Anti-cheating blacklist output method and device, computer equipment and storage medium

Abstract

The invention relates to an anti-cheating blacklist output method and device, computer equipment and a storage medium. The method comprises the steps of performing feature extraction on log data of an anti-cheating service, performing anomaly detection on extracted features to obtain an anomaly detection result of each object in the anti-cheating service, and determining whether the corresponding object is a cheating object based on the anomaly detection result. And the anti-cheating blacklist corresponding to the anti-cheating business is output by integrating the anomaly detection results of all the objects, and the anti-cheating blacklist can be output without using an anti-cheating sample in the process, so that the problem of how to output the blacklist under the condition of lack of the anti-cheating sample or no anti-cheating sample can be solved.

Description

Technical Field

[0001] This application relates to the field of anti-cheating blacklist output, and particularly to an anti-cheating blacklist output method, device, computer device, and storage medium. Background Art

[0002] With the growth of business, the anti-cheating technology needs to be connected to more and more scenarios. How to connect to a new anti-cheating scenario in a short time and how to output an anti-cheating blacklist without anti-cheating samples are thorny problems often encountered in the anti-cheating field currently. Summary of the Invention

[0003] This application provides an anti-cheating blacklist output method, device, computer device, and storage medium to solve the problem of how to output a blacklist in the absence of anti-cheating samples.

[0004] In a first aspect, this application provides an anti-cheating blacklist output method, and the method includes:

[0005] Obtain log data of the anti-cheating service, where the log data includes behavior data of multiple different objects;

[0006] Extract features from the log data to obtain a feature set, where the feature set includes feature subsets of multiple objects, and the feature subsets include at least one of a time feature, a space feature, an element feature, and a composite feature, and the composite feature is the product of the feature values of any at least two of the time feature, the space feature, and the element feature;

[0007] Perform anomaly detection on the feature subsets of each object in the feature set to obtain the anomaly detection results of each object;

[0008] Output the anti-cheating blacklist corresponding to the anti-cheating service according to the anomaly detection results of each object.

[0009] In a second aspect, this application provides an anti-cheating blacklist output device, and the device includes:

[0010] An obtaining module, configured to obtain log data of the anti-cheating service, where the log data includes behavior data of multiple different objects;

[0011] A processing module, configured to extract features from the log data to obtain a feature set, where the feature set includes feature subsets of multiple objects, and the feature subsets include at least one of a time feature, a space feature, an element feature, and a composite feature, and the composite feature is the product of the feature values of any at least two of the time feature, the space feature, and the element feature;

[0012] A detection module, configured to perform anomaly detection on the feature subsets of each object in the feature set to obtain the anomaly detection results of each object;

[0013] An output module, configured to output an anti-cheating blacklist corresponding to the anti-cheating service according to the anomaly detection results of each object.

[0014] In a third aspect, the present application provides a computer device, including a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the computer program, the above anti-cheating blacklist output method is implemented.

[0015] In a fourth aspect, the present application further provides a computer storage medium storing computer-executable instructions for executing the above anti-cheating blacklist output method.

[0016] The above technical solution provided by the embodiments of the present application has the following advantages compared with the prior art: In the method provided by the embodiments of the present application, log data of an anti-cheating service is obtained, where the log data includes behavior data of multiple different objects; feature extraction is performed on the log data to obtain a feature set, where the feature set includes feature subsets of multiple objects, and the feature subsets include at least one of a time feature, a space feature, an element feature, and a composite feature, and the composite feature is the product of the feature values of any at least two of the time feature, the space feature, and the element feature; anomaly detection is performed on the feature subsets of each object in the feature set to obtain the anomaly detection results of each object; and an anti-cheating blacklist corresponding to the anti-cheating service is output according to the anomaly detection results of each object.

[0017] Based on the above method, feature extraction is performed on the log data of the anti-cheating service, and then anomaly detection is performed on the extracted features to obtain the anomaly detection results of each object in the anti-cheating service. Based on the anomaly detection results, it can be determined whether the corresponding object is a cheating object, and an anti-cheating blacklist corresponding to the anti-cheating service is output by integrating the anomaly detection results of all objects. The above process can output the anti-cheating blacklist without using anti-cheating samples, so it can solve the problem of how to output the blacklist in the case of lack of anti-cheating samples or no anti-cheating samples. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The accompanying drawings herein are incorporated into the specification and form a part of the specification, showing embodiments consistent with the present invention and used together with the specification to explain the principles of the present invention.

[0019] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings required for the description of the embodiments or the prior art. Obviously, for those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on these drawings.

[0020] One or more embodiments are illustrated by way of example with reference to the pictures in the corresponding drawings. These illustrative descriptions do not limit the embodiments. Elements with the same reference numerals in the drawings represent similar elements, and unless otherwise stated, the drawings in the figures do not constitute a scale limitation.

[0021] Figure 1 It is a schematic flowchart of an anti-cheating blacklist output method provided by an embodiment of the present application;

[0022] Figure 2 It is a schematic diagram of the Gaussian distribution effect provided by an embodiment of the present application;

[0023] Figure 3 It is a structural block diagram of an anti-cheating blacklist output device provided by an embodiment of the present application;

[0024] Figure 4 It is an internal structural schematic diagram of a computer device provided by an embodiment of the present application. Detailed implementation manners

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present application clearer, the following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are some, but not all, of the embodiments of the present application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present application without creative efforts fall within the scope of protection of the present application.

[0026] The following disclosure provides many different embodiments or examples for implementing different structures of the present invention. To simplify the disclosure of the present invention, the components and settings of specific examples are described below. Of course, they are only examples and are not intended to limit the present invention. In addition, the present invention may repeat reference numerals and / or letters in different examples. This repetition is for the purpose of simplification and clarity, and does not itself indicate the relationship between the various embodiments and / or settings discussed.

[0027] In one embodiment, Figure 1 It is a schematic flowchart of an anti-cheating blacklist output method in one embodiment. Refer to Figure 1, an anti-cheating blacklist output method is provided. In this embodiment, the method is mainly illustrated by taking its application to a server as an example. The anti-cheating blacklist output method specifically includes the following steps:

[0028] Step S210, obtain log data of the anti-cheating service, where the log data includes behavior data of multiple different objects.

[0029] Specifically, the anti-cheating service can be any different type of service that requires anti-cheating detection. The service type of the anti-cheating service can be a game service, an online education service, a financial service, an advertising service, a social media service, a workplace recruitment service, a blockchain service, etc. The log data includes behavior data of multiple different objects. The object can specifically be a user account or a user terminal. The behavior data of the object includes at least one of a time feature, a space feature, and an element feature. The time feature includes the moments when the object performs multiple different behavior operations, the behavior time difference of the same type of operations, the behavior time difference in natural order, etc. The space feature includes the location where the behavior occurs, the location where the behavior takes effect, the geographical location switching frequency, the click location switching frequency, the display location switching frequency, etc. The element feature includes the element where the behavior occurs, the displayed element, the element operation frequency. For example, the element where the behavior occurs is a click element, the displayed elements are advertising elements, video elements, activity material elements, etc. The element operation frequency includes the click frequency and the switching frequency.

[0030] Step S220, perform feature extraction on the log data to obtain a feature set, where the feature set includes feature subsets of multiple objects, and the feature subsets include at least one of a time feature, a space feature, an element feature, and a composite feature. The composite feature is the product of the feature values of any at least two of the time feature, the space feature, and the element feature.

[0031] Specifically, feature extraction is performed on the log data, and the features belonging to the same object are summarized into a feature subset. Multiple feature subsets corresponding to multiple objects are combined to form a feature set. Feature extraction is performed on the log data to extract various types of features. Different types of features at least include single-dimensional features such as time features, spatial features, and element features. Based on the extraction of at least two different types of features, the different types of single-dimensional features are multiplied to obtain composite features. For example, if the time feature is a, the spatial feature is b, and the element feature is c, the composite features include a*c, b*c, a*b, and a*b*c. Among them, a*c represents the behavioral time feature of different landing elements (such as the behavioral time link feature of an advertising creative, reflecting which times the operation behaviors occurred); b*c represents the behavioral spatial feature of different landing elements (such as the behavioral spatial link feature of an advertising creative, reflecting which positions the operation behaviors occurred); a*b represents the behavioral time feature of the behavioral space (such as the time link feature of a position, reflecting which times the operation behaviors occurred at this position); a*b*c represents the behavioral time feature of the landing element and the behavioral space (such as the behavioral spatial link and time link feature of an advertising creative, reflecting which positions and which times the landing element had operation behaviors).

[0032] Through the above time features, spatial features, element features, and composite features, the access behaviors of the objects can be accurately reflected, so that subsequent cheating anomaly detection can be accurately performed based on these features.

[0033] Step S230: Perform anomaly detection on the feature subsets of each object in the feature set to obtain the anomaly detection results of each object.

[0034] Specifically, anomaly detection is performed on the features in each feature subset to determine whether an object has cheating behavior. The obtained anomaly detection results can reflect whether the object is a cheating object. An anomaly detection result of anomaly indicates that the corresponding object has cheating behavior and is a cheating object, while an anomaly detection result of normal indicates that the corresponding object has no cheating behavior and is a normal access object.

[0035] Step S240: Output the anti-cheating blacklist corresponding to the anti-cheating service according to the anomaly detection results of each object.

[0036] Specifically, the anti-cheating blacklist corresponding to the anti-cheating service is output according to the anomaly detection results of each object. The anti-cheating blacklist includes cheating objects with cheating behavior, so as to subsequently restrict the abnormal access of cheating objects based on the anti-cheating blacklist, thereby ensuring the security of business access. The above process can output the anti-cheating blacklist without using anti-cheating samples, so it can solve the problem of how to output the blacklist in the case of lack of anti-cheating samples or no anti-cheating samples.

[0037] In one embodiment, the abnormal detection of the feature subsets of each object in the feature set to obtain the abnormal detection results of each object includes:

[0038] Perform abnormal detection on each feature in the feature subset of the target object in the feature set to obtain the feature detection results of each feature in the feature subset of the target object, where the target object is any object in the log data;

[0039] Determine the abnormal detection result of the target object according to the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature.

[0040] Specifically, first perform abnormal detection on each feature in each feature subset to obtain the feature detection results of each feature of the same object. The feature detection results are used to indicate the abnormal state of the feature. After comprehensively weighting all the features corresponding to the same object and the fusion weights corresponding to each feature, the weighted result is obtained to determine the abnormal detection result of the object. The abnormal detection result comprehensively reflects the abnormal states of all the features corresponding to the same object. In this way, based on the abnormal states of all the features corresponding to the same object, it can accurately reflect whether the behavior of the object is a cheating behavior, that is, it can accurately determine whether the object is a cheating object.

[0041] In one embodiment, before determining the abnormal detection result of the target object according to the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature, the method further includes:

[0042] Determine the fusion weight corresponding to each feature according to the service type of the anti-cheating service and / or the quality parameter corresponding to the log data.

[0043] Specifically, the fusion weights of each feature in the log data are different under different business types. Therefore, the fusion weights of each feature can be determined only according to the business type of the anti-fraud business. The quality parameters corresponding to the log data include log quality accuracy and log null rate. Log quality accuracy refers to the degree to which the information recorded in the log data conforms to the actual events or situations, that is, whether the content reflected by the log data accurately describes the true state and behavior of the system or business. The log null rate is the proportion of null values or missing values in the log data. Null values may appear in various fields, such as timestamp, user ID, operation content, etc. The higher the log quality accuracy and the lower the log null rate, the higher the fusion weight corresponding to the feature. On the contrary, the lower the log quality accuracy and the higher the log null rate, the lower the fusion weight corresponding to the feature. Therefore, the fusion weights corresponding to each feature can be determined only according to the quality parameters corresponding to the log data, or the fusion weights corresponding to each feature can be comprehensively determined by combining the business type of the anti-fraud business and the quality parameters corresponding to the log data, so as to improve the accuracy of the fusion weights.

[0044] In one embodiment, the performing anomaly detection on each feature in the feature subset of the target object in the feature set to obtain the feature detection result of each feature in the feature subset of the target object includes:

[0045] Using a Gaussian model to determine the deviation metric value between each feature in the feature subset of the target object in the feature set and the corresponding feature mean;

[0046] Determining the deviation metric value corresponding to each feature as the feature detection result of each feature in the feature subset of the target object.

[0047] Specifically, the feature detection result (deviation metric value) is where σ is the standard deviation, x i is the feature data corresponding to feature i, μ is the feature mean of the same feature type in the log data corresponding to the anti-fraud business, and the feature detection result is used to represent how many standard deviations the feature data x i deviates from the feature mean. For example, as Figure 2 shown, the overall proportion of data within 3σ is 99.73%. The feature detection results corresponding to the feature data outside this range are determined to be abnormal. That is, the anomaly detection of single-dimensional features is realized through the Gaussian distribution corresponding to the Gaussian model, that is, z i ≤3, then it is determined that the feature detection result is normal. On the contrary, z i >3, then it is determined that the feature detection result is abnormal. In this way, the abnormal state of each feature can be determined.

[0048] In one embodiment, determining the anomaly detection result of the target object based on the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature includes:

[0049] Determining the anomaly fusion index of the target object based on the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature;

[0050] Determining the anomaly detection result of the target object according to the comparison result between the anomaly fusion index of the target object and the set threshold.

[0051] Specifically, the anomaly fusion index is denoted as M i , where λ j is the fusion weight corresponding to feature j, is the feature detection result corresponding to feature i(j), and ∑ j λ j = 1, that is, the sum of the fusion weights corresponding to all features is 1. The set threshold is denoted as th g . The set threshold can be customized according to business requirements. The set threshold is used to define access outliers. The anomaly fusion index and the set threshold are compared, and based on the comparison result obtained, the anomaly detection result of the target object is determined, so as to accurately judge whether the object corresponding to the anomaly fusion index has cheating behavior.

[0052] In one embodiment, determining the anomaly detection result of the target object according to the comparison result between the anomaly fusion index of the target object and the set threshold includes:

[0053] When the anomaly fusion index of the target object is greater than or equal to the set threshold, determining that the anomaly detection result of the target object is abnormal; or,

[0054] When the anomaly fusion index of the target object is less than the set threshold, determining that the anomaly detection result of the target object is normal.

[0055] Specifically, if M i ≥ th g , the anomaly fusion index exceeds the set threshold, indicating that the object corresponding to the anomaly fusion index has cheating behavior, then determining that the anomaly detection result of the object is abnormal; if M i < th g , the anomaly fusion index does not exceed the set threshold, indicating that the object corresponding to the anomaly fusion index does not have cheating behavior, then determining that the anomaly detection result of the object is normal.

[0056] In one embodiment, according to the anomaly detection results of each of the objects, outputting the anti-cheating blacklist corresponding to the anti-cheating service includes:

[0057] Output the anti-cheating blacklist corresponding to the anti-cheating service for the objects with abnormal results in all anomaly detections; or,

[0058] Among the multiple objects with abnormal anomaly detection results, after sorting them in descending order according to the anomaly fusion index, output the anti-cheating blacklist corresponding to the anti-cheating service according to the preset number of objects ranked at the top.

[0059] Specifically, the cheating detection result of an object with an abnormal anomaly detection result is recorded as 1, and the cheating detection result of an object with a normal anomaly detection result is recorded as 0. The cheating detection result is Summarize all the objects with a cheating detection result of 1 to obtain a cheating set, and the cheating set is

[0060] The anti-cheating blacklist can be output according to all the objects with abnormal anomaly detection results, that is, generate the anti-cheating blacklist according to all the objects in the above-mentioned cheating set; or generate the anti-cheating blacklist according to some objects in the cheating set, that is, in the anomaly fusion corresponding to multiple objects in the anti-cheating service, select the top N objects to generate the anti-cheating blacklist after sorting them in descending order according to the anomaly fusion index, or select the top n% objects to generate the anti-cheating blacklist after sorting them in descending order according to the anomaly fusion index. N is the preset number, and the number of objects corresponding to n% (preset proportion n) is the preset number. The preset number N or the preset proportion n can be customized according to business requirements, so as to accurately output the anti-cheating blacklist with a limited number of objects.

[0061] Figure 1 It is a schematic flowchart of the method for outputting the anti-cheating blacklist in an embodiment. It should be understood that although Figure 1 the steps in the flowchart are shown in sequence according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise clearly stated in this article, the execution of these steps has no strict order limit, and these steps can be executed in other orders. Moreover, Figure 1 at least a part of the steps in

[0062] In an embodiment, as Figure 3 shown, an anti-cheating blacklist output device is provided, including:

[0063] An acquisition module 310, configured to acquire log data of an anti-cheating service, where the log data includes behavior data of multiple different objects;

[0064] A processing module 320, configured to perform feature extraction on the log data to obtain a feature set, where the feature set includes feature subsets of multiple objects, and the feature subsets include at least one of a time feature, a space feature, an element feature, and a composite feature, and the composite feature is the product of the feature values of any at least two of the time feature, the space feature, and the element feature;

[0065] A detection module 330, configured to perform anomaly detection on the feature subsets of each object in the feature set to obtain an anomaly detection result for each of the objects;

[0066] An output module 340, configured to output an anti-cheating blacklist corresponding to the anti-cheating service according to the anomaly detection results of each of the objects.

[0067] In one embodiment, the detection module 330 is further configured to:

[0068] Perform anomaly detection on each feature in the feature subset of the target object in the feature set to obtain a feature detection result for each feature in the feature subset of the target object, where the target object is any one object in the log data;

[0069] Determine the anomaly detection result of the target object according to the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature.

[0070] In one embodiment, the detection module 330 is further configured to:

[0071] Determine the fusion weight corresponding to each feature according to the service type of the anti-cheating service and / or the quality parameter corresponding to the log data.

[0072] In one embodiment, the detection module 330 is further configured to:

[0073] Use a Gaussian model to determine the deviation metric value between each feature in the feature subset of the target object in the feature set and the corresponding feature mean;

[0074] Determine the deviation metric value corresponding to each feature as the feature detection result for each feature in the feature subset of the target object.

[0075] In one embodiment, the detection module 330 is further configured to:

[0076] Determine the anomaly fusion index of the target object according to the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature;

[0077] The abnormality detection result of the target object is determined according to the comparison result between the abnormal fusion index of the target object and the set threshold.

[0078] In one embodiment, the detection module 330 is further configured to:

[0079] When the abnormal fusion index of the target object is greater than or equal to a set threshold, determining that the abnormal detection result of the target object is abnormal; or,

[0080] When the abnormal fusion index of the target object is less than a set threshold, it is determined that the abnormal detection result of the target object is normal.

[0081] In one embodiment, the output module 340 is further configured to:

[0082] Outputting the anti-cheating blacklist corresponding to the anti-cheating service according to all objects with abnormal detection results; or,

[0083] Among the multiple objects whose anomaly detection results are abnormal, after being sorted in descending order according to the anomaly fusion index, an anti-cheating blacklist corresponding to the anti-cheating service is output based on a preset number of objects that are ranked top.

[0084] like Figure 4 As shown, an embodiment of the present application provides a computer device, including a processor 711, a communication interface 712, a memory 713 and a communication bus 714, wherein the processor 711, the communication interface 712, and the memory 713 communicate with each other through the communication bus 714;

[0085] Memory 713, used for storing computer programs;

[0086] The processor 711 is used to implement the anti-cheating blacklist output method provided by any one of the aforementioned method embodiments when executing the program stored in the memory 713.

[0087] Those skilled in the art will understand that Figure 4 The structure shown in the figure is only a block diagram of a part of the structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than those shown in the figure, or combine certain components, or have a different arrangement of components.

[0088] In one embodiment, the anti-cheating blacklist output device provided by the present application can be implemented in the form of a computer program. The computer program can be used in Figure 4 The computer device shown in the figure is run. The memory of the computer device can store various program modules that constitute the anti-cheating blacklist output device, such as:Figure 3 The acquisition module 310, the processing module 320, the detection module 330, and the output module 340 shown. The computer program composed of each program module enables the processor to execute the anti-cheating blacklist output method of each embodiment of the present application described in this specification.

[0089] Figure 4 The computer device shown can pass through, such as Figure 3 The acquisition module 310 in the anti-cheating blacklist output device shown executes to acquire the log data of the anti-cheating service. Among them, the log data includes the behavior data of multiple different objects. The computer device can execute feature extraction on the log data through the processing module 320 to obtain a feature set. Among them, the feature set includes feature subsets of multiple objects, and the feature subset includes at least one of time feature, space feature, element feature, and composite feature. The composite feature is the product of the feature values of any at least two of the time feature, the space feature, and the element feature. The computer device can execute anomaly detection on the feature subsets of each object in the feature set through the detection module 330 to obtain the anomaly detection results of each object. The computer device can execute according to the anomaly detection results of each object through the output module 340 to output the anti-cheating blacklist corresponding to the anti-cheating service.

[0090] The embodiment of the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, it implements the anti-cheating blacklist output method provided in any one of the foregoing method embodiments.

[0091] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separated. The components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the modules can be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0092] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the related technology can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0093] It should be understood that the terms used herein are for the purpose of describing particular example embodiments only and are not intended to be limiting. Unless the context clearly dictates otherwise, the singular forms "a", "an", and "the" as used herein may also include the plural forms. The terms "comprising", "including", "containing", and "having" are inclusive and thus specify the presence of stated features, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, steps, operations, elements, components, and / or combinations thereof. The method steps, processes, and operations described herein are not to be construed as necessarily requiring their performance in the particular order described or illustrated, unless the order of performance is expressly stated. It should also be understood that alternatives may be used.

[0094] The above are only specific embodiments of the present invention, enabling those skilled in the art to understand or implement the present invention. Various modifications to these embodiments will be obvious to those skilled in the art, and the general principles defined herein can be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to these embodiments shown herein, but rather to the broadest scope consistent with the principles and novel features claimed herein.

Claims

1. A method for outputting an anti-cheating blacklist, characterized in that: The method comprises: Obtaining log data of an anti-cheating service, wherein the log data includes behavior data of multiple different objects; Performing feature extraction on the log data to obtain a feature set, wherein the feature set includes feature subsets of multiple objects, the feature subsets include at least one of a time feature, a space feature, an element feature, and a composite feature, and the composite feature is the product of feature values ​​of any at least two of the time feature, the space feature, and the element feature; Performing anomaly detection on a feature subset of each object in the feature set to obtain anomaly detection results for each object; According to the abnormality detection results of each of the objects, an anti-cheating blacklist corresponding to the anti-cheating service is output.

2. The method according to claim 1, characterized in that The performing anomaly detection on a feature subset of each object in the feature set to obtain an anomaly detection result of each object includes: Performing anomaly detection on each feature in a feature subset of a target object in the feature set to obtain a feature detection result of each feature in the feature subset of the target object, wherein the target object is any object in the log data; The abnormality detection result of the target object is determined according to the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature.

3. The method according to claim 2, characterized in that Before determining the abnormality detection result of the target object according to the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature, the method further includes: The fusion weight corresponding to each feature is determined according to the service type of the anti-cheating service and / or the quality parameter corresponding to the log data.

4. The method according to claim 3, characterized in that: The performing anomaly detection on each feature in the feature subset of the target object in the feature set to obtain a feature detection result for each feature in the feature subset of the target object includes: Determine, using a Gaussian model, a deviation measure between each feature in a feature subset of a target object in the feature set and a corresponding feature mean; The deviation metric value corresponding to each feature is determined as the feature detection result of each feature in the feature subset of the target object.

5. The method according to claim 3, characterized in that: The determining the abnormality detection result of the target object according to the weighted result between the fusion weight corresponding to each feature and the feature detection result of the corresponding feature includes: Determining an abnormal fusion index of the target object according to a weighted result between a fusion weight corresponding to each feature and a feature detection result of the corresponding feature; The abnormality detection result of the target object is determined according to the comparison result between the abnormal fusion index of the target object and the set threshold.

6. The method according to claim 5, characterized in that The determining the abnormality detection result of the target object according to the comparison result between the abnormal fusion index of the target object and the set threshold value includes: When the abnormal fusion index of the target object is greater than or equal to a set threshold, determining that the abnormal detection result of the target object is abnormal; or, When the abnormal fusion index of the target object is less than a set threshold, it is determined that the abnormal detection result of the target object is normal.

7. The method according to claim 6, characterized in that According to the abnormal detection results of each of the objects, an anti-cheating blacklist corresponding to the anti-cheating service is output, including: Outputting the anti-cheating blacklist corresponding to the anti-cheating service according to all objects with abnormal detection results; or, Among the multiple objects whose anomaly detection results are abnormal, after being sorted in descending order according to the anomaly fusion index, an anti-cheating blacklist corresponding to the anti-cheating service is output based on a preset number of objects that are ranked top. 8.An anti-cheating blacklist output device, characterized in that: The device comprises: An acquisition module, used to acquire log data of the anti-cheating service, wherein the log data includes behavior data of multiple different objects; a processing module, configured to perform feature extraction on the log data to obtain a feature set, wherein the feature set includes feature subsets of multiple objects, the feature subsets include at least one of a time feature, a space feature, an element feature, and a composite feature, and the composite feature is the product of feature values ​​of any at least two of the time feature, the space feature, and the element feature; A detection module, used to perform anomaly detection on a feature subset of each object in the feature set to obtain anomaly detection results for each object; The output module is used to output the anti-cheating blacklist corresponding to the anti-cheating service according to the abnormality detection results of each of the objects.

9. A computer device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images