefore, the installation identifier can exist multiple times. A player without abnormal behavior can install the game only once, so the installation identifier can only have a unique one. Therefore, the first data includes the installation identifier, so that the detection result determined based on the installation identifier is more accurate. In addition, the login time information can reflect the fluctuation of the login time of the player. Therefore, the first data includes the login time information, so that the detection result determined based on the login time information is more accurate.

[0067] Specifically, the server can determine time differences between each login time in the login data according to the login times. According to the time differences, the login time condition of the sample player is determined. The login time condition and the installation identifier are taken as the first data of the specified dimension. The time differences between each login time can be the time differences between each two adjacent login times. For example, there are four login times, i.e. login times 1-4, and the time differences can be the four time differences between login time 1 and login time 2, login time 2 and login time 3, login time 3 and login time 4. When determining the login time condition of the sample player according to the time differences, the server can determine the mean value corresponding to each time difference, determine the variance or standard deviation according to the mean value, and take the variance or standard deviation as the login time condition of the sample player. Of course, the server can also determine the login time condition of the sample player according to the determined variance or standard deviation. The login time condition includes one of large login time fluctuation and small login time fluctuation.

[0068] In addition, the data of the specified dimension (i.e. the first data) can also include the login device condition of the sample player. A player without abnormal behavior generally uses one type of device to log in to the game, while a player with abnormal behavior can use multiple types of devices to log in to the game. The login device condition represents how many types of devices the player has used to log in to the game in the past, so that the first data includes the login device condition, which can make the detection result based on the login device condition more accurate. Therefore, the server can determine time differences between each login time in the login data according to the login times. At the same time, each device information in the login data is divided to obtain each data group, and the first number of each data group is determined. Then, according to the time differences, the login time condition of the sample player is determined. And according to the first number, the login device condition of the sample player is determined. The login time condition, the login device condition and the installation identifier are taken as the first data of the specified dimension.

[0069] The device information in each data group is the same, that is, the same device information in each device information is divided into one data group. When dividing each device information in the login data to obtain each data group, the server can determine other device information same as the device information for each device information, and divide the device information and the determined other device information into one data group. Each data group includes the same device information. The first number is the number corresponding to each data group. The first number is how many data groups there are. The login device condition can be the first number, which represents how many types of devices the sample player has used to log in to the game in the past.

[0070] S104: determine a historical detection result of the sample player, and train a plurality of initial detection models to be trained according to the first data and the historical detection result, to obtain each initial detection model; wherein the model structures of the initial detection models are different.

[0071] In the present specification, the server can determine a historical detection result of a sample player, and train a plurality of initial detection models to be trained according to the first data and the historical detection result. The historical detection result can be one of an abnormal behavior and an absence of an abnormal behavior, and the historical detection result can be marked by a risk control personnel. The risk control personnel can mark the sample player according to historical game data of the sample player, to obtain the historical detection result of the sample player. Of course, the historical detection result can also be determined by other risk control means or risk control systems in history, and the present specification does not make specific limitations. The model structures of the initial detection models to be trained or the initial detection models are different. The initial detection models to be trained or the initial detection models can be GPT (Generative Pre-trained Transformer) series models, BERT (Bidirectional Encoder Representations from Transformers) structure models, traditional machine learning models, such as linear regression models, logistic regression models, support vector machine (SVM) models, and deep learning models, such as feedforward neural networks, recurrent neural networks, Transformer structure models, and generative adversarial networks, and the present specification does not make specific limitations. The initial detection models to be trained can be any trained model or an untrained model, and the present specification does not make specific limitations.

[0072] When the plurality of initial detection models to be trained are trained according to the first data and the historical detection result, to obtain each initial detection model, the server can input the first data into each initial detection model to be trained, determine an output result output by the initial detection model to be trained, train the initial detection model to be trained according to the output result and the historical detection result, and obtain a trained initial detection model. When the initial detection model to be trained is trained according to the output result and the historical detection result, to obtain the trained initial detection model, the server can train the initial detection model to be trained to minimize the difference between the output result and the historical detection result, and obtain the trained initial detection model. Of course, the server can also determine the difference between the output result and the historical detection result, determine a loss according to the difference, and train the initial detection model to be trained according to the loss, to obtain the trained initial detection model. For example, the server can determine the difference between the output result and the historical detection result, determine a loss according to the difference, and train the initial detection model to be trained according to the loss, to obtain the trained initial detection model. Figure 2As shown, Figure 2 FIG. 1 is a schematic diagram of a process for training initial detection models according to an embodiment of the present disclosure, Figure 2 In the process shown, there are n initial detection models to be trained, i.e., initial detection models 1-n to be trained. Similarly, there are also n initial detection models, i.e., initial detection models 1-n. The server can train the initial detection models 1-n to be trained based on the first data and the historical detection results, thereby obtaining the trained initial detection models 1-n.

[0073] S106: determining a game anomaly detection model from the initial detection models.

[0074] In the present disclosure, the server can determine a game anomaly detection model from the initial detection models. The game anomaly detection model is one of the initial detection models. Specifically, the server can randomly select one of the initial detection models as the game anomaly detection model. The game anomaly detection model can be used to determine the detection result of a player to be detected based on the game data of the player to be detected.

[0075] In addition, the server can also determine a test sample and a test label corresponding to the test sample, and then input the test sample into each initial detection model to determine the test result output by the initial detection model, and determine the similarity between the test result and the test label. Then determine the maximum similarity among the similarities, and the initial detection model corresponding to the maximum similarity is the game anomaly detection model. The test sample can be the game data of a player in history, and the test label can be one of the abnormal behavior and the non-abnormal behavior. When determining the similarity between the test result and the test label, the server can use any existing similarity algorithm or model to determine the similarity between the test result and the test label. The greater the similarity between the test result and the test label, the higher the accuracy of the result output by the initial detection model. The server can select the initial detection model with the highest accuracy (i.e., the initial detection model corresponding to the maximum similarity) from the initial detection models as the game anomaly detection model. When inputting the test sample into the initial detection model to determine the test result output by the initial detection model, the server can determine the data of a specified dimension based on the test sample and use the data as the test data. Then input the test data into the initial detection model to determine the test result output by the initial detection model. In addition, the server can also use any existing means to determine the accuracy of each initial detection model, and then select the initial detection model with the highest accuracy as the game anomaly detection model.

[0076] As can be seen from the above method, in training the game anomaly detection model, the server can determine the historical game data of the sample player, and then determine the data of the specified dimension according to the historical game data as the first data. Then, the historical detection result of the sample player is determined, and the initial detection model to be trained is trained according to the first data and the historical detection result to obtain each initial detection model. Then, the game anomaly detection model is determined from each initial detection model. By training the initial detection model to be trained with different model structures according to the first data and the historical detection result, the detection result output by each initial detection model after training can be more accurate. Moreover, the final game anomaly detection model is determined from each initial detection model, so that the detection result determined by the game anomaly detection model can be more accurate, and the abnormal behavior can be effectively prevented from destroying the fairness and ecological environment of the game.

[0077] In the present specification, in order to better train each initial detection model to be trained, in the step S104 of training the initial detection model to be trained according to the first data and the historical detection result to obtain each initial detection model, the server can first determine the features corresponding to the first data as sample features. The sample features are screened according to the historical detection result. The initial detection model to be trained is trained based on the screened sample features and the historical detection result to obtain each initial detection model. When determining the features corresponding to the first data, the server can use a pre-trained feature extraction layer to determine the features corresponding to the first data. The feature extraction layer can be a network layer pre-trained by the server, or any existing network layer, which is not limited in the present specification. Of course, the server can also input the first data into any initial detection model to be trained to determine the features corresponding to the first data, which is not limited in the present specification.

[0078] The sample features include sub-features of several dimensions, i.e., each sub-feature. When screening the sample features according to the historical detection result, the server can determine the correlation between each sub-feature and the historical detection result by using a pre-set correlation analysis method. The sample features are screened according to each correlation. The correlation analysis method can be any one of Pearson correlation coefficient, Spearman rank correlation coefficient or chi-square test, and the specific correlation analysis method is not limited in the present specification. When screening the sample features according to each correlation, the server can select each sub-feature as a target sub-feature when the correlation of the sub-feature is greater than a first threshold value, and select each target sub-feature as the screened sample features. The first threshold value is a value pre-set by the server.

[0079] In addition, when performing feature screening on the sample features according to the historical detection results, the server can also use a pre-trained feature evaluation model to determine the importance of each sub-feature, and perform feature screening on the sample features according to the importance of each sub-feature. The feature evaluation model can be a decision tree or a random forest. The feature evaluation model can be a pre-trained model of the server or any existing model, which is not limited in the present specification. When performing feature screening on the sample features according to the importance of each sub-feature, the server can, for each sub-feature, determine the sub-feature as a target sub-feature when the importance of the sub-feature is greater than a second threshold value, and determine each target sub-feature as a screened sample feature. The second threshold value is a value pre-set by the server. Of course, the server can also use any existing method to perform feature screening on the sample features based on the historical detection results, which is not limited in the present specification.

[0080] When training the plurality of initial detection models based on the screened sample features and the historical detection results to obtain each initial detection model, the server can, for each initial detection model to be trained, input the screened sample features into the initial detection model to be trained, determine an output result output by the initial detection model to be trained, and train the initial detection model to be trained based on the output result and the historical detection results to obtain a trained initial detection model.

[0081] In the present specification, in order to increase the diversity of the training data and better train each initial detection model to be trained, when training the plurality of initial detection models based on the first data and the historical detection results to obtain each initial detection model in step S104, the server can train the plurality of initial detection models based on the first data and historical game data to obtain each initial detection model.

[0082] Further, in order to avoid the interference of unimportant dimension data in the historical game data on the model, when training the plurality of initial detection models based on the first data and the historical detection results to obtain each initial detection model in step S104, the historical game data includes a plurality of first dimension data, and the server can, for each first dimension data included in the historical game data, determine an importance score corresponding to the first dimension data according to a pre-set scoring rule corresponding to the first dimension data. According to the importance score corresponding to each first dimension data, the second data is determined from the historical game data. The plurality of initial detection models are trained based on the first data, the second data and the historical detection results to obtain each initial detection model.

[0083] The first-dimension data corresponds to a scoring rule, and the scoring rule can be used to determine the importance score corresponding to the first-dimension data. The scoring rule can be pre-set by the server. The scoring rule corresponding to the first-dimension data can be used to determine whether the first-dimension data meets the pre-set condition in the scoring rule, thereby determining the importance score corresponding to the first-dimension data. Specifically, taking the login times as the first-dimension data, the pre-set condition in the scoring rule corresponding to the first-dimension data is the first quantity. Therefore, when the login times are greater than the first quantity, the login times meet the pre-set condition, and the importance score corresponding to the first-dimension data is the first score. When the login times are not greater than the first quantity, the login times do not meet the pre-set condition, and the importance score corresponding to the first-dimension data is the second score. The first score and the second score are pre-set by the server.

[0084] According to the pre-set scoring rule corresponding to the first-dimension data, the server can also display the pre-set scoring rule corresponding to the first-dimension data and the first-dimension data to the risk control personnel, so that the risk control personnel determine the importance score corresponding to the first-dimension data according to the pre-set scoring rule corresponding to the first-dimension data, and upload it to the server, so that the server can determine the importance score corresponding to the first-dimension data in response to the uploading score operation of the risk control personnel.

[0085] According to the importance score corresponding to each first-dimension data, the server can sort the first-dimension data in descending order of the importance score corresponding to each first-dimension data to obtain a first sequence. Then, the server determines a specified number of data according to the order of the first sequence, and the specified number of data is the second data. The specified number can be pre-set by the server. The server can also determine the second data according to each first-dimension data. When the importance score corresponding to the first-dimension data is greater than a specified threshold, the first-dimension data is the second data. The specified threshold is pre-set by the server.

[0086] According to the first data, the second data, and the historical detection result, the server can train a plurality of initial detection models to obtain the initial detection models. The server can input the first data and the second data into each initial detection model to be trained, determine the output result output by the initial detection model to be trained, and train the initial detection model to be trained according to the output result and the historical detection result to obtain the trained initial detection model.

[0087] In the specification, after obtaining the game anomaly detection model, the server can collect the to-be-detected data corresponding to the to-be-detected player in real time, determine the data of the specified dimension according to the to-be-detected data, and use the data as input data. Then, the input data is input into the game anomaly detection model to determine the target detection result corresponding to the to-be-detected player. Then, according to the target detection result, the abnormal processing strategy corresponding to the to-be-detected player is determined. According to the abnormal processing strategy, the to-be-detected player is controlled. Wherein, the to-be-detected player can be a registered player. The to-be-detected game data is the game data corresponding to the to-be-detected player. The process of determining the data of the specified dimension according to the to-be-detected data and using the data as input data is similar to the content described in step S102, and will not be repeated here. The target detection result can be one of the existence of abnormal behavior and the non-existence of abnormal behavior, and can also be the probability of the existence of abnormal behavior, which is not limited in the specification. When inputting the input data into the game anomaly detection model to determine the target detection result corresponding to the to-be-detected player, the server can input the to-be-detected game data and the input data into the game anomaly detection model to determine the target detection result corresponding to the to-be-detected player. The server can also determine the importance score corresponding to each second dimension data included in the to-be-detected game data according to the pre-set scoring rule of the second dimension data. According to the importance score corresponding to each second dimension data, the third data is determined from the to-be-detected game data. The third data and the input data are input into the game anomaly detection model to determine the target detection result corresponding to the to-be-detected player. The to-be-detected game data includes several second dimension data.

[0088] When determining the abnormal processing strategy corresponding to the to-be-detected player according to the target detection result, the server can determine the abnormal processing strategy corresponding to the to-be-detected player from the pre-set first strategy library according to the target detection result. Wherein, the first strategy library is pre-set by the server, the first strategy library includes several abnormal processing strategies, and each abnormal processing strategy has a corresponding relationship with the target detection result. In addition, the server can also determine the game type corresponding to the game of the to-be-detected player, and determine the pre-set second strategy library corresponding to the game type, and then determine the abnormal processing strategy corresponding to the to-be-detected player from the second strategy library according to the target detection result. Each game type has a corresponding second strategy library, and the second strategy library is pre-set by the server, the second strategy library includes several abnormal processing strategies, and each abnormal processing strategy has a corresponding relationship with the target detection result.

[0089] The abnormal processing strategy includes sending warning information to the to-be-detected player, and banning the game account of the to-be-detected player. When controlling the to-be-detected player according to the abnormal processing strategy, the server can control the to-be-detected player by using the abnormal processing strategy.

[0090] In the present specification, after obtaining the game anomaly detection model, the server can collect the to-be-detected game data corresponding to the to-be-detected player according to a specified period, determine the data of the specified dimension according to the to-be-detected data, and use the data as input data. Then, the input data is input into the game anomaly detection model to determine the target detection result corresponding to the to-be-detected player. Then, according to the target detection result, the abnormal processing strategy corresponding to the to-be-detected player is determined. According to the abnormal processing strategy, the to-be-detected player is controlled. The specified period is a period set by the server in advance, which can be one day or one week, and the present specification does not make specific limitations.

[0091] In the present specification, the server can also continue to train each initial detection model according to the data in the application process of the game anomaly detection model, and continue to determine a new game anomaly detection model. Based on this, the server can train each initial detection model according to the input data and the target detection result to obtain each trained initial detection model. Then, the first detection model is determined from each trained initial detection model, and the game anomaly detection model is replaced by the first detection model. The process of training each initial detection model according to the input data and the target detection result to obtain each trained initial detection model is similar to the process of training a plurality of to-be-trained initial detection models according to the first data and the historical detection result to obtain each initial detection model in step S104, and will not be repeated here. The process of determining the first detection model from each trained initial detection model is similar to the process of determining the game anomaly detection model from each initial detection model in step S106, and will not be repeated here.

[0092] In addition, in order to ensure the accuracy of the target detection result, the server can obtain feedback information of the to-be-detected player, adjust the target detection result according to the feedback information, and then train each initial detection model according to the input data and the adjusted target detection result to obtain each trained initial detection model. Then, the first detection model is determined from each trained initial detection model, and the game anomaly detection model is replaced by the first detection model. The feedback information can be complaint information proposed by the to-be-detected player after being controlled, and the feedback information can be text input by the to-be-detected player. When adjusting the target detection result according to the feedback information, the server can display the feedback information and the target detection result to the risk control personnel, so that the risk control personnel can adjust the target detection result according to the feedback information, and upload the adjusted target detection result to the server. Then, the server can determine the adjusted target detection result in response to the result uploading operation of the risk control personnel. The adjusted target detection result can be the target detection result before adjustment, or the target detection result adjusted by the risk control personnel.

[0093] The process of training each initial detection model according to the input data and the adjusted target detection result is similar to the process of training a plurality of initial detection models to be trained according to the first data and the historical detection result in step S104, and will not be repeated here. The process of determining the first detection model from each trained initial detection model is similar to the process of determining the game anomaly detection model from each initial detection model in step S106, and will not be repeated here.

[0094] In the present specification, the server can also periodically continue to train each initial detection model according to the data in the game anomaly detection model application process and continue to determine a new game anomaly detection model. Based on this, the server can collect the input data and the target detection result of each player to be detected according to a preset period, and train each initial detection model according to the input data and the target detection result of each player to be detected to obtain each trained initial detection model. Then, the first detection model is determined from each trained initial detection model, and the game anomaly detection model is replaced by the first detection model. The process of training each initial detection model according to the input data and the target detection result of each player to be detected is similar to the process of training a plurality of initial detection models to be trained according to the first data and the historical detection result in step S104, and will not be repeated here. The process of determining the first detection model from each trained initial detection model is similar to the process of determining the game anomaly detection model from each initial detection model in step S106, and will not be repeated here.

[0095] The above is the method of one or more embodiments of the present specification. Based on the same idea, the present specification also provides a corresponding game anomaly detection model training device, as shown in Figure 3 .

[0096] Figure 3 The game anomaly detection model training device provided by the present specification is a schematic diagram, which comprises:

[0097] The first determination module 200 is configured to determine the historical game data of the sample player.

[0098] The second determination module 202 is configured to determine the data of a specified dimension as the first data according to the historical game data.

[0099] The training module 204 is configured to determine historical detection results of the sample player, and train a plurality of initial detection models to be trained according to the first data and the historical detection results, to obtain each initial detection model; wherein the model structures of the initial detection models are different.

[0100] The third determination module 206 is configured to determine a game anomaly detection model from the initial detection models.

[0101] Optionally, the historical game data at least includes installation identification and login data, and the login data includes a plurality of login times and a plurality of device information.

[0102] The second determination module 202 is specifically configured to determine time differences between the login times in the login data according to the login times, divide the device information in the login data to obtain a plurality of data groups, and determine a first quantity of the data groups; wherein the device information in the data group is the same; determine login time conditions of the sample player according to the time differences; determine login device conditions of the sample player according to the first quantity; and take the login time conditions, the login device conditions and the installation identification as the first data of the specified dimensions.

[0103] Optionally, the historical game data includes a plurality of first dimension data.

[0104] The training module 204 is specifically configured to, for each first dimension data included in the historical game data, determine an importance score corresponding to the first dimension data according to a pre-set scoring rule corresponding to the first dimension data; determine second data from the historical game data according to the importance scores respectively corresponding to the first dimension data; and train a plurality of initial detection models to be trained according to the first data, the second data and the historical detection results, to obtain each initial detection model.

[0105] Optionally, the training module 204 is specifically configured to determine features corresponding to the first data as sample features, perform feature screening on the sample features according to the historical detection results, and train a plurality of initial detection models to be trained based on the screened sample features and the historical detection results, to obtain each initial detection model.

[0106] Optionally, the apparatus further includes:

[0107] The application module 208 is configured to collect, according to a specified period, to-be-detected game data corresponding to a to-be-detected player, determine data of the specified dimension as input data according to the to-be-detected game data, input the input data into the game anomaly detection model to determine a target detection result corresponding to the to-be-detected player, determine an abnormality processing strategy corresponding to the to-be-detected player according to the target detection result, and perform management and control on the to-be-detected player according to the abnormality processing strategy.

[0108] Optionally, the training module 204 is further configured to obtain feedback information of the to-be-detected player.

[0109] The target detection result is adjusted according to the feedback information, the initial detection models are trained according to the input data and the adjusted target detection result, a first detection model is determined from the trained initial detection models, and the game anomaly detection model is replaced by the first detection model.

[0110] Optionally, the third determination module 206 is specifically configured to determine a test sample and a test label corresponding to the test sample, input the test sample into each initial detection model to determine a test result output by the initial detection model, determine a similarity between the test result and the test label, determine a maximum similarity in the similarities, and determine the initial detection model corresponding to the maximum similarity as the game anomaly detection model.

[0111] The specification also provides a computer-readable storage medium storing a computer program, which can be used to execute the above Figure 1 The specification also provides a game anomaly detection model training method.

[0112] The specification also provides a game anomaly detection model training method. Figure 4 The specification also provides a game anomaly detection model training method. Figure 1 The specification also provides a game anomaly detection model training method. Figure 4 As shown in the figure, at the hardware level, the electronic device includes a processor, an internal bus, a network interface, a memory, and a non-volatile memory, and of course can also include other hardware required by the business. The processor reads the corresponding computer program from the non-volatile memory into the memory and then runs to implement the above Figure 1 The specification also provides a game anomaly detection model training method.

[0113] Of course, in addition to the software implementation, the specification does not exclude other implementation manners, such as logic devices or a combination of software and hardware, etc., that is, the execution subject of the following processing flow is not limited to each logic unit, but can also be hardware or a logic device.

[0114] In the 1990s, it was quite obvious to distinguish whether an improvement in a technology was in hardware (e.g., improvement in circuit structures of diodes, transistors, switches, etc.) or in software (improvement in method flow). However, as technology has evolved, many improvements in method flow today can be considered as direct improvements in hardware circuit structures. Designers almost always obtain the corresponding hardware circuit structures by programming the improved method flow into hardware circuits. Therefore, it cannot be said that an improvement in a method flow cannot be implemented by hardware entity modules. For example, a programmable logic device (PLD) (e.g., a field programmable gate array (FPGA)) is an integrated circuit whose logic function is determined by user programming of the device. A digital system is "integrated" on a PLD by the designer programming it, rather than by asking a chip manufacturer to design and fabricate a custom integrated circuit chip. Moreover, instead of manually fabricating integrated circuit chips, this programming is now mostly implemented by "logic compiler" software, which is similar to software compilers used in program development, and the original code to be compiled is written in a specific programming language, which is called a hardware description language (HDL), and there are many such languages, such as ABEL (Advanced Boolean Expression Language), AHDL (Altera Hardware Description Language), Confluence, CUPL (Cornell University Programming Language), HDCal, JHDL (Java Hardware Description Language), Lava, Lola, MyHDL, PALASM, RHDL (Ruby Hardware Description Language), etc., and the most commonly used are VHDL (Very-High-Speed Integrated Circuit Hardware Description Language) and Verilog. Those skilled in the art should be aware that, as long as the method flow is logically programmed in the above-mentioned hardware description languages and programmed into an integrated circuit, a hardware circuit implementing the logical method flow can be easily obtained.

[0115] The controller can be implemented in any suitable way, for example, the controller can take the form of a microprocessor or processor and a computer readable medium storing computer readable program code, such as software or firmware, executable by the (micro)processor, logic gates, switches, an application specific integrated circuit (ASIC), a programmable logic controller and an embedded microcontroller, examples of which include but are not limited to the following microcontrollers: ARC 625D, Atmel AT91SAM, Microchip PIC18F26K20 and Silicone Labs C8051F320, the memory controller can also be implemented as part of the control logic of the memory. Those skilled in the art will also know that, in addition to being implemented in pure computer readable program code, the controller can equally well be implemented to perform the same functions using logic gates, switches, an application specific integrated circuit, a programmable logic controller and an embedded microcontroller, etc. by means of a logical programming of the method steps. The controller can thus be considered as a hardware component, and the means comprised therein for performing the various functions can be considered as structures within the hardware component. Alternatively, the means for performing the various functions can even be considered as both a software module implementing the method and a structure within the hardware component.

[0116] The systems, apparatuses, modules or units illustrated by the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0117] For the sake of description, the above apparatuses are described in various units with functions respectively. Of course, the functions of the units can be implemented in one or more software and / or hardware in implementing the present specification.

[0118] Those skilled in the art will understand that the embodiments of the present specification can be provided as a method, a system or a computer program product. Therefore, the present specification can take the form of a complete hardware embodiment, a complete software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer usable program code.

[0119] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0120] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0121] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes ​ The steps of the function specified in one or more boxes.

[0122] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0123] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0124] Computer-readable media includes permanent and non-permanent, movable and non-movable media that can be implemented by any method or technology to store information. The information can be computer-readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other non-transmission medium that can be used to store information accessible to a computing device. According to the definition herein, computer-readable media does not include transitory media such as modulated data signals and carriers.

[0125] It should also be noted that the terms "comprising", "containing", or any other variant thereof are intended to cover non-exclusive inclusion, such that a process, method, article or apparatus that comprises a list of elements does not only include those elements, but can also include other elements not expressly listed or inherent to such process, method, article or apparatus. Without more limitations, the element defined by the statement "comprising a" does not exclude the presence of additional identical elements in the process, method, article or apparatus that includes the element.

[0126] Those skilled in the art will appreciate that embodiments of the present specification can be provided as methods, systems or computer program products. Therefore, the present specification can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Moreover, the present specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0127] The present specification can be described in the general context of computer-executable instructions, such as program modules, being executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. The present specification can also be practiced in distributed computing environments where tasks are performed by remote processing devices that are connected through a communication network. In a distributed computing environment, program modules can be located in both local and remote computer storage media including storage devices.

[0128] The various embodiments described in this specification are described using a numbering of embodiments approach: these are each individually integrated contributions pertaining to different aspects of the description. For each embodiment, the description focuses on the differences from the other embodiments. In particular, the description of the system embodiments is relatively brief, as the system embodiments are largely analogous to the method embodiments. The relevant parts of the description of the method embodiments are therefore referred to.

[0129] The above description is embodied in the form of embodiments only and is not intended to limit the present specification. The present specification can be variously changed and modified by those skilled in the art. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present specification should be included in the scope of the claims of the present specification.

Claims

1. A training method for a game anomaly detection model, characterized in that, include: Determine the historical game data of the sample players; the historical game data includes at least installation identifiers and login data, and the login data includes several login times and several device information. Based on the login times in the login data, determine the time difference between the login times; divide the device information in the login data into data groups, and determine the first number of each data group; wherein the device information in the data groups is the same; Based on the time differences, determine the login time of the sample players; based on the first quantity, determine the login device of the sample players; The login time, the login device, and the installation identifier are used as the first data for the specified dimension; The historical detection results of the sample players are determined, and for each first dimension of the historical game data, an importance score is determined according to a pre-set scoring rule corresponding to the data in that first dimension. Second data is determined from the historical game data based on the importance scores corresponding to each first dimension. Several initial detection models are trained based on the first data, the second data, and the historical detection results to obtain each initial detection model; wherein the model structures of each initial detection model are different. From the initial detection models, a game anomaly detection model is determined.

2. The method as described in claim 1, characterized in that, Based on the first data and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model, specifically including: Determine the features corresponding to the first data and use them as sample features; Based on the historical detection results, feature filtering is performed on the sample features; Based on the filtered sample features and the historical detection results, several initial detection models to be trained are trained to obtain each initial detection model.

3. The method as described in claim 1, characterized in that, The method further includes: Collect game data for the players to be tested according to a specified period; Based on the game data to be detected, determine the data of the specified dimension and use it as input data; The input data is fed into the game anomaly detection model to determine the target detection result corresponding to the player to be detected. Based on the target detection results, determine the anomaly handling strategy corresponding to the player to be detected; The player to be detected is managed according to the aforementioned anomaly handling strategy.

4. The method as described in claim 3, characterized in that, The method further includes: Obtain feedback information from the player to be tested; The target detection results are adjusted based on the feedback information. Based on the input data and the adjusted target detection results, each initial detection model is trained. From each of the initial detection models after training, a first detection model is determined, and the game anomaly detection model is replaced with the first detection model.

5. The method as described in claim 1, characterized in that, From the initial detection models, a game anomaly detection model is determined, specifically including: Determine the test samples and the corresponding test labels for the test samples; For each initial detection model, the test sample is input into the initial detection model, and the test result output by the initial detection model is determined; Determine the similarity between the test results and the test labels; The maximum similarity among all similarities is determined, and the initial detection model corresponding to the maximum similarity is used as the game anomaly detection model.

6. A training device for a game anomaly detection model, characterized in that, include: The first determination module is used to determine the historical game data of the sample players; The historical game data includes at least installation identifiers and login data, and the login data includes several login times and several device information. The second determining module is used to determine the time difference between the login times based on the login times in the login data; The device information in the login data is divided into data groups, and a first quantity of each data group is determined; wherein the device information in the data groups is the same; the login time of the sample player is determined according to each time difference; the login device of the sample player is determined according to the first quantity; the login time, the login device, and the installation identifier are used as the first data of the specified dimension. The training module is used to determine the historical detection results of the sample players, and for each first dimension of the historical game data, determine the importance score corresponding to the data in that first dimension according to the pre-set scoring rules; determine second data from the historical game data based on the importance scores corresponding to each first dimension of the data; and train several initial detection models to be trained based on the first data, the second data, and the historical detection results to obtain each initial detection model; wherein, the model structure of each initial detection model is different. The third determining module is used to determine the game anomaly detection model from the initial detection models.

7. A computer-readable storage medium, characterized in that, The storage medium stores a computer program, which, when executed by a processor, implements the method described in any one of claims 1 to 5.

8. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method described in any one of claims 1 to 5.

Images