A method for monitoring and identifying cheating behavior in games

Abstract

This invention relates to the field of game monitoring and identification technology, and discloses a method for monitoring and identifying game cheating behavior, including: acquiring user operation data, determining whether the user operation is abnormal, and generating a predictive model based on the player's historical operation data to determine the approximate range of ability that the player can achieve at each stage. Based on the changes in the player's game progression speed over a certain period, it determines whether the player is using cheats such as hacks or account boosting. Combining the player's current game IP with the accounts logged into in the game and the player's current game operation habits, it determines whether the player is using cheats such as hacks or account boosting, reducing inaccurate monitoring during game monitoring, avoiding disruption of game fairness, and improving the gaming experience for players who play normally.

Description

Technical Field

[0001] This invention relates to the field of game monitoring and identification technology, specifically to a method for monitoring and identifying behaviors that prevent cheating in games. Background Technology

[0002] Methods for monitoring and identifying cheating behaviors in games encompass multiple fields, including computer science, cybersecurity, artificial intelligence, statistics, and game development. They can effectively address increasingly complex cheating behaviors. While existing methods for monitoring and identifying cheating behaviors have made some progress, they still have many shortcomings in practical applications, such as limitations of client-side detection, challenges of server-side detection, detection targeting specific cheating types, limitations in general applicability, and legal and ethical issues. The development of anti-cheating technology often lags behind cheating technology. When new cheating methods emerge, anti-cheating systems need time to analyze, learn, and develop corresponding countermeasures. This means there will always be a "vacuum period" during which cheaters can use it to cheat, while cheaters are also constantly learning the strategies of anti-cheating systems and taking corresponding countermeasures, such as using more covert cheating tools and modifying cheating behavior patterns. This creates a continuous "cat and mouse game."

[0003] Existing methods for monitoring and identifying cheating in games cannot determine whether a player is using cheats such as hacks or account boosting based on changes in their game progression speed over a certain period. They also cannot generate predictive models based on a player's historical gameplay to estimate their potential capabilities at each stage, thus failing to assess cheating based on current performance. Furthermore, when a player's progression speed exceeds the model's predicted maximum, the methods cannot combine this information with the player's past game accounts and whether their gameplay habits are similar to other players to determine if cheating is involved. This leads to inaccurate monitoring, undermining game fairness and potentially causing psychological harm to players who are playing normally. Therefore, their practicality is limited. Summary of the Invention

[0004] This invention provides a method for monitoring and identifying cheating behaviors in games, which helps to solve the problems mentioned in the background art.

[0005] This invention provides the following technical solution: a method for monitoring and identifying cheating behaviors in games, comprising:

[0006] Obtain the target user's current operation data, denoted as ;

[0007] Obtain all historical operation data of the target user and generate a historical dataset;

[0008] Extract the time difference between each element in the historical dataset and its previous adjacent element, define it as the interval difference, and denot it as . ;

[0009] Calculate the average of the interval differences, define it as the mean difference, and denot it as . :

[0010] ;

[0011] The time difference between the current data being processed and the last element in the historical dataset is defined as the analytical difference and denoted as . ;

[0012] like Then, it continuously acquires the target user's operation data;

[0013] like Then the training model is obtained;

[0014] By training the model and making T predictions based on the average difference, T predicted values ​​are obtained, denoted as Tpredicted. :

[0015] ;

[0016] Where t = {1, 2, ..., T};

[0017] Define a mean function to calculate the mean of the predicted values, denoted as . :

[0018] ;

[0019] Define a variance function to calculate the variance of the predicted values, denoted as:

[0020] ;

[0021] For each prediction, a prediction range is generated, denoted as . :

[0022] ;

[0023] ;

[0024] in, The coefficients are determined based on the confidence level;

[0025] Based on the difference in analysis, extract the prediction range of the current operational data, denoted as . ;

[0026] like Then, it continuously acquires the target user's operation data;

[0027] like Then, user operation analysis will be performed.

[0028] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the step of obtaining the training model specifically involves:

[0029] S1. Set an initial data model, define it as the initial model, and denote it as... Its parameters are ;

[0030] Randomly initialize the model parameters, denoted as ;

[0031] S2. Obtain all feature vectors from the historical dataset. ;

[0032] Each feature vector Based on their chronological order in the historical dataset, they are used as feature vectors for analysis in sequence;

[0033] Each sample in the feature vector is sequentially identified as a feature sample for analysis, denoted as . ;

[0034] S1, the predicted output of the calculation model, denoted as :

[0035] ;

[0036] in, Indicates the first Model parameters for the next iteration;

[0037] S3. Extract and analyze the true values ​​of the feature samples, denoted as... ;

[0038] S4. Based on the predicted output and the actual value, generate a loss function, denoted as... ;

[0039] S5. Calculate the gradient of the loss function with respect to the model parameters, denoted as... ;

[0040] S6. Set an optimization function to update the model parameters:

[0041] ;

[0042] in, It is the learning rate, which controls the step size of each update;

[0043] S7. Set the iteration threshold, denoted as... ;

[0044] Repeat steps S1-S6 until... Stop when the time comes.

[0045] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the user operation analysis includes user address analysis, specifically:

[0046] Obtain the user's current game IP, denoted as ;

[0047] Obtain all of the user's historical game IPs, forming a historical IP set, denoted as... ;

[0048] Set an account threshold, denoted as ;

[0049] By matching function Determine if the user's current IP address is normal:

[0050] ;

[0051] like If so, the user's current IP address is considered normal.

[0052] like If so, the user's current IP address is deemed suspicious, and suspicious IP analysis will be performed.

[0053] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the suspicious IP analysis specifically includes:

[0054] Query the target game's database;

[0055] Get the current game IP All accounts used in the target game are grouped into an account set, denoted as [account name missing]. ;

[0056] Calculate the size of the account set, denoted as . ;

[0057] Set an account matching function Determine if the user's current IP address is abnormal:

[0058] ;

[0059] like If so, the user's current IP address is considered normal.

[0060] like If so, the user's current IP address is determined to be abnormal.

[0061] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the user operation analysis further includes user habit analysis, specifically:

[0062] For each historical login time in the historical dataset, all operations for that historical login time are retrieved to form a historical operation sequence, denoted as [missing information]. ;

[0063] Each of them This represents an action performed by a player during their historical login period;

[0064] Retrieve all actions taken by the target user during the current login time, forming the current action sequence, denoted as... ;

[0065] Each of them This represents an action performed by the player during the current login time.

[0066] Set a similarity threshold, denoted as . ;

[0067] For each operation and Extract the feature vectors respectively, denoted as and ;

[0068] The current operation sequence at the current login time is calculated by using a comprehensive similarity function. With historical operation sequence The overall similarity is denoted as :

[0069] ;

[0070] in, For the current operation sequence Number of operations in For the current operation sequence The first in Index of each operation, This indicates the number of times the current login time is displayed. One operation In the historical operation sequence Find the operation that is most similar to it The similarity, among which, It is a historical operation sequence The operation index in the table ranges from 1 to the number of historical operations.

[0071] In the comprehensive similarity function, The similarity score between each current operation and a historical operation is calculated using the following formula:

[0072] ;

[0073] in, Representing vectors The magnitude reflects the vector Size, Representing vectors The magnitude reflects the vector Size;

[0074] Set a habit matching function to determine whether the user's current operation is normal:

[0075] ;

[0076] Get The quantity is defined as a consistent quantity, denoted as . ;

[0077] The number of historical login times obtained from the historical dataset is defined as the collection quantity, and denoted as . ;

[0078] like If so, the user's current operation is determined to be normal;

[0079] like If so, the user's current operation is deemed questionable, and a questionable operation analysis will be performed.

[0080] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the suspicious operation analysis specifically includes:

[0081] Get the target user's current operation sequence ;

[0082] Query the target game's database;

[0083] Obtain the action sequences of all users in the target game, forming a set of user action sequences, denoted as . ;

[0084] Set a similarity threshold, denoted as . ;

[0085] Get each operation eigenvectors ;

[0086] For each user operation sequence Operations in Extract the feature vector, denoted as ;

[0087] Set a sequence similarity function to calculate the current operation sequence. With each user operation sequence Similarity:

[0088] ;

[0089] ;

[0090] in, yes and The DTW distance between two time series is used to measure the similarity between them. yes Length, yes Length;

[0091] Set an operation matching function to determine whether the user's current operation is abnormal:

[0092] ;

[0093] Set a user threshold, denoted as ;

[0094] Get The number of similar numbers is defined as the similarity number, denoted as . ;

[0095] like If so, the user's game operation is determined to be normal;

[0096] like If so, the user's game operation is deemed abnormal.

[0097] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the user operation analysis further includes comprehensive data analysis, specifically:

[0098] If the user's game operation is determined to be abnormal, and the user's current IP address is determined to be abnormal, then the user's game operation data for this time is determined to be abnormal, and the user's account will be dealt with for violation.

[0099] If the user's game operation is determined to be normal, or if the user's current IP address is determined to be normal, then the user's game operation data for this time is determined to be normal, and the operation data of the target user can be continuously obtained.

[0100] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the step of obtaining all historical operation data of the target user and generating a historical dataset specifically includes:

[0101] Obtain all historical login times of the target user in the target game, forming a historical time set, denoted as . ;

[0102] in, This refers to the number of login attempts.

[0103] Obtain the target user's historical operation data for each historical login time, forming a historical operation set, denoted as . ;

[0104] in, The number of samples;

[0105] Based on the sample decision function For each historical login time's set of historical operations Each sample in Determine if it is an outlier:

[0106] ;

[0107] in, This is abnormal. This is normal. and These are the lower and upper limits of the set normal sample values, respectively;

[0108] For each historical login time, the set of historical operations Remove this set of historical operations. The set of all outliers is defined as the net set, denoted as . ;

[0109] The error detection function is used to determine the net set for each historical login time. Each sample in Determine if it is erroneous data:

[0110] ;

[0111] in, This is incorrect data. For correct data, Too many missing values The format is incorrect;

[0112] For the net set of each historical login time Remove the net set All erroneous data in the dataset will be collected, and the resulting set will be designated as the cleaned set, denoted as [missing information]. The number of samples is ;

[0113] For each historical login time, a clean set From the cleaning set Extract key features from the vector to obtain the feature vector, denoted as . ;

[0114] in, The number of features;

[0115] Integrate historical time sets and cleaned sets for each historical login time. and each cleaning set corresponding feature vector This forms a historical dataset.

[0116] As an optional solution to the behavior monitoring and identification method for preventing game cheating described in this invention, the step of obtaining the target user's current operation data specifically includes:

[0117] Obtain the target user's current login time in the target game, denoted as . ;

[0118] Obtain the target user's current operation data at the current login time, form a current operation set, denoted as . ;

[0119] in, The number of samples;

[0120] Based on the sample decision function For the current set of operations at the current login time Each sample in Determine if it is an outlier:

[0121] ;

[0122] in, This is abnormal. This is normal. and These are the lower and upper limits of the set normal sample values, respectively;

[0123] The current set of operations for the current login time Remove the current set of operations. The set of all outliers is defined as the net set, denoted as . ;

[0124] Error detection function For the net set of current login times Each sample in Determine if it is erroneous data:

[0125] ;

[0126] in, This is incorrect data. For correct data, Too many missing values The format is incorrect;

[0127] For the net set of current login times Remove the net set All erroneous data in the dataset will be collected, and the resulting set will be designated as the cleaned set, denoted as [missing information]. The number of samples is ;

[0128] The clean set for the current login time From the cleaning set Extract key features from the vector to obtain the feature vector, denoted as . ;

[0129] in, The number of features;

[0130] Integrate current login time and cleaned set of current login time and cleaning collection corresponding feature vector This forms the current dataset.

[0131] The present invention has the following beneficial effects:

[0132] 1. This method for monitoring and identifying cheating behavior in games generates a predictive model by acquiring players' historical gameplay data. It determines the approximate skill range a player can achieve at each stage based on their habits and performance. Then, based on the player's current performance, it assesses whether their progress and gameplay exceed the predicted maximum value. This helps determine if the player is using cheats such as hacks or account boosting. If the player's progress and gameplay are within a certain threshold of the predicted maximum value, it indicates normal progress and gameplay; otherwise, it indicates abnormalities. This method reduces inaccurate monitoring, prevents disruption of game fairness, and enhances the gaming experience for players who play normally.

[0133] 2. This method for monitoring and identifying cheating behavior in games involves checking if a player's game progression speed exceeds the model's predicted maximum value within a certain timeframe. If there is overlap between the player's current game IP and their historical IP, it indicates normal operation. If there is no overlap, the game's database is traversed to determine if the current IP has logged into a large number of game accounts. If the number of accounts logged into by the current IP is within a threshold, the current IP is considered normal. If the number of accounts logged into by the current IP exceeds the threshold, the current IP is considered abnormal. This method reduces inaccurate monitoring during game monitoring, avoids undermining game fairness, and improves the gaming experience for players who play normally.

[0134] 3. This method for monitoring and identifying cheating behavior in games involves the following steps: When a player's game progression speed exceeds the model's predicted maximum value within a certain timeframe, the method compares the player's current game operation habits with their historical operation habits. A high similarity indicates normal operation; a low similarity indicates abnormal operation. The method then iterates through the game's database to determine if the current operation habits are similar to those of other players. If no similarity exists, the player's operation is considered normal; otherwise, it is considered abnormal. The method also considers the player's current IP address. If neither the IP address nor the operation is abnormal, the player is considered to be playing normally. If both are abnormal, it indicates cheating, such as using cheats or account boosting. This method reduces inaccurate monitoring, prevents disruption of game fairness, and enhances the gaming experience for players who play normally. Attached Figure Description

[0135] Figure 1 This is a flowchart of the method for monitoring and identifying cheating behaviors in games according to the present invention. Detailed Implementation

[0136] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0137] Example 1: A method for monitoring and identifying cheating behaviors in games, see [link / reference] Figure 1 ,include:

[0138] Obtain the target user's current operation data, denoted as ;

[0139] Obtain all historical operation data of the target user and generate a historical dataset;

[0140] Extract the time difference between each element in the historical dataset and its previous adjacent element, define it as the interval difference, and denot it as . ;

[0141] Calculate the average of the interval differences, define it as the mean difference, and denot it as . :

[0142] ;

[0143] The time difference between the current data being processed and the last element in the historical dataset is defined as the analytical difference and denoted as . ;

[0144] like Then, continuously acquire the target user's operation data. That is, the user may not play the game for a long time. In this case, the game difficulty may be lowered accordingly to allow the user to level up quickly and improve the user's game experience. In this case, the data is inaccurate. Just continue to acquire the target user's operation data.

[0145] like Then the training model is obtained;

[0146] By training the model and making T predictions based on the average difference, T predicted values ​​are obtained, denoted as Tpredicted. :

[0147] ;

[0148] Where t = {1, 2, ..., T};

[0149] Define a mean function to calculate the mean of the predicted values, denoted as . :

[0150] ;

[0151] Define a variance function to calculate the variance of the predicted values, denoted as:

[0152] ;

[0153] For each prediction, a prediction range is generated, denoted as . :

[0154] ;

[0155] ;

[0156] in, The coefficients are determined based on the confidence level;

[0157] Based on the difference in analysis, extract the prediction range of the current operational data, denoted as . ;

[0158] like If the target user's operation data is continuously acquired, it indicates that the user's current operation data is highly similar to the estimated operation data, and it can be considered that the user is the one performing the operation.

[0159] like If the user's current operation data is not very similar to the estimated operation data, it can be considered that the user's game operation is abnormal and needs to be further analyzed in combination with other data.

[0160] Specifically, obtaining the training model involves:

[0161] S1. Set an initial data model, define it as the initial model, and denote it as... Its parameters are ;

[0162] Randomly initialize the model parameters, denoted as ;

[0163] S2. Obtain all feature vectors from the historical dataset. ;

[0164] Each feature vector Based on their chronological order in the historical dataset, they are used as feature vectors for analysis in sequence;

[0165] Each sample in the feature vector is sequentially identified as a feature sample for analysis, denoted as . ;

[0166] S1, the predicted output of the calculation model, denoted as :

[0167] ;

[0168] in, Indicates the first Model parameters for the next iteration;

[0169] S3. Extract and analyze the true values ​​of the feature samples, denoted as... ;

[0170] S4. Based on the predicted output and the actual value, generate a loss function, denoted as... ;

[0171] S5. Calculate the gradient of the loss function with respect to the model parameters, denoted as... ;

[0172] gradient Represents the loss function For each model parameter The partial derivatives are as follows:

[0173] ;

[0174] S6. Set an optimization function to update the model parameters:

[0175] ;

[0176] in, It is the learning rate, which controls the step size of each update;

[0177] S7. Set the iteration threshold, denoted as... The iteration threshold is 8;

[0178] Repeat steps S1-S6 until... Stop when the time comes.

[0179] By employing the above methods, the system assesses the potential for cheating, such as using hacks or account boosting, based on changes in a player's progression speed over a given period. It generates a predictive model based on the player's historical gameplay, estimating the approximate skill level a player can achieve at each stage using their preferred playstyle and data. This model then determines whether the player is cheating based on their current performance. If a player's progression speed exceeds the model's predicted maximum by a certain margin, the system further considers the accounts logged into by the player's current IP address and whether their gameplay habits are similar to those of other players. This approach reduces inaccuracies in game monitoring, prevents disruption of fairness, and enhances the gaming experience for players who play normally.

[0180] Example 2 is an improvement upon Example 1. This method for monitoring and identifying cheating in games includes user operation analysis, specifically:

[0181] Obtain the user's current game IP, denoted as ;

[0182] Obtain all of the user's historical game IPs, forming a historical IP set, denoted as... ;

[0183] Set an account threshold, denoted as The account threshold is 3;

[0184] By matching function Determine if the user's current IP address is normal:

[0185] ;

[0186] like If so, the user's current IP address is considered normal.

[0187] like If so, the user's current IP address is deemed suspicious, and suspicious IP analysis will be performed.

[0188] Specifically, the analysis of suspicious IP addresses includes:

[0189] Query the target game's database;

[0190] Get the current game IP All accounts used in the target game are grouped into an account set, denoted as [account name missing]. ;

[0191] Calculate the size of the account set, denoted as . ;

[0192] Set an account matching function Determine if the user's current IP address is abnormal:

[0193] ;

[0194] like If so, the user's current IP address is considered normal.

[0195] like If so, the user's current IP address is determined to be abnormal.

[0196] This embodiment also provides that the user operation analysis further includes user habit analysis, specifically:

[0197] For each historical login time in the historical dataset, all operations for that historical login time are retrieved to form a historical operation sequence, denoted as [missing information]. ;

[0198] Each of them This represents an action performed by a player during their historical login period;

[0199] Retrieve all actions taken by the target user during the current login time, forming the current action sequence, denoted as... ;

[0200] Each of them This represents an action performed by the player during the current login time.

[0201] Set a similarity threshold, denoted as . The similarity threshold A threshold set according to the difficulty of the game, such as 0.8;

[0202] For each operation and Extract the feature vectors respectively, denoted as and Among them, the features include operation type, operation time interval, and operation sequence;

[0203] The current operation sequence at the current login time is calculated by using a comprehensive similarity function. With historical operation sequence The overall similarity is denoted as :

[0204] ;

[0205] in, For the current operation sequence Number of operations in For the current operation sequence The first in Index of each operation, This indicates the number of times the current login time is displayed. One operation In the historical operation sequence Find the operation that is most similar to it The similarity, among which, It is a historical operation sequence The operation index in the table ranges from 1 to the number of historical operations.

[0206] In the comprehensive similarity function, The similarity score between each current operation and a historical operation is calculated using the following formula:

[0207] ;

[0208] in, Representing vectors The magnitude reflects the vector Size, Representing vectors The magnitude reflects the vector Size;

[0209] vector The formula for calculating the modulus is: ;

[0210] vector The formula for calculating the modulus is: ;

[0211] Set a habit matching function to determine whether the user's current operation is normal:

[0212] ;

[0213] Get The quantity is defined as a consistent quantity, denoted as . ;

[0214] The number of historical login times obtained from the historical dataset is defined as the collection quantity, and denoted as . ;

[0215] like If so, the user's current operation is determined to be normal;

[0216] like If so, the user's current operation is deemed questionable, and a questionable operation analysis will be performed.

[0217] Specifically, the analysis of questionable operations includes:

[0218] Get the target user's current operation sequence ;

[0219] Query the target game's database;

[0220] Obtain the action sequences of all users in the target game, forming a set of user action sequences, denoted as . ;

[0221] Set a similarity threshold, denoted as . The similarity threshold A threshold set according to the difficulty of the game, such as 0.8;

[0222] Get each operation eigenvectors ;

[0223] For each user operation sequence Operations in Extract the feature vector, denoted as Among them, the features include operation type, operation time interval, and operation sequence;

[0224] Set a sequence similarity function to calculate the current operation sequence. With each user operation sequence Similarity:

[0225] ;

[0226] ;

[0227] in, yes and The DTW distance between two time series is used to measure the similarity between them. yes Length, yes Length;

[0228] Set an operation matching function to determine whether the user's current operation is abnormal:

[0229] ;

[0230] Set a user threshold, denoted as The user threshold is 2;

[0231] Get The number of similar numbers is defined as the similarity number, denoted as . ;

[0232] like If so, the user's game operation is determined to be normal;

[0233] like If so, the user's game operation is deemed abnormal.

[0234] This embodiment also provides that the user operation analysis further includes comprehensive data analysis, specifically:

[0235] If a user's game operation is deemed abnormal, and the user's current IP address is deemed abnormal, then the user's game operation data for this instance is deemed abnormal, and the user's account will be penalized for violating the rules. This means that the user may have cheated in this instance, and the user's account may be suspended for a period of time.

[0236] If the user's game operation is determined to be normal, or if the user's current IP address is determined to be normal, then the user's game operation data for this time is determined to be normal, and the operation data of the target user can be continuously obtained.

[0237] Example 3 is an improvement on Example 2. In this example, the step of obtaining all historical operation data of the target user and generating a historical dataset specifically involves:

[0238] Obtain all historical login times of the target user in the target game, forming a historical time set, denoted as . ;

[0239] in, This refers to the number of login attempts.

[0240] Obtain the target user's historical operation data for each historical login time, forming a historical operation set, denoted as . The historical operation data includes operation frequency, operation sequence, operation reaction time, skill usage success rate, task completion time, and score, etc.

[0241] in, The number of samples;

[0242] Based on the sample decision function For each historical login time's set of historical operations Each sample in Determine if it is an outlier:

[0243] ;

[0244] in, This is abnormal. This is normal. and These are the lower and upper limits of the normal sample values, respectively, which are the criteria for judging outliers based on statistical methods or domain knowledge.

[0245] For each historical login time, the set of historical operations Remove this set of historical operations. The set of all outliers is defined as the net set, denoted as . ;

[0246] The error detection function is used to determine the net set for each historical login time. Each sample in Determine if it is erroneous data:

[0247] ;

[0248] in, This is incorrect data. For correct data, Too many missing values The format is incorrect;

[0249] For the net set of each historical login time Remove the net set All erroneous data in the dataset will be collected, and the resulting set will be designated as the cleaned set, denoted as [missing information]. The number of samples is ;

[0250] For each historical login time, a clean set From the cleaning set Extract key features from the vector to obtain the feature vector, denoted as . ;

[0251] in, The number of features;

[0252] The key features include basic operation features, game behavior features, game progress features, operation mode features, game resource features, network features, and habitual features, etc.

[0253] Among them, basic operation characteristics include operation frequency, operation reaction time, and operation intensity variation; game behavior characteristics include skill use success rate, task completion time, and scoring efficiency; game progress characteristics include level advancement speed and game stage duration; operation mode characteristics include operation sequence mode and skill combination usage frequency; game resource characteristics include resource acquisition efficiency and resource consumption mode; network characteristics include game IP address and IP address usage frequency; and habitual characteristics include game time period preference and consistency of operation habits.

[0254] The operation frequency refers to the number of times a player performs an operation per unit of time, such as the number of clicks per second, key press frequency, etc., specifically: ;

[0255] The operation reaction time refers to the average response time of a player to a game event, such as the time from the occurrence of the event to the player's reaction. Specifically: ;

[0256] in, For each reaction time, Number of events;

[0257] The change in operation intensity refers to the change in the player's operation intensity (such as the force of pressing buttons or the intensity of touch screen operation), which is measured by statistically analyzing the standard deviation or range of operation intensity.

[0258] The skill usage success rate is the percentage of players who successfully execute skill operations, specifically: ;

[0259] The task completion time refers to the time spent by the player to complete a specific game task, specifically: ;

[0260] The scoring efficiency refers to the score a player obtains per unit of time, specifically: ;

[0261] The level progression speed refers to the speed at which a player advances to a new level, specifically: ;

[0262] The game phase duration refers to the average time a player spends in each game phase, specifically: ;

[0263] in, The duration of each stage, Number of stages;

[0264] The operation sequence pattern refers to the order and combination of player operations, which are converted into numerical features through sequence analysis or one-hot encoding to analyze and judge the player's operation habits.

[0265] The frequency of skill combination usage refers to the frequency with which players use a specific skill combination, specifically: ;

[0266] The resource acquisition efficiency refers to the efficiency with which players acquire in-game resources (such as gold coins and items), specifically: ;

[0267] The resource consumption pattern refers to the pattern and frequency of players consuming in-game resources, which is measured by statistically analyzing the distribution and frequency of resource consumption.

[0268] The game IP address is the IP address used by the player when playing the game, and is used to detect whether the player is playing the game from multiple different IP addresses.

[0269] The IP address usage frequency refers to the frequency at which each IP address is used, specifically:

[0270] The game time preference refers to the game time period preferred by the player, which is determined by statistically analyzing the player's game time in different time periods.

[0271] The consistency of operating habits refers to the consistency between a player's operating habits and historical operations, which is measured by comparing the similarity between current operating characteristics and historical characteristics.

[0272] Integrate historical time sets and cleaned sets for each historical login time. and each cleaning set corresponding feature vector This forms a historical dataset.

[0273] This embodiment also provides that obtaining the target user's current operation data specifically includes:

[0274] Obtain the target user's current login time in the target game, denoted as . ;

[0275] Obtain the target user's current operation data at the current login time, form a current operation set, denoted as . The current operation data includes operation frequency, operation sequence, operation reaction time, skill usage success rate, task completion time, and score, etc.

[0276] in, The number of samples;

[0277] Based on the sample decision function For the current set of operations at the current login time Each sample in Determine if it is an outlier:

[0278] ;

[0279] in, This is abnormal. This is normal. and These are the lower and upper limits of the normal sample values, respectively, which are the criteria for judging outliers based on statistical methods or domain knowledge.

[0280] The current set of operations for the current login time Remove the current set of operations. The set of all outliers is defined as the net set, denoted as . ;

[0281] Error detection function For the net set of current login times Each sample in Determine if it is erroneous data:

[0282] ;

[0283] in, This is incorrect data. For correct data, Too many missing values The format is incorrect;

[0284] For the net set of current login times Remove the net set All erroneous data in the dataset will be collected, and the resulting set will be designated as the cleaned set, denoted as [missing information]. The number of samples is ;

[0285] The clean set for the current login time From the cleaning set Extract key features from the vector to obtain the feature vector, denoted as . ;

[0286] in, The number of features;

[0287] Integrate current login time and cleaned set of current login time and cleaning collection corresponding feature vector This forms the current dataset.

[0288] This embodiment determines whether a player is cheating, such as using cheats or account boosting, based on changes in their game progression speed over a certain period. It generates a predictive model based on the player's historical gameplay, estimating the approximate skill range a player can achieve at each stage using their own habits and performance data. This model then assesses the player's current performance to determine if cheating is possible. When a player's progression speed exceeds the model's predicted maximum by a certain margin, the system considers the player's current game IP's past logins and whether their gameplay habits are similar to other players to further determine if cheating is involved. This reduces inaccurate monitoring during game monitoring, prevents disruption of game fairness, and enhances the gaming experience for players who play normally.

Claims

1. A method for monitoring and identifying cheating behaviors in games, characterized in that: include: Obtain the target user's current operation data, denoted as ; Obtain all historical operation data of the target user and generate a historical dataset; Extract the time difference between each element in the historical dataset and its previous adjacent element, define it as the interval difference, and denot it as . ; Calculate the average of the interval differences, define it as the mean difference, and denot it as . : ； The time difference between the current data being processed and the last element in the historical dataset is defined as the analytical difference and denoted as . ; like Then, it continuously acquires the target user's operation data; like Then the training model is obtained; By training the model and making T predictions based on the average difference, T predicted values ​​are obtained, denoted as Tpredicted. : ; For data models, for Parameters; Where t = {1, 2, ..., T}; Define a mean function to calculate the mean of the predicted values, denoted as . : ； Define a variance function to calculate the variance of the predicted values, denoted as: ； For each prediction, a prediction range is generated, denoted as . : ； ； in, The coefficients are determined based on the confidence level; Based on the difference in analysis, extract the prediction range of the current operational data, denoted as . ; like Then, it continuously acquires the target user's operation data; like Then, user operation analysis will be performed.

2. The method for monitoring and identifying cheating behaviors in games according to claim 1, characterized in that: The acquisition of the training model specifically involves: S1. Set an initial data model, define it as the initial model, and denote it as... Its parameters are ; Randomly initialize the model parameters, denoted as ; S2. Obtain all feature vectors from the historical dataset. ; Each feature vector Based on their chronological order in the historical dataset, they are used as feature vectors for analysis in sequence; Each sample in the feature vector is sequentially identified as a feature sample for analysis, denoted as . ; S1, the predicted output of the computational model, denoted as : ； in, Indicates the first Model parameters for the next iteration; S3. Extract and analyze the true values ​​of the feature samples, denoted as... ; S4. Based on the predicted output and the actual value, generate a loss function, denoted as... ; S5. Calculate the gradient of the loss function with respect to the model parameters, denoted as... ; S6. Set an optimization function to update the model parameters: ； in, It is the learning rate, which controls the step size of each update; S7. Set the iteration threshold, denoted as... ; Repeat steps S1-S6 until... Stop when the time comes.

3. The method for monitoring and identifying cheating behaviors in games according to claim 1, characterized in that: The user operation analysis, including user address analysis, specifically includes: Obtain the user's current game IP, denoted as ; Obtain all of the user's historical game IPs, forming a historical IP set, denoted as... ; Set an account threshold, denoted as ; By matching function Determine if the user's current IP address is normal: ； like If so, the user's current IP address is considered normal. like If so, the user's current IP address is deemed suspicious, and suspicious IP analysis will be performed.

4. The method for monitoring and identifying cheating behaviors in games according to claim 3, characterized in that: The analysis of the suspicious IP addresses specifically includes: Query the target game's database; Get the current game IP All accounts used in the target game are grouped into an account set, denoted as [account name missing]. ; Calculate the size of the account set, denoted as . ; Set an account matching function Determine if the user's current IP address is abnormal: ； like If so, the user's current IP address is considered normal. like If so, the user's current IP address is determined to be abnormal.

5. The method for monitoring and identifying cheating behaviors in games according to claim 3, characterized in that: The user operation analysis also includes user habit analysis, specifically: For each historical login time in the historical dataset, all operations for that historical login time are retrieved to form a historical operation sequence, denoted as [missing information]. ; Each of them This represents an action performed by a player during their historical login period; Retrieve all actions taken by the target user during the current login time, forming the current action sequence, denoted as... ; Each of them This represents an action performed by the player during the current login time. Set a similarity threshold, denoted as . ; For each operation and Extract the feature vectors respectively, denoted as and ; The current operation sequence at the current login time is calculated by using a comprehensive similarity function. With historical operation sequence The overall similarity is denoted as : ； in, For the current operation sequence The number of operations in the process. For the current operation sequence The first in Index of each operation, This indicates the number of times the current login time is displayed. One operation In the historical operation sequence Find the operation that is most similar to it The similarity, among which, It is a historical operation sequence The operation index in the table ranges from 1 to the number of historical operations. In the comprehensive similarity function, The similarity score between each current operation and a historical operation is calculated using the following formula: ； in, Representing vectors The magnitude reflects the vector Size, Representing vectors The magnitude reflects the vector Size; Set a habit matching function to determine whether the user's current operation is normal: ； Get The quantity is defined as a consistent quantity, denoted as . ; The number of historical login times obtained from the historical dataset is defined as the collection quantity, and denoted as . ; like If so, the user's current operation is determined to be normal; like If so, the user's current operation is deemed questionable, and a questionable operation analysis will be performed.

6. The method for monitoring and identifying cheating behaviors in games according to claim 5, characterized in that: The analysis of the questionable operations is as follows: Get the target user's current operation sequence ; Query the target game's database; Obtain the action sequences of all users in the target game, forming a set of user action sequences, denoted as . ; Set a similarity threshold, denoted as . ; Get each operation eigenvectors ; For each user operation sequence Operations in Extract the feature vector, denoted as ; Set a sequence similarity function to calculate the current operation sequence. With each user operation sequence Similarity: ； ； in, yes and The DTW distance between two time series is used to measure the similarity between them. yes Length, yes Length; Set an operation matching function to determine whether the user's current operation is abnormal: ； Set a user threshold, denoted as ; Get The number of similar numbers is defined as the similarity number, denoted as . ; like If so, the user's game operation is determined to be normal; like If so, the user's game operation is deemed abnormal.

7. The method for monitoring and identifying cheating behaviors in games according to claim 6, characterized in that: The user operation analysis also includes comprehensive data analysis, specifically: If the user's game operation is determined to be abnormal, and the user's current IP address is determined to be abnormal, then the user's game operation data for this time is determined to be abnormal, and the user's account will be dealt with for violation. If the user's game operation is determined to be normal, or if the user's current IP address is determined to be normal, then the user's game operation data for this time is determined to be normal, and the operation data of the target user can be continuously obtained.

8. The method for monitoring and identifying cheating behaviors in games according to claim 1, characterized in that: The process of obtaining all historical operation data of the target user and generating a historical dataset specifically involves: Obtain all historical login times of the target user in the target game, forming a historical time set, denoted as . ; in, This refers to the number of login attempts. Obtain the target user's historical operation data for each historical login time, forming a historical operation set, denoted as . ; in, The number of samples; Based on the sample decision function For each historical login time's set of historical operations Each sample in Determine if it is an outlier: ； in, This is abnormal. This is normal. and These are the lower and upper limits of the set normal sample values, respectively; For each historical login time, the set of historical operations Remove this set of historical operations. The set of all outliers is defined as the net set, denoted as . ; The error detection function is used to determine the net set for each historical login time. Each sample in Determine if it is erroneous data: ； in, This is incorrect data. For correct data, Too many missing values The format is incorrect; For the net set of each historical login time Remove the net set All erroneous data in the dataset will be collected, and the resulting set will be designated as the cleaned set, denoted as [missing information]. The number of samples is ; For each historical login time, a clean set From the cleaning set Extract key features from the vector to obtain the feature vector, denoted as . ; in, The number of features; Integrate historical time sets and clean sets for each historical login time. and each cleaning set Corresponding feature vector This forms a historical dataset.

9. The method for monitoring and identifying cheating behaviors in games according to claim 1, characterized in that: The acquisition of the target user's current operation data specifically includes: Obtain the target user's current login time in the target game, denoted as . ; Obtain the target user's current operation data at the current login time, form a current operation set, denoted as . ; in, The number of samples; Based on the sample decision function For the current set of operations at the current login time Each sample in Determine if it is an outlier: ； in, This is abnormal. This is normal. and These are the lower and upper limits of the set normal sample values, respectively; The current set of operations for the current login time Remove the current operation set. The set of all outliers is defined as the net set, denoted as . ; Error detection function For the net set of current login times Each sample in Determine if it is erroneous data: ； in, This is incorrect data. For correct data, Too many missing values The format is incorrect; For the net set of current login times Remove the net set All erroneous data in the dataset will be collected, and the resulting set will be designated as the cleaned set, denoted as [missing information]. The number of samples is ; The clean set for the current login time From the cleaning set Extract key features from the vector to obtain the feature vector, denoted as . ; in, The number of features; Integrate current login time and cleaned set of current login time and cleaning collection Corresponding feature vector This forms the current dataset.

Images