A method and system for identifying abnormal transaction behavior of game users

Abstract

The application relates to the technical field of game transaction management, and discloses a game user abnormal transaction behavior identification method and system, which comprises the following steps: S1, acquiring the transaction, in-game behavior, social relationship data and multi-modal data of the device environment of a user, and constructing a personalized behavior baseline based on user historical data to generate a user normal behavior sequence; S2, regarding the user as a graph node, regarding the transaction, behavior, social relationship and device correlation as edges, constructing a dynamic transaction relationship graph, and analyzing the updated transaction relationship graph according to the edge weight calculation result. Through the utilization of a dynamic transaction construction module, the combination of a reinforcement learning strategy module, the real-time feedback of a game environment, the dynamic adjustment of a detection strategy and model parameters, the effective response to changes such as the adjustment of an in-game economic system and the emergence of new transaction modes, the continuous maintenance of the efficient identification ability of abnormal transaction behaviors and the overcoming of the poor adaptability of traditional static models.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of game transaction management, and particularly relates to a game user abnormal transaction behavior identification method and system. BACKGROUND

[0002] At present, the game industry is developing rapidly, virtual item transactions and player interactions are frequent, game economic systems are becoming increasingly complex, and game users' transaction behaviors cover the circulation of virtual assets such as virtual currency, props, equipment, and transaction forms are becoming more diversified. However, some users are driven by interests and use abnormal transaction behaviors such as malicious coin brushing, account sharing, and false transactions to disrupt the balance of the game economy and harm the experience of other players and the interests of game operators.

[0003] Traditional transaction identification methods rely on manual rule setting and are difficult to cope with complex and variable transaction patterns. Moreover, rule updates are not timely and may result in missed detection. Machine learning methods have been applied, but most are static models that cannot adaptively adjust to dynamic changes in the game environment and lack effective identification capabilities for new abnormal transaction forms. In addition, existing methods have poor model interpretability and cannot clearly explain the basis for abnormal determination to players and operators, leading to a trust crisis. SUMMARY

[0004] To solve the problems in the prior art, the present application provides a game user abnormal transaction behavior identification method and system.

[0005] To achieve the above-mentioned purpose, the present application provides a game user abnormal transaction behavior identification method, comprising the following steps:

[0006] S1, acquiring transaction, in-game behavior, social relationship data and multi-modal data of device environment of the user, and constructing a personalized behavior baseline based on historical data of the user to generate a normal behavior sequence of the user;

[0007] S2, regarding the user as a graph node, regarding transaction, behavior, social relationship and device association as edges, constructing a dynamic transaction relationship graph, and analyzing the updated transaction relationship graph according to the edge weight calculation result;

[0008] S3, performing self-supervised training using unlabeled game log data, constructing a loss function using a contrastive learning method, and calculating a virtual economic balance index according to an in-game item drop mechanism, a currency inflation rate and a transaction tax rule;

[0009] S4, performing millisecond-level processing on real-time transaction data through a stream processing framework, calculating a comprehensive risk score, and dividing risk levels according to the risk score;

[0010] S5, explain the model decision with SHAP value, generate abnormal transaction explanation label, form tamper-proof abnormal transaction evidence chain, and collect labeled data through human-computer cooperation, optimize model parameters and risk score in reverse;

[0011] S6, generate dynamic detection strategy through strategy network with the feedback of each abnormal transaction judgment process and optimization processing result, and continuously interact with the game environment to optimize the strategy network parameters.

[0012] Preferably, in step S1, generating a user normal behavior sequence comprises the following steps:

[0013] S11, collect transaction data between users, in-game behavior data, social relationship data, and device environment data information, and perform data cleaning and normalization processing;

[0014] S12, divide time into fixed-length time windows, and in each time window, calculate the statistics of each feature, with the formula being: , wherein, is the mean, is the standard deviation, is the number of transactions in the time window, is the transaction amount;

[0015] S13, take the feature statistics of each time window as the input sequence, and output the predicted feature value, with the formula being: , wherein, is the output predicted feature value, is the weight matrix of the full connection layer, is the hidden state obtained after the last time step, is the bias vector;

[0016] S14, according to the calculation results of the mean and the standard deviation, establish the stationary sequence autoregressive model and the moving average model, with the formula being: , wherein, is the stationary sequence of the natural regression part, is the dependent variable of the moving average part, is the autoregressive order, is the autoregressive coefficient, is the value of the stationary time series at time, is the moving average order, is the moving average coefficient, and are the values of the white noise sequence at and time, respectively;

[0017] S15, combine the stationary sequence autoregressive model and the moving average model to establish an ARIMA model, the formula is: , wherein, is a lag operator, and , is the difference order, is an autoregressive polynomial, and , wherein, is an autoregressive coefficient, is an autoregressive order, is a moving average polynomial, , wherein, is a moving average coefficient;

[0018] S16, using the ARIMA model with estimated parameters to predict future values to obtain the final predicted characteristic value .

[0019] Preferably, in step S2, analyzing the updated transaction relationship graph comprises the following steps:

[0020] S21, abstracting the game user as a node to construct a node set, abstracting the user's transaction, social and device relationship as an edge to form an edge set, and constructing a dynamic transaction relationship graph, the formula is: , wherein, is a dynamic transaction relationship graph, is a node set, is an edge set;

[0021] S22, combined with the multi-modal data acquisition result, giving each node an initial feature vector, and calculating the weight of the edge to reflect the closeness of the relationship between users, the formula is: , wherein, is the weight of the edge, the larger the value, the closer the relationship between users, is the transaction money, is the transaction frequency, is the social closeness between users, the value range is [0-1], , and are the corresponding weights, and are the normalized transaction money and frequency, respectively;

[0022] S23, neighborhood aggregation of node features, and updating the feature vector of the node, the formula is: , wherein, is the feature vector of node in the first layer, a neighborhood node set of the node , a weight matrix of the layer , an activation function, averaging the features of the neighborhood nodes;

[0023] S24, processing the updated transaction graph to identify high-density transaction clusters or one-sided star network structures in the graph, the formula being , wherein is the modularity value, is the total number of edges in the transaction graph, is the edge weight between node and node , and are the degrees of node and node , respectively, is a function for determining whether node and node belong to the same community, 1 if they do, and 0 otherwise, and when a sudden change in the modularity value or a subgraph structure that does not conform to the normal transaction pattern is detected, the subgraph is determined to be abnormal, and the transactions between the users in the subgraph are likely to be abnormal.

[0024] Preferably, in the step S3, the self-supervised training and abnormal pattern recognition include the following steps:

[0025] S31, collecting game log data, including but not limited to unlabeled data of normal transactions, behavior trajectories, and social relationships, and constructing an unlabeled data set;

[0026] S32, performing data enhancement operations on each user's original feature vector in the unlabeled data set to generate an augmented feature vector;

[0027] S33, based on the idea of contrastive learning, constructing a loss function to enable the model to learn the similarity of different augmented views of the same user and the difference between feature vectors of different users, the formula being , wherein is the feature vector value of the cross-entropy loss function, is the original feature vector, is the augmented feature vector, is a feature vector of another user, is a temperature parameter for controlling the learning difficulty, is a cosine similarity function for measuring the similarity between two feature vectors;

[0028] S34, using the constructed loss function to train the model, in the training process, the user original feature vector and the augmented feature vector in the unlabeled data set are input into the model, the loss is calculated and the model parameters are updated through back propagation, the model weight is optimized, and the model can learn the general transaction mode and behavior rule from the unlabeled data;

[0029] S35, after the training is completed, a small amount of labeled abnormal transaction data is introduced to fine-tune the pre-trained model, the labeled data is input into the model, the model parameters are further optimized through the cross loss function, the model is adapted to the specific needs of the game abnormal transaction scene, and the abnormal probability score is output, the formula is: , in the formula, is the total cross-entropy loss of the whole labeling technology and is the number of samples in the labeled abnormal transaction data, is the true label of the th sample, is the abnormal probability score output by the model for the th sample, is the transaction data feature of the th input;

[0030] S36, according to the abnormal probability score output by the model , set threshold , when , it is determined that the user's transaction behavior is abnormal, and when , it is determined that the user's transaction behavior is normal.

[0031] Preferably, in the step S32, the augmented feature vector is generated by the following steps:

[0032] S321, randomly replace part of the information in the transaction item type with special marks, force the model to learn to recover the complete features from the incomplete information;

[0033] S322, add random time offset to the transaction timestamp, simulate the slight shift in time sequence, and enhance the robustness of the model to time change;

[0034] S323, report a part of the subgraph randomly sampled from the user's social relationship graph, retain the key social links, remove the honor information, and make the model focus on the core social features.

[0035] Preferably, in the step S4, the transaction data is processed and divided into risk levels by the following steps:

[0036] ​S41, intervene in the game transaction record in real time through a stream processing framework, including but not limited to the timestamp of each transaction, the ID of the transaction parties, the transaction money, and the transaction item information, to generate a real-time feature vector;

[0037] S42, use an edge computing node to pre-process the transaction data locally on a server cluster, extract device environment related light graph features including but not limited to device fingerprints, IP addresses, and whether there is a simulator, and generate a unique identifier;

[0038] S43, compare the real-time feature vector with a dynamic behavior baseline, calculate the deviation, and the formula is: , wherein, is the real-time feature vector , is the first feature value of the real-time feature vector , is the first feature value of the behavior baseline vector , is the feature dimension, and the greater the value of , the higher the degree of deviation of the current transaction behavior from the normal mode;

[0039] S44, integrate the real-time transaction data into a dynamic transaction relationship graph, update the graph structure and node features, and analyze the relationship graph to output an abnormal score of each transaction behavior, and the formula is: , wherein, is the abnormal score of the node , is the dimension of the embedding vector, and are the first components of the embedding vector and the abnormal transaction cluster centroid vector of the node , respectively;

[0040] S45, according to the abnormal score, combine the dynamic behavior baseline deviation and the transaction abnormal score to calculate a comprehensive risk score, and the formula is: , wherein, and are the corresponding weight coefficients, , and divide the risk threshold, according to the risk score, divide the risk level, when , divide into low risk, when , divide into medium risk, when , divide into high risk, , divide into extremely high risk, wherein, and are the set low, medium, and high risk thresholds.

[0041] ​​​​​Preferably, in the step S5, the generation of the abnormal transaction evidence chain and the reverse optimization model parameters and risk score comprises the following steps:

[0042] S51, calculate the SHAP value, quantify the contribution of each feature to the model prediction result, the formula is: , wherein, is the SHAP value of the feature , is a subset of the feature set , is the number of elements in the subset , is the total number of features, is the prediction value of the model when only using the features in the subset , is the change in the model prediction value after adding the feature to the subset ; S52, screen out the features with large absolute SHAP values, combine the preset explanation template, and convert the key features and their SHAP values into natural language; S53, collect evidence data, and perform hash operation on the collected evidence data to generate a unique transaction hash value, the formula is: , wherein,

[0043] is the transaction hash value, is data splicing,

[0044] , , , , , , , , and are the transaction timestamp, transaction gold, transaction item information, device fingerprint, SHAP value explanation label and output abnormal probability score respectively, and then record the transaction hash value, original evidence data, timestamp, transaction gold, transaction item information, device fingerprint, SHAP value explanation label and output abnormal probability score to the block chain distributed ledger to ensure the authenticity and permanent storage of the evidence chain;

[0045] S54, the system shows the preliminary determination result of the abnormal transaction, the SHAP value explanation label and the original evidence data to the artificial auditing personnel for manual determination and annotation, and recycles the manual annotation data;

[0046] S55, divide the recycled annotation data into training set and test set, use the gradient descent optimization algorithm to perform back propagation on the model parameters, the formula is: , wherein, is the feature vector value of the cross loss function after back propagation, is the sample The true label, For the model to sample The predicted probability of .

[0047] Preferably, in step S6, optimizing the strategic network parameters includes the following steps:

[0048] S61. Integrate the current game's economic status, user behavior data, and model recognition results into a state vector. The formula is: , where is the integrated state vector, is a vector of game economic indicators, including but not limited to the game currency inflation rate and the price deviation of rare equipment. is the deviation of user behavior baseline, is the historical risk level sequence, is the abnormal probability score output by the model;

[0049] S62. Define executable detection strategy actions and design a reward mechanism based on abnormal transaction determination and optimization results. The formula is: , where is the reward value, The rate of change of the accuracy of abnormal transaction identification, This is the improvement value of the stability of the game's economic indicators. is the number of false positives, 、 and are the corresponding weights respectively;

[0050] S63. Build a policy network, output the probability distribution of each action, and optimize the policy network parameters according to the dynamic strategy;

[0051] S64. Repeat steps S61-S63, continuously interact with the game environment, accumulate experience data and update the strategy network until the loss function converges or the reward value reaches a stable state, and then output the final dynamic detection strategy.

[0052] Preferably, in step S63, optimizing the policy network parameters includes the following steps:

[0053] S631. Use a deep neural network to build a policy network, input the state vector, and output the probability distribution of the action. The formula is: , where Strategic Network In a given state Take action The probability of is the parameter set of the policy network, and is the network weight matrix, and is the bias vector;

[0054] S632, randomly initialize the policy network parameters, and set the learning rate and discount factor parameters;

[0055] S633. At each time step, based on the current state, sample actions through the policy network and perform corresponding detection strategy adjustments;

[0056] S634: After executing the sampling action, observe the changes in the game environment and obtain the new state and reward value;

[0057] S635. Use the temporal difference learning algorithm to define the objective function. The formula is: , where For the strategy Next, status Execute action when The state-action value function, To find the expectation of the interior random variable, For The reward value obtained at any time, is the discount factor, with a value range of [0-1]. The closer its value is to 0, the more emphasis is placed on current rewards, and the closer its value is to 1, the more emphasis is placed on future rewards. For the strategy Next, next state Execute the next action The maximum state-action value of

[0058] S636. Optimize the network strategy by minimizing the loss function. The formula is: , where is the loss function value, Strategic Network In a given state Take action Logarithm of probability;

[0059] S637, use stochastic gradient descent to update the network strategy, the formula is: , where is the learning rate, is the loss function Parameters gradient.

[0060] A system for identifying abnormal transaction behavior of game users, applied to any one of the above-mentioned methods for identifying abnormal transaction behavior of game users, comprises:

[0061] Data acquisition and processing module, used to collect multi-source data and pre-process the data;

[0062] a dynamic transaction construction module, configured to construct a dynamic transaction model of the user based on the processed data;

[0063] a self-supervised learning module, configured to mine the structure and rules inside the data without manual annotation;

[0064] a risk assessment and division module, configured to perform risk assessment on the transaction behavior of the user according to the output feature representation;

[0065] a traceability and hierarchical processing module, configured to perform traceability analysis on the abnormal transaction determined as high risk;

[0066] a reinforcement learning strategy module, configured to continuously optimize the detection strategy and dynamically adjust the model parameters and detection rules according to the system feedback.

[0067] The game user abnormal transaction behavior recognition method and system provided by the application has the following beneficial effects:

[0068] 1. By using the dynamic transaction construction module to construct the dynamic transaction model, combining the reinforcement learning strategy module, and dynamically adjusting the detection strategy and model parameters according to the real-time feedback of the game environment, the changes such as the adjustment of the in-game economic system and the emergence of new transaction modes can be effectively responded to, the high-efficiency recognition ability of abnormal transaction behavior can be continuously maintained, and the poor adaptability of the traditional static model is overcome.

[0069] 2. By using the self-supervised learning module and the self-supervised learning technology, the internal rules of the data can be mined without a large amount of manual annotation data, the normal and abnormal transaction modes can be learned, the workload and cost of manual annotation can be greatly reduced, the understanding depth and generalization ability of the model to the transaction mode can be improved, and the model can still run well under the condition of limited data.

[0070] 3. By using the traceability and hierarchical processing module to carry out traceability analysis and hierarchical disposal on transactions of different risk levels, the abnormal transaction behavior can be accurately attacked, the game economic order can be ensured, the disposal strength can be reasonably controlled, the normal transaction can be avoided from being excessively intervened, the model decision interpretability can be realized based on the SHAP value and other technologies, the clear and understandable abnormal transaction explanation label can be generated, the abnormal judgment reason and key influencing factors can be clearly shown to the players and the operators, and the trust of the players in the justice of the game operation can be enhanced. BRIEF DESCRIPTION OF DRAWINGS

[0071] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or the prior art description. Obviously, the drawings in the following description only some embodiments of the application, and for those skilled in the art, other drawings can also be obtained without creative labor on the basis of these drawings.

[0072] Fig. 1 A game user abnormal transaction behavior identification method and system provided by the present application provides a step flow diagram;

[0073] Fig. 2 A game user abnormal transaction behavior identification method and system provided by the present application provides a system module diagram. DETAILED DESCRIPTION

[0074] The specific embodiments of the present application will be further described in detail below in combination with the drawings and examples in the specification. The following examples are only used to illustrate the present application, but cannot be used to limit the scope of the present application.

[0075] As Figs. 1-2 shown, the present embodiment proposes a game user abnormal transaction behavior identification method, including the following steps:

[0076] S1, acquiring the transaction, in-game behavior, social relationship data and multi-modal data of the device environment of the user, and constructing a personalized behavior baseline based on the user historical data to generate a user normal behavior sequence;

[0077] S2, regarding the user as a graph node, regarding the transaction, behavior, social and device association as an edge, constructing a dynamic transaction relationship graph, and analyzing the updated transaction relationship graph according to the edge weight calculation result;

[0078] S3, using unlabeled game log data for self-supervised training, using a contrast learning method to construct a loss function, and calculating a virtual economic balance index according to the in-game item drop mechanism, the currency inflation rate and the transaction tax rules;

[0079] S4, performing millisecond-level processing on real-time transaction data through a stream processing framework, calculating a comprehensive risk score, and dividing risk levels according to the risk score;

[0080] S5, using SHAP value to explain the model decision, generating abnormal transaction explanation labels, forming an unforgeable abnormal transaction evidence chain, and collecting labeled data through human-computer collaboration, and optimizing model parameters and risk scores in reverse;

[0081] S6, using the feedback of each abnormal transaction judgment process and optimization processing result, generating a dynamic detection strategy through a strategy network, and continuously interacting with the game environment to optimize the strategy network parameters.

[0082] In the present embodiment, the step S1 of generating a user normal behavior sequence includes the following steps:

[0083] S11, collecting transaction data between users, in-game behavior data, social relationship data, device environment data information, and performing data cleaning and normalization processing;

[0084] S12, divide the time into fixed length time windows, in each time window, calculate the statistics of each feature, the formula is: , wherein, is the mean, is the standard deviation, is the number of transactions in the time window, is the transaction gold;

[0085] S13, the feature statistics of each time window is the input sequence, and the predicted feature value is output, the formula is: , wherein, is the output predicted feature value, is the weight matrix of the full connection layer, is the hidden state obtained after the last time step, is the bias vector;

[0086] S14, according to the calculation results of the mean and the standard deviation, establish the stationary sequence autoregressive model and the moving average model, the formula is: , wherein, is the stationary sequence of the natural regression part, is the dependent variable of the moving average part, is the autoregressive order, is the autoregressive coefficient, is the value of the stationary time series at time, is the moving average order, is the moving average coefficient, and are the values of the white noise sequence at and time;

[0087] S15, combined with the establishment of the stationary sequence autoregressive model and the moving average model, establish the ARIMA model, the formula is: , wherein, is the lag operator, and , is the difference order, is the autoregressive polynomial, and , wherein, is the autoregressive coefficient, is the autoregressive order, is the moving average polynomial, , wherein, is the moving average coefficient;

[0088] S16, using the ARIMA model with the estimated parameters to predict future values to obtain the final predicted characteristic values .

[0089] Specifically, through the data acquisition and processing module, multi-modal data such as user transactions, in-game behavior, social relationships, and device environment are comprehensively obtained, and through deep analysis and feature extraction, the potential correlation between data is fully mined. Compared with traditional methods that rely only on single or a small number of data dimensions, it can more accurately capture abnormal transaction behavior characteristics and significantly reduce false positives and false negatives.

[0090] In this embodiment, the analysis of the updated transaction relationship graph in step S2 includes the following steps:

[0091] S21, abstract the game users as nodes to construct a node set, and abstract the users' transactions, social relationships, and device relationships as edges to form an edge set, and construct a dynamic transaction relationship graph, the formula is: , wherein, is the dynamic transaction relationship graph, is the node set, is the edge set;

[0092] S22, combined with the multi-modal data acquisition result, give each node an initial feature vector, and calculate the weight of the edge to reflect the closeness of the relationship between users, the formula is: , wherein, is the weight of the edge, the larger the value, the closer the relationship between users, is the transaction money, is the transaction frequency, is the social closeness between users, the value range is [0-1], , and are the corresponding weights, and are the normalized transaction money and frequency, respectively;

[0093] S23, aggregate the node features in the neighborhood, and update the feature vector of the node, the formula is: , wherein, is the feature vector of the node in the first layer, is the neighborhood node set of the node , is the weight matrix of the first layer, is the activation function, is the average of the neighborhood node features;

[0094] S24, processing the updated transaction relationship graph to identify a high-density transaction cluster or a one-sided star network structure in the graph, the formula being , wherein, is a modularity value, is the total number of edges in the transaction relationship graph, is the edge weight between node and node , and are the degrees of node and node , respectively, is a function of determining whether node and node belong to the same community, 1 if they belong to the same community, and 0 otherwise, and when a sudden change in the modularity value or a subgraph structure that does not conform to the normal transaction mode is detected, the subgraph is determined to be an abnormal subgraph, and the transactions between the users in the abnormal subgraph may be abnormal.

[0095] In this embodiment, in step S3, the self-supervised training and abnormal pattern recognition include the following steps:

[0096] S31, collecting game log data, including but not limited to unlabeled data of normal transactions, behavior trajectories, and social relationships, and constructing an unlabeled data set;

[0097] S32, performing a data augmentation operation on each user original feature vector in the unlabeled data set to generate an augmented feature vector;

[0098] S33, based on the idea of contrast learning, constructing a loss function so that the model learns the similarity of different augmented views of the same user and the difference between feature vectors of different users, the formula being: , wherein, is the feature vector value of the cross loss function, is the original feature vector, is the augmented feature vector, is the feature vector of another user, is a temperature parameter for controlling the learning difficulty, is a cosine similarity function for measuring the similarity between two feature vectors;

[0099] S34, using the constructed loss function to train the model, in the training process, inputting the original feature vector and the augmented feature vector of the user in the unlabeled data set into the model, calculating the loss and updating the model parameters through back propagation, and optimizing the weight of the model, so that the model can learn the general transaction mode and behavior rule from the unlabeled data;

[0100] S35. After training is completed, a small amount of labeled abnormal transaction data is introduced to fine-tune the pre-trained model. The labeled data is input into the model, and the model parameters are further optimized through the cross-loss function to adapt the model to the specific needs of the game abnormal transaction scenario. The abnormal probability score is output. The formula is: , where is the total cross entropy loss of the entire annotation technique, is the number of samples in the annotated abnormal transaction data, For the The true labels of samples, For the model samples The output abnormal probability score, For the Input transaction data features;

[0101] S36. Abnormal probability score based on model output , set the threshold ,when When the user's transaction behavior is judged to be abnormal, At this time, the user's transaction behavior is judged to be normal.

[0102] In this embodiment, in step S32, generating the augmented feature vector includes the following steps:

[0103] S321. Randomly replace part of the information in the transaction item type with special tags, forcing the model to learn to recover complete features from incomplete information.

[0104] S322. Add random time offsets to transaction timestamps to simulate small fluctuations in the time series and enhance the model's robustness to time changes.

[0105] S323. Randomly sample some subgraphs from the social relationship graph of the reporting user, retain key social links, remove honor information, and make the model focus on core social features.

[0106] Specifically, by using the self-supervised learning module and self-supervised learning technology, the inherent laws of the data can be mined without a large amount of manual labeling of data, and normal and abnormal trading patterns can be learned, which greatly reduces the workload and cost of manual labeling. At the same time, it improves the model's depth of understanding of trading patterns and generalization ability, so that the model can still operate well under limited data conditions.

[0107] In this embodiment, in step S4, processing the transaction data and classifying the risk levels includes the following steps:

[0108] S41. Use a stream processing framework to access game transaction records in real time, including but not limited to the timestamp of each transaction, the IDs of both parties, the transaction amount, and the transaction item information, to generate a real-time feature vector.

[0109] S42. Preprocess the transaction data locally in the server cluster using edge computing nodes to extract lightweight graph features related to the device environment, including but not limited to device fingerprints, IP addresses, and the presence of a simulator, and generate a unique identifier.

[0110] S43. Compare the real-time feature vector with the dynamic behavior baseline and calculate the deviation. The formula is: , where is the real-time feature vector No. eigenvalues, is the behavioral baseline vector No. eigenvalues, is the feature dimension, when The larger the value of , the more the current trading behavior deviates from the normal pattern;

[0111] S44. Integrate the real-time transaction data into the dynamic transaction relationship graph, update the graph structure and node features, analyze the relationship graph, and output the abnormality score of each transaction behavior. The formula is: , where For nodes The anomaly score, is the dimension of the embedding vector, and Node The embedding vector of the abnormal transaction cluster and the centroid vector of the Quantity

[0112] S45. Calculate the comprehensive risk score based on the anomaly score, combined with the dynamic behavior baseline deviation and the transaction anomaly score. The formula is: , where and as well as are the corresponding weight coefficients, , and divide the risk threshold, and divide the risk level according to the risk score. When When When the risk is high, When , it is classified as extremely high risk, where, and as well as The risk thresholds are set as low, medium and high respectively.

[0113] In this embodiment, in step S5, generating the abnormal transaction evidence chain and the reverse optimization model parameters and risk score includes the following steps:

[0114] S51, calculate the SHAP value to quantify the contribution of each feature to the model prediction result, the formula is: , wherein is the SHAP value of the feature , is a subset of the feature set , is the number of elements in the subset , is the total number of features , is the prediction value of the model when only using the features in the subset , is the change in the model prediction value after adding the feature to the subset . S52, filter out features with large absolute SHAP values, and convert key features and their SHAP values into natural language according to a preset explanation template; S53, collect evidence data and perform hash operation on the collected evidence data to generate a unique transaction hash value, the formula is: , wherein

[0115] is the transaction hash value, is data splicing,

[0116] , , , , , , , , and are the transaction timestamp, transaction gold, transaction item information, device fingerprint, SHAP value explanation label and output abnormal probability score respectively, and then record the transaction hash value, original evidence data, timestamp, transaction gold, transaction item information, device fingerprint, SHAP value explanation label and output abnormal probability score in the block chain distributed ledger to ensure the authenticity and permanent storage of the evidence chain;

[0117] S54, the system displays the preliminary determination result of the abnormal transaction, the SHAP value explanation label and the original evidence data to the artificial auditing personnel for manual determination and annotation, and recovers the manual annotation data;

[0118] S55, divide the recovered annotation data into training set and test set, and use gradient descent optimization algorithm to perform back propagation on the model parameters, the formula is: , wherein is the feature vector value of the cross loss function after back propagation, is the sample a real label, a predicted probability of the model for the sample .

[0119] Specifically, the traceability hierarchical processing module carries out traceability analysis and hierarchical disposal for transactions of different risk levels, realizes accurate attack on abnormal transaction behavior, guarantees the game economic order, reasonably controls the disposal strength, avoids excessive intervention in normal transactions, realizes the model decision interpretability based on SHAP value and other technologies, generates clear and understandable abnormal transaction explanation labels, and clearly shows the players and operators the abnormal determination reasons and key influencing factors, and enhances the trust of players in the justice of game operation.

[0120] In the embodiment, in step S6, the optimization of the strategy network parameters includes the following steps:

[0121] S61, integrate the economic state of the current game, user behavior data and model identification results into a state vector, the formula is: , wherein, is the integrated state vector, is a game economic index vector, including but not limited to game currency inflation rate, rare equipment price deviation, is a user behavior baseline deviation amount, is a historical risk level sequence, is an abnormal probability score output by the model;

[0122] S62, define executable detection strategy actions, and design a reward mechanism according to the abnormal transaction determination and optimization results, the formula is: , wherein, is a reward value, is the change rate of the accuracy of abnormal transaction identification, is the improvement value of the stability of the game economic index, is the number of false positives, , and are the corresponding weights, respectively;

[0123] S63, construct a strategy network, output the probability distribution of each action, and optimize the strategy network parameters according to the dynamic strategy;

[0124] S64, repeat steps S61-S63, interact with the game environment continuously, accumulate experience data and update the strategy network, until the loss function converges or the reward value reaches a stable state, and output the final dynamic detection strategy.

[0125] In the embodiment, in step S63, the optimization of the strategy network parameters includes the following steps:

[0126] S631. Use a deep neural network to build a policy network, input the state vector, and output the probability distribution of the action. The formula is: , where Strategic Network In a given state Take action The probability of is the parameter set of the policy network, and is the network weight matrix, and is the bias vector;

[0127] S632. Randomly initialize the policy network parameters and set the learning rate and discount factor parameters;

[0128] S633. At each time step, based on the current state, sample actions through the policy network and perform corresponding detection strategy adjustments;

[0129] S634: After executing the sampling action, observe the changes in the game environment and obtain the new state and reward value;

[0130] S635. Use the temporal difference learning algorithm to define the objective function. The formula is: , where For the strategy Next, status Execute action when The state-action value function, To find the expectation of the interior random variable, For The reward value obtained at any time, is the discount factor, with a value range of [0-1]. The closer its value is to 0, the more emphasis is placed on current rewards, and the closer its value is to 1, the more emphasis is placed on future rewards. For the strategy Next, next state Execute the next action The maximum state-action value of

[0131] S636. Optimize the network strategy by minimizing the loss function. The formula is: , where is the loss function value, Strategic Network In a given state Take action Logarithm of probability;

[0132] S637, use stochastic gradient descent to update the network strategy, the formula is: , where is the learning rate, is a loss function the gradient of the parameter .

[0133] Specifically, by constructing a dynamic transaction model through a dynamic transaction construction module, combining a reinforcement learning strategy module, and dynamically adjusting the detection strategy and model parameters according to real-time feedback of the game environment, changes such as adjustment of the in-game economic system and appearance of new transaction modes can be effectively responded to, the ability to continuously maintain efficient identification of abnormal transaction behavior is maintained, and the poor adaptability of traditional static models is overcome.

[0134] A game user abnormal transaction behavior identification system applied to the game user abnormal transaction behavior identification method of any one of the above, comprising:

[0135] A data acquisition and processing module for acquiring multi-source data and pre-processing the data;

[0136] A dynamic transaction construction module for constructing a dynamic transaction model of the user based on the processed data;

[0137] A self-supervised learning module for mining the structure and rules of the data without manual annotation;

[0138] A risk assessment and division module for performing risk assessment on the user's transaction behavior according to the output feature representation;

[0139] A traceability and hierarchical processing module for performing traceability analysis on the abnormal transactions determined to be high-risk;

[0140] A reinforcement learning strategy module for continuously optimizing the detection strategy according to system feedback, dynamically adjusting the model parameters and detection rules.

[0141] The above embodiments are only used to illustrate the present application, and are not intended to limit the present application. Although the present application has been described in detail with reference to the embodiments, those skilled in the art should understand that various combinations, modifications or equivalent replacements of the technical solutions of the present application do not deviate from the spirit and scope of the present application, and should be covered in the scope of the claims of the present application.

Claims

1. A method for identifying abnormal transaction behavior of game users, characterized in that: The following steps are involved: S1. Obtain multimodal data on users' transactions, in-game behaviors, social relationships, and device environments, and build a personalized behavior baseline based on historical user data to generate a normal user behavior sequence. S2. Build a dynamic transaction relationship graph by treating users as graph nodes and transactions, behaviors, social interactions, and device associations as edges. Analyze the updated transaction relationship graph based on edge weight calculation results. S3. Use unlabeled game log data for self-supervised training, adopt contrastive learning to construct a loss function, and calculate the virtual economic balance indicator based on the in-game item drop mechanism, currency inflation rate, and transaction tax rules; S4. Use the stream processing framework to process real-time transaction data in milliseconds, calculate the comprehensive risk score, and classify the risk level based on the risk score; In step S4, processing the transaction data and classifying the risk levels includes the following steps: S41. Use the stream processing framework to access game transaction records in real time, including the timestamp, IDs of both parties, transaction amount, and transaction item information of each transaction, and generate a real-time feature vector. S42. Preprocess the transaction data locally in the server cluster using edge computing nodes to extract lightweight graph features related to the device environment, including device fingerprints, IP addresses, and the presence of a simulator, and generate a unique identifier. S43. Compare the real-time feature vector with the dynamic behavior baseline and calculate the deviation. The formula is: , where is the real-time feature vector No. eigenvalues, is the behavioral baseline vector No. eigenvalues, is the feature dimension, when The larger the value of , the more the current trading behavior deviates from the normal pattern; S44. Integrate the real-time transaction data into the dynamic transaction relationship graph, update the graph structure and node features, analyze the relationship graph, and output the abnormality score of each transaction behavior. The formula is: , where For nodes The anomaly score, is the dimension of the embedding vector, and Node The embedding vector of the abnormal transaction cluster and the centroid vector of the Quantity S45. Combine the dynamic behavior baseline deviation and the transaction anomaly score to calculate the comprehensive risk score. The formula is: , where and as well as are the corresponding weight coefficients, , Score the abnormal probability and divide the risk threshold. According to the risk score, divide the risk level. When When When the risk is high, When , it is classified as extremely high risk, where, and as well as The low, medium and high risk thresholds are set respectively; S5. Utilize SHAP values ​​to explain model decisions and generate labels explaining abnormal transactions, forming an unalterable chain of evidence for abnormal transactions. Through human-machine collaboration, we collect labeled data and reversely optimize the risk calculation model parameters and risk scores. In step S5, generating the abnormal transaction evidence chain and the parameters and risk scores of the reverse optimization risk calculation model includes the following steps: S51. Calculate the SHAP value to quantify the contribution of each feature to the model prediction results. The formula is: , where Features SHAP value, is a feature set A subset of For subset The number of elements of is the total number of features, When only a subset is used The features in are the predicted values ​​of the model, To feature Join Subset The model prediction value changes after S52. Filter out features with larger absolute SHAP values, and convert the key features and their SHAP values ​​into natural language using a preset interpretation template. S53. Evidence data is collected and hashed to generate a unique transaction hash value. The formula is: , where is the transaction hash value, For data splicing, 、 、 、 、 as well as The transaction timestamp, transaction amount, transaction item information, device fingerprint, SHAP value interpretation label and output abnormal probability score are recorded in the blockchain distributed ledger to ensure the authenticity and permanent storage of the evidence chain. S54. The system displays the preliminary determination results of abnormal transactions, SHAP value interpretation labels, and original evidence data to the manual reviewer for manual determination and annotation, and collects the manually annotated data; S55. Divide the recovered labeled data into training set and test set, and use the gradient descent optimization algorithm to backpropagate the model parameters. The formula is: , where is the eigenvector value of the cross loss function after back propagation, For samples The true label, For the model to sample The predicted probability of S6. Based on the feedback from each abnormal transaction determination process and optimization results, a dynamic detection strategy is generated through the strategy network, which continuously interacts with the game environment to optimize the strategy network parameters.

2. A method for identifying abnormal transaction behavior of game users according to claim 1, characterized in that: In step S1, generating a normal user behavior sequence includes the following steps: S11. Collect transaction data between users, in-game behavior data, social relationship data, and device environment data, and clean and normalize the data; S12. Divide the time into time windows of fixed length, and calculate the statistics of each feature in each time window; S13. Take the feature statistics of each time window as the input sequence and output the predicted feature value. The formula is: , where is the feature value of the output prediction, is the weight matrix of the fully connected layer, is the hidden state obtained after the last time step, is the bias vector; S14. Based on the calculation results of the mean and standard deviation, establish the stabilized sequence autoregressive model and moving average model. The formula is: , where is the sequence after the natural regression part is stabilized, is the dependent variable of the moving average part, is the autoregressive order, is the autoregressive coefficient, The time series after stationary The value of the moment, is the moving average order, is the moving average coefficient, and are white noise sequences in and The value of the moment; S15. Combine the established autoregressive model and moving average model to build an ARIMA model. The formula is: , where is a lag operator, and , is the difference order, is an autoregressive polynomial, and ,in, is the autoregressive coefficient, is the autoregressive order, is the moving average polynomial, ,in, is the moving average coefficient; S16. Use the ARIMA model with estimated parameters to predict future values ​​and obtain the final predicted eigenvalues .

3. A method for identifying abnormal transaction behavior of game users according to claim 1, characterized in that: In step S2, analyzing the updated transaction relationship graph includes the following steps: S21. Game users are abstracted as nodes, and node sets are constructed. Users’ transactions, social interactions, and device relationships are abstracted as edges, forming an edge set. A dynamic transaction relationship graph is constructed using the following formula: , where is a dynamic transaction relationship diagram, is a node set, For the edge collection; S22. Based on the multimodal data collection results, an initial feature vector is assigned to each node, and the weight of the edge is calculated to reflect the closeness of the relationship between users. The formula is: , where is the weight of the edge. The larger the value, the closer the relationship between users. For transaction money, is the transaction frequency, is the social intimacy between users, with a value range of [0-1], 、 and are the corresponding weights, and are the normalized transaction amount and frequency respectively; S23. Perform neighborhood aggregation on node features and update the feature vector of the node. The formula is: , where For nodes In the The feature vector of the layer, For nodes The collection of neighboring nodes, For the The weight matrix of the layer, is the activation function, To average the features of neighboring nodes; S24. Process the updated transaction relationship graph to identify high-density transaction clusters or one-side star network structures in the graph. The formula is: , where is the modularity value, is the total number of edges in the transaction graph, For nodes and nodes The edge weights between and Node and nodes The degree, For judgment nodes and nodes A function that determines whether the user belongs to the same community. If so, the value is 1, otherwise, the value is 0. When a sudden change in the modularity value or a subgraph structure that does not conform to the normal transaction pattern is detected, it is determined to be an abnormal subgraph, and the transactions between the users in the subgraph may be abnormal.

4. A method for identifying abnormal transaction behavior of game users according to claim 1, characterized in that: In step S3, the self-supervised training and abnormal pattern recognition includes the following steps: S31. Collect game log data, including unlabeled data on normal transactions, behavioral trajectories, and social relationships, and construct an unlabeled dataset. S32, performing a data augmentation operation on the original feature vector of each user in the unlabeled dataset to generate an augmented feature vector; S33. Based on the contrastive learning idea, a loss function is constructed to enable the model to learn the similarities between different augmented views of the same user and the differences between feature vectors of different users. The formula is: , where The eigenvector value of the cross loss function, is the original eigenvector, is the augmented eigenvector, are other user feature vectors, To control the temperature parameter of learning difficulty, is the cosine similarity function that measures the similarity between two feature vectors; S34. Use the constructed loss function to train the model. During the training process, the original feature vectors and augmented feature vectors of users in the unlabeled dataset are input into the model. The loss is calculated and the model parameters are updated through backpropagation to optimize the model weights, so that the model can learn common transaction patterns and behavioral patterns from the unlabeled data. S35. After training is completed, a small amount of labeled abnormal transaction data is introduced to fine-tune the pre-trained model. The labeled data is input into the model, and the model parameters are further optimized through the cross-loss function to adapt the model to the specific needs of the game abnormal transaction scenario. The abnormal probability score is output. The formula is: , where Score the anomaly probability, is the number of samples in the annotated abnormal transaction data, For the The true labels of samples, For the model samples The output abnormal probability score, For the Input transaction data features; S36. Abnormal probability score based on model output , set the threshold ,when When the user's transaction behavior is judged to be abnormal, At this time, the user's transaction behavior is judged to be normal.

5. A method for identifying abnormal transaction behavior of game users according to claim 4, characterized in that: In step S32, generating the augmented feature vector includes the following steps: S321. Randomly replace part of the information in the transaction item type with special tags, forcing the model to learn to recover complete features from incomplete information. S322. Add random time offsets to transaction timestamps to simulate small fluctuations in the time series and enhance the model's robustness to time changes. S323. Randomly sample some subgraphs from the social relationship graph of the reporting user, retain key social links, remove honor information, and make the model focus on core social features.

6. A method for identifying abnormal transaction behavior of game users according to claim 1, characterized in that: In step S6, optimizing the strategic network parameters includes the following steps: S61. Integrate the current game's economic status, user behavior data, and model recognition results into a state vector. The formula is: , where is the integrated state vector, is the game economic indicator vector, including the game currency inflation rate and the price deviation of rare equipment. is the deviation of user behavior baseline, is the historical risk level sequence, is the abnormal probability score output by the model; S62. Define executable detection strategy actions and design a reward mechanism based on abnormal transaction determination and optimization results. The formula is: , where is the reward value, The rate of change of the accuracy of abnormal transaction identification, This is the improvement value of the stability of the game's economic indicators. is the number of false positives, 、 and are the corresponding weights respectively; S63. Build a policy network, output the probability distribution of each action, and optimize the policy network parameters according to the dynamic strategy; S64. Repeat steps S61-S63, continuously interact with the game environment, accumulate experience data and update the strategy network until the loss function converges or the reward value reaches a stable state, and then output the final dynamic detection strategy.

7. A method for identifying abnormal transaction behavior of game users according to claim 6, characterized in that: In step S63, optimizing the policy network parameters includes the following steps: S631. Use a deep neural network to build a policy network, input the state vector, and output the probability distribution of the action. The formula is: , where Strategic Network In a given state Take action The probability of is the parameter set of the policy network, and is the network weight matrix, and is the bias vector; S632. Randomly initialize the policy network parameters and set the learning rate and discount factor parameters; S633. At each time step, based on the current state, sample actions through the policy network and perform corresponding detection strategy adjustments; S634: After executing the sampling action, observe the changes in the game environment and obtain the new state and reward value; S635. Use the temporal difference learning algorithm to define the objective function. The formula is: , where For the strategy Next, status Execute action when The state-action value function, To find the expectation of the interior random variable, For The reward value obtained at any time, is the discount factor, with a value range of [0-1]. The closer its value is to 0, the more emphasis is placed on current rewards, and the closer its value is to 1, the more emphasis is placed on future rewards. For the strategy Next, next state Execute the next action The maximum state-action value of S636. Optimize the network strategy by minimizing the loss function. The formula is: , where is the loss function value, Strategic Network In a given state Take action Logarithm of probability; S637, use stochastic gradient descent to update the network strategy, the formula is: , where is the learning rate, is the loss function Parameters gradient.

8. A system for identifying abnormal transaction behavior of game users, applied to a method for identifying abnormal transaction behavior of game users according to any one of claims 1 to 7, characterized in that: include: Data acquisition and processing module, used to collect multi-source data and pre-process the data; Dynamic transaction building module, used to build the user's dynamic transaction model based on the processed data; Self-supervised learning module, used to mine the structure and regularity of data without manual labeling; The risk assessment and classification module uses the output feature representation to perform risk assessment on user transaction behaviors; The traceability layer processing module is used to conduct traceability analysis on abnormal transactions that are judged to be high-risk; The reinforcement learning strategy module is used to continuously optimize the detection strategy based on system feedback and dynamically adjust model parameters and detection rules.

Images