Game anti-cheating model training method based on confrontation sample recognition

Abstract

The invention discloses a game anti-cheating model training method based on adversarial sample recognition, which comprises the following steps: S1, collecting and preprocessing player behavior data, and generating a standardized behavior graph; s2, encoding the behavior diagram by a depth map auto-encoder, and outputting low-dimensional representation and reconstruction errors; s3, identifying and tracking a player community structure by a dynamic community discovery algorithm; s4, generating an adversarial sample, and training a model in combination with the original sample; s5, evaluating and marking abnormal behaviors based on model output and a community evolution result; and S6, outputting an anomaly detection result, executing anti-cheating processing, and dynamically optimizing the model by using feedback. The invention aims to realize efficient intelligent detection and continuous adaptive protection of various abnormal and cheating behaviors in online games through combination of a depth map auto-encoder and a dynamic community discovery algorithm.

Description

Technical Field

[0001] The present invention relates to the cross-technical field of game data analysis, and in particular to a method for training a game anti-cheating model based on adversarial sample recognition. Background Art

[0002] With the continued development of the online gaming industry and the rapid expansion of its user base, security issues within gaming environments have become prominent. Player cheating behaviors are becoming increasingly diverse and intelligent, becoming a significant challenge affecting the fairness of gaming platforms, user experience, and commercial interests. Traditional gaming anti-cheating technologies rely on static feature rules, blacklist searches, and behavioral log comparisons. While effective against simple cheating methods in the early stages, these methods often suffer from limitations such as delayed detection, evasion, and difficulty adapting to changing scenarios when faced with new, highly covert, and organized cheating behaviors. Some cheating gangs frequently change accounts, disguise their operation traces, or use automated tools to generate complex, fabricated behavior data. Traditional methods struggle to accurately identify and track cheating chains.

[0003] In recent years, with the development of artificial intelligence technologies such as deep learning and graph neural networks, the industry has begun experimenting with intelligent methods such as behavioral modeling, anomaly detection, and graph structure analysis for game anti-cheating modeling. Typical approaches include using deep neural networks to automatically extract player behavioral features, identifying anomalous behavior through clustering or classification models, and mining social relationships and interaction networks among players using methods such as graph convolutional networks (GCNs). Existing technologies generally face several prominent issues: Most models analyze only nodes (individual players) or static graphs, ignoring the dynamic evolution and complex interaction structures of player behavioral networks, making it difficult to accurately capture the evolution of group-based or collaborative cheating. Models also have limited robustness against counterfeit behavior and adversarial examples, making them easily misled by carefully designed adversarial attack samples, resulting in false positives or missed detections. Existing anomaly detection methods are often static and one-way, making it difficult to continuously and adaptively update based on feedback. This results in a rapid decline in the model's detection capabilities when faced with new or variant cheating methods. Most existing solutions fail to adequately model the dynamic changes in community structure and the multidimensional variations in node attributes and edge weights, limiting their effectiveness in complex scenarios.

[0004] Therefore, how to provide a game anti-cheating model training method based on adversarial sample recognition is an urgent problem that those skilled in the art need to solve. Summary of the Invention

[0005] One purpose of the present invention is to propose a game anti-cheating model training method based on adversarial sample identification. The present invention combines a deep graph autoencoder model with a dynamic community discovery algorithm, and describes a full-process method for multi-scale feature encoding of player behavior graphs, anomaly detection of nodes and communities, adversarial sample generation, and model adversarial training. Through innovative mechanisms such as multi-scale structure adaptive aggregation, dynamic adjustment and joint reconstruction of edge weights, inter-layer residual connections, and deep regularization, anomaly identification of player nodes and player communities is achieved. By integrating technologies such as dynamic community structure evolution, community stability evaluation, and adaptive scale threshold adjustment, the ability to detect collaborative, gang-type, and new types of cheating behaviors is improved. The present invention has the advantages of high detection accuracy, strong adversarial robustness, strong adaptability, and applicability to large-scale complex game environments, thereby improving the security of the game system and the level of anti-cheating intelligence.

[0006] According to an embodiment of the present invention, a method for training a game anti-cheating model based on adversarial sample recognition includes the following steps:

[0007] S1. Collect the operation logs, social relationships, transaction records, and communication information of players in the online game environment, construct a behavior graph dataset, and preprocess the behavior graph dataset to obtain a standardized behavior graph dataset;

[0008] S2. Based on the standardized behavior graph dataset, a deep graph autoencoder model is constructed. The node and edge features are encoded through a multi-layer graph convolutional network to obtain a low-dimensional potential representation of the behavior graph and output the reconstruction error of the nodes and edges.

[0009] S3. Based on low-dimensional latent representation, a dynamic community discovery algorithm is used to identify and partition the community structure of player nodes and dynamically track the evolution of the player community.

[0010] S4. Based on the standardized behavior graph dataset and low-dimensional latent representation, we construct adversarial samples, and input the standardized behavior graph dataset and adversarial samples into the deep graph autoencoder model and dynamic community discovery algorithm for training.

[0011] S5. During the training process, based on the reconstruction errors of nodes and edges, low-dimensional latent representations, community structure partitions, and player community evolution, abnormal behaviors of player nodes and player communities are evaluated and marked to obtain abnormal behavior detection results.

[0012] S6. Output the abnormal behavior detection results. For player nodes and player communities that are judged to be abnormal, execute the risk warning, account restriction, behavior tracing and anti-cheating processing procedures in sequence, and dynamically update the deep graph autoencoder model parameters based on real-time feedback.

[0013] Optionally, the preprocessing of the behavior graph dataset specifically includes data cleaning, abnormal data removal, and standardization of node and edge attributes.

[0014] Optionally, the S2 specifically includes:

[0015] S21. Based on the standardized behavior graph dataset G = (V, E, X, W), where V is the set of player nodes, E is the set of interaction edges, X is the node attribute feature matrix, and W is the edge weight feature matrix, for each node, the structural features and attribute features of neighbors of different orders are collected as multi-scale input;

[0016] S22. In the encoder structure, a multi-scale structure adaptive aggregation mechanism is designed to calculate the neighbor sets N of different orders for each node v. s (v) Using learnable weights α s Perform weighted aggregation to obtain the feature representation of the node in the l+1 layer

[0017] S23. At each layer of the encoder, by setting up an inter-layer residual connection mechanism, the output result of this layer is directly added to the output result of the previous layer, and the information of each layer is directly passed to the next layer;

[0018] S24, the low-dimensional potential representation Z finally output by the encoder is used as the structural attribute expression of the node and passed to the decoder part;

[0019] S25. In the decoder, the node features, the connection relationship between nodes, and the edge weights are jointly reconstructed using the low-dimensional potential representation, that is, the reconstructed value of the node feature, the reconstructed probability of the edge existence, and the reconstructed value of the edge weight are simultaneously generated;

[0020] S26. Calculate node features, adjacency matrix and edge weight reconstruction error, and define the joint loss function as

[0021] S27. Introduce regularization terms into the loss function, including feature sparsity regularization and latent space smoothness regularization, to constrain the expression of the low-dimensional latent representation Z;

[0022] S28. Based on the joint loss function, all learnable parameters are updated iteratively to complete the deep graph autoencoder model training, and the reconstruction error of the nodes and edges and the low-dimensional potential representation of the nodes are output.

[0023] Optionally, the S3 specifically includes:

[0024] S31. Based on the low-dimensional potential representation Z of the node, perform preliminary community division on all player nodes V to obtain the initial community label set C t ;

[0025] S32: The community label C at the current time t is obtained. t and the community label C at the previous moment t-1 t-1 Perform multi-feature pairing, integrate node set overlap, node attribute similarity, and edge structure similarity, and use a weighted comprehensive formula to calculate the community stability score S c,t ;

[0026] S33, based on the obtained community stability score S c,t , set the stability score threshold τ, judge each community as a structurally stable community or a structurally fluctuating community, and record the community status;

[0027] S34, according to the discrimination results, an adaptive adjustment mechanism is used to adjust the size threshold of each community θ size,t Conduct nonlinear adjustments, with different adjustment strategies corresponding to different types of communities;

[0028] S35. Adjust the current community based on the determined community size threshold, merge or discard communities whose size is smaller than the community size threshold, and output the adjusted community division result;

[0029] S36. For each community, establish a temporal memory unit to continuously record the community labels and scale change sequence H at the last n moments. c and use the adjusted community division results as the latest historical sequence;

[0030] S37. Based on the temporal memory unit, short-term fluctuations in community labels and sizes are smoothed. If community attributes, structure, or size are observed to change continuously and significantly within the temporal window, it is determined to be an evolutionary event such as community splitting, merging, or the generation of a new community, and a list of evolutionary events is output.

[0031] Optionally, the S4 specifically includes:

[0032] S41. Based on the obtained standardized behavior graph dataset G = (V, E, X, W) and the obtained low-dimensional potential representation of the node Z, use the perturbation injection method to generate adversarial perturbation matrices ΔX, ΔA, and ΔW for node attributes, edge structure, and edge weights, where V is the set of player nodes, E is the set of interaction edges, X is the node attribute feature matrix, and W is the edge weight feature matrix;

[0033] S42. Add the original node feature X to the perturbation matrix ΔX to obtain the adversarial node feature X ′ ; Add the original adjacency matrix A to the perturbation matrix ΔA to obtain the adversarial adjacency matrix A ′ ; Add the original edge weight matrix W and the perturbation matrix ΔW to obtain the adversarial edge weight matrix W ′ ;

[0034] S43. Construct adversarial sample behavior graph G ′ =(V,E ′ ,X ′ ,W ′ ), where E ′ is the updated edge set after adversarial perturbation;

[0035] S44. Compare the original standardized behavior graph dataset G with the adversarial sample behavior graph G ′ The deep graph autoencoder model is jointly input for training to obtain the adversarially enhanced low-dimensional potential representation of nodes and the reconstruction errors of nodes and edges;

[0036] S45. Based on the adversarial enhanced latent representation, the dynamic community discovery algorithm is synchronously input to dynamically update the player community partition and evolution information;

[0037] S46. During the joint training process, respectively calculate the reconstruction errors of the original sample and the adversarial sample in terms of node feature reconstruction, adjacency matrix reconstruction, and edge weight reconstruction, and determine the overall joint training loss based on the weighted result of the reconstruction error of the original sample and the reconstruction error of the adversarial sample;

[0038] S47. During the training process, all learnable parameters of the deep graph autoencoder model and the dynamic community discovery algorithm are continuously updated based on the joint training loss;

[0039] S48. Output the low-dimensional potential representation of nodes after adversarial sample enhancement training, the reconstruction error of nodes and edges, and the community partition and community evolution information.

[0040] Optionally, the S5 specifically includes:

[0041] S51. Based on the output low-dimensional latent representation of nodes, reconstruction errors of nodes and edges, and output community partitioning and community evolution information, data of all player nodes and player communities are aggregated to construct feature sets of nodes and communities.

[0042] S52. For each player node, calculate the node feature reconstruction error, edge structure reconstruction error, and edge weight reconstruction error, which respectively reflect the reconstruction deviations of the node in attributes, structure, and interaction weight;

[0043] S53. For each player community, calculate the average feature reconstruction error of all nodes in the community, calculate the proportion of community size change between two consecutive moments, and calculate the proportion of changes in the community labels of nodes in the community at adjacent moments, reflecting the overall structural changes and member stability of the community;

[0044] S54, setting a multi-threshold discrimination criterion based on the node reconstruction error, the community average reconstruction error, the community size change rate, and the community label evolution rate, and setting a node anomaly discrimination threshold and a community anomaly discrimination threshold respectively;

[0045] S55. For player nodes whose reconstruction error or structural change index exceeds a threshold, mark them as abnormal nodes; for player communities whose average reconstruction error, scale change rate, or label evolution rate exceeds a threshold, mark them as abnormal communities;

[0046] S56: Output the numbers of all player nodes and player communities marked as abnormal and the corresponding abnormal index values ​​to form abnormal behavior detection results.

[0047] Optionally, the S6 specifically includes:

[0048] S61. Receive and organize the generated abnormal behavior detection results, determine the specific list of player nodes and player communities that are judged to be abnormal, and the reasons for the abnormality;

[0049] S62. For player nodes and player communities that are determined to be abnormal, risk warning information is issued to the backend security management personnel or monitoring platform to remind relevant personnel to pay attention to and handle risk events in a timely manner;

[0050] S63. Based on the severity of the abnormal behavior, account restriction measures will be taken against player nodes and player communities that are judged to be abnormal, including suspending login, freezing accounts, restricting transaction permissions, and blocking social operations;

[0051] S64. Conduct behavioral tracing for all player nodes and player communities where restrictive measures have been taken, analyzing recent game behaviors, interaction objects, historical operation records, and associations, and locating suspicious behavior chains and potential related groups.

[0052] S65. Organize the feedback information and actual results obtained during the risk warning, account restriction, and behavior tracing process. Based on the feedback information during the process, dynamically adjust and update the parameters of the deep graph autoencoder model to optimize the detection capabilities of new abnormal behaviors and cheating methods.

[0053] The beneficial effects of the present invention are:

[0054] The present invention deeply integrates deep graph autoencoders with dynamic community discovery algorithms, and realizes modeling and anomaly detection of multi-dimensional complex graph structures for player behavior data in online gaming environments. Compared with anti-cheating technologies that rely on static rules or simple feature comparisons, the present invention dynamically captures the evolution of player behavior networks and simultaneously detects abnormal signals at multiple levels such as node features, relationship structures, and community evolution, thereby improving the ability to identify new, hidden, and collaborative cheating behaviors. The innovative multi-scale structure adaptive aggregation, dynamic joint reconstruction of edge weights, and residual regularization mechanism enable the model to accurately reconstruct normal behavior, sensitively perceive abnormal changes caused by counterfeit operations, subtle interactions, and gang behavior, and improve the accuracy and credibility of detection results.

[0055] The present invention introduces a stability evaluation and dynamic scale threshold adjustment mechanism in the community discovery process to avoid misjudgments due to occasional disturbances, and strengthens the accurate tracking of gang-type cheating and community structure variations. Combined with the automatic generation of adversarial samples and hybrid training, the robustness and generalization ability of the model in the face of unknown attack strategies and adversarial behaviors are enhanced, so that the anti-cheating system always maintains a high degree of sensitivity and adaptability. The present invention establishes a model adaptive optimization mechanism based on real-time feedback, which can continuously adjust the model parameters according to actual detection results and system feedback to achieve dynamic upgrading and self-evolution of anti-cheating capabilities. It not only makes up for the shortcomings of existing technologies in dynamic evolution, collaborative identification and continuous optimization, but also provides a more efficient, intelligent and reliable anti-cheating solution for the safe operation of large-scale online games. BRIEF DESCRIPTION OF THE DRAWINGS

[0056] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0057] Figure 1 This is a flowchart of a method for training a game anti-cheating model based on adversarial sample recognition proposed by the present invention;

[0058] Figure 2 This is a schematic diagram of the abnormal behavior detection and anti-cheating processing flow of the game anti-cheating model training method based on adversarial sample recognition proposed by the present invention; DETAILED DESCRIPTION

[0059] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.

[0060] refer to Figure 1 and Figure 2 A method for training a game anti-cheating model based on adversarial sample recognition includes the following steps:

[0061] S1. Collect the operation logs, social relationships, transaction records, and communication information of players in the online game environment, construct a behavior graph dataset, and preprocess the behavior graph dataset to obtain a standardized behavior graph dataset;

[0062] S2. Based on the standardized behavior graph dataset, a deep graph autoencoder model is constructed. The node and edge features are encoded through a multi-layer graph convolutional network to obtain a low-dimensional potential representation of the behavior graph and output the reconstruction error of the nodes and edges.

[0063] S3. Based on low-dimensional latent representation, a dynamic community discovery algorithm is used to identify and partition the community structure of player nodes and dynamically track the evolution of the player community.

[0064] S4. Based on the standardized behavior graph dataset and low-dimensional latent representation, we construct adversarial samples, and input the standardized behavior graph dataset and adversarial samples into the deep graph autoencoder model and dynamic community discovery algorithm for training.

[0065] S5. During the training process, based on the reconstruction errors of nodes and edges, low-dimensional latent representations, community structure partitions, and player community evolution, abnormal behaviors of player nodes and player communities are evaluated and marked to obtain abnormal behavior detection results.

[0066] S6. Output the abnormal behavior detection results. For player nodes and player communities that are judged to be abnormal, execute the risk warning, account restriction, behavior tracing and anti-cheating processing procedures in sequence, and dynamically update the deep graph autoencoder model parameters based on real-time feedback.

[0067] In this embodiment, the preprocessing of the behavior graph dataset specifically includes data cleaning, abnormal data removal, and standardization of node and edge attributes.

[0068] In this embodiment, S2 specifically includes:

[0069] S21. Based on the standardized behavior graph dataset G = (V, E, X, W), where V is the set of player nodes, E is the set of interaction edges, X is the node attribute feature matrix, and W is the edge weight feature matrix, for each node, the structural features and attribute features of neighbors of different orders are collected as multi-scale input;

[0070] S22. In the encoder structure, a multi-scale structure adaptive aggregation mechanism is designed to calculate the neighbor sets N of different orders for each node v. s (v) Using learnable weights α s Perform weighted aggregation to obtain the feature representation of the node in the l+1 layer

[0071]

[0072] Among them, S is the scale number, AGG s is the aggregation function of the s-th scale, σ is the activation function;

[0073] Feature Representation By introducing a multi-scale structure adaptive aggregation mechanism into the encoder structure, dynamic enhancement of node feature expression is achieved. The model automatically perceives neighbor information of different levels and ranges for each node, and weightedly fuses neighborhood features of each scale through learnable weights, integrating local and global structural features. The multi-scale structure adaptive aggregation mechanism improves the model's ability to model node associations in complex behavioral networks, avoiding information loss or expression limitations caused by a single aggregation method. Multi-scale weighted aggregation enhances the model's sensitivity to structural changes, abnormal patterns, and hidden collaborations, laying a solid data foundation for anomaly detection and anti-cheating judgment, and improving the expressiveness and generalization performance of behavioral graph modeling in large-scale online gaming environments. The anti-cheating system is more intelligent, stable, and reliable in dynamic and changeable practical application scenarios.

[0074] S23. At each layer of the encoder, by setting up an inter-layer residual connection mechanism, the output result of this layer is directly added to the output result of the previous layer, and the information of each layer is directly passed to the next layer;

[0075] S24, the low-dimensional potential representation Z finally output by the encoder is used as the structural attribute expression of the node and passed to the decoder part;

[0076] S25. In the decoder, the node features, the connection relationship between nodes, and the edge weights are jointly reconstructed using the low-dimensional potential representation, that is, the reconstructed value of the node feature, the reconstructed probability of the edge existence, and the reconstructed value of the edge weight are simultaneously generated;

[0077] S26. Calculate node features, adjacency matrix and edge weight reconstruction error, and define the joint loss function as

[0078]

[0079] Among them, λ1, λ2, λ3 are weighted coefficients, X is the original node attribute feature matrix, is the reconstructed node attribute feature matrix, A is the original adjacency matrix, To reconstruct the adjacency matrix, W is the original edge weight feature matrix, To reconstruct the edge weight feature matrix, ‖‖ 2 is the Frobenius norm;

[0080] The joint loss function weightedly integrates the reconstruction errors of node attributes, adjacency relationships, and edge weight features, achieving unified optimization of multi-dimensional feature consistency and network structure restoration, ensuring that the deep graph autoencoder model comprehensively examines the reconstruction effect of node attribute information, connection relationships, and interaction strength during training, avoiding the risk of the model over-focusing on a single feature and ignoring the overall structural expression. By strictly measuring the difference between the original features and the reconstructed features through the Frobenius norm, the model keenly captures subtle structural and attribute changes and shows higher detection sensitivity for abnormal behavior or cheating patterns. The weighted coefficients of different loss terms provide convenience for the model to flexibly adjust the importance of each feature in practical applications. The loss function improves the expressiveness of the model and the robustness of training, providing a solid foundation for high-precision, low-error anomaly detection and anti-cheating decision-making.

[0081] S27. Introduce regularization terms into the loss function, including feature sparsity regularization and latent space smoothness regularization, to constrain the expression of the low-dimensional latent representation Z;

[0082] S28. Based on the joint loss function, all learnable parameters are updated iteratively to complete the deep graph autoencoder model training, and the reconstruction error of the nodes and edges and the low-dimensional potential representation of the nodes are output.

[0083] In this embodiment, S3 specifically includes:

[0084] S31. Based on the low-dimensional potential representation Z of the node, perform preliminary community division on all player nodes V to obtain the initial community label set C t ;

[0085] S32: The community label C at the current time t is obtained. t and the community label C at the previous moment t-1 t-1 Perform multi-feature pairing, integrate node set overlap, node attribute similarity, and edge structure similarity, and use a weighted comprehensive formula to calculate the community stability score S c,t :

[0086]

[0087] Among them, sim attr () is the node attribute similarity, sim edge () is the edge structure similarity, M c,t is the node set of community c at time t, E c,t is the edge set of the community, β1, β2 and β3 are weighted coefficients, M c,t-1 is the node set of community c at time t-1, E c,t-1 is the edge set of community c at the previous moment t-1;

[0088] Community stability score S c,t By weightedly integrating node set overlap, node attribute similarity, and edge structure similarity, the system quantifies the structure and member stability of the community at different times in multiple dimensions, accurately depicts the sustainability and evolution trend of the community, and sensitively identifies dynamic changes such as community splits and mergers caused by cheating gangs, abnormal collaboration, or sudden behaviors. Node set overlap measures whether community members are stable, attribute similarity reflects the consistency of behavior and interests within the community, and edge structure similarity captures changes in social interactions and collaboration networks. By flexibly setting the weights of various indicators, the system can automatically adjust the focus according to actual needs. The community stability score S c,t It improves the scientificity and accuracy of community evolution detection, and provides a quantitative basis for abnormal community identification and subsequent anti-cheating processing.

[0089] S33, based on the obtained community stability score S c,t , set the stability score threshold τ, judge each community as a structurally stable community or a structurally fluctuating community, and record the community status;

[0090] S34, according to the discrimination results, the adaptive adjustment mechanism is used to adjust the size threshold of each community θ size,t Perform nonlinear adjustments, and different types of communities correspond to different adjustment strategies:

[0091]

[0092] Among them, θ0 is the basic threshold, γ1, γ2, δ are adjustment coefficients;

[0093] Community size threshold θ size,t With the introduction of the system, the system dynamically and flexibly sets the standards for retaining or merging communities based on the community stability score. For communities with stable structures, the threshold adjustment adopts a smooth exponential function to prevent community misjudgment and invalid splitting caused by small fluctuations. For communities with large structural fluctuations, a stricter nonlinear growth strategy is adopted to suppress the arbitrary expansion and noise influence of unstable communities. Through the adaptive adjustment mechanism, the platform ensures the healthy evolution of real and active communities while keenly capturing and curbing the generation and spread of abnormal, fake or gang-type cheating communities. The community size threshold θ size,t The strategy enhances the adaptability and robustness of community division and evolution processes, and provides an efficient and scientific decision-making basis for abnormal group detection and platform security management.

[0094] S35. Adjust the current community based on the determined community size threshold, merge or discard communities whose size is smaller than the community size threshold, and output the adjusted community division result;

[0095] S36. For each community, establish a temporal memory unit to continuously record the community labels and scale change sequence H at the last n moments. c and use the adjusted community division results as the latest historical sequence;

[0096] S37. Based on the temporal memory unit, short-term fluctuations in community labels and sizes are smoothed. If community attributes, structure, or size are observed to change continuously and significantly within the temporal window, it is determined to be an evolutionary event such as community splitting, merging, or the generation of a new community, and a list of evolutionary events is output.

[0097] In this embodiment, the S4 specifically includes:

[0098] S41. Based on the obtained standardized behavior graph dataset G = (V, E, X, W) and the obtained low-dimensional potential representation of the node Z, use the perturbation injection method to generate adversarial perturbation matrices ΔX, ΔA, and ΔW for node attributes, edge structure, and edge weights, where V is the set of player nodes, E is the set of interaction edges, X is the node attribute feature matrix, and W is the edge weight feature matrix;

[0099] S42. Add the original node feature X to the perturbation matrix ΔX to obtain the adversarial node feature X ′ ; Add the original adjacency matrix A to the perturbation matrix ΔA to obtain the adversarial adjacency matrix A ′ ; Add the original edge weight matrix W and the perturbation matrix ΔW to obtain the adversarial edge weight matrix W ′ ;

[0100] S43. Construct adversarial sample behavior graph G ′ =(V,E ′ ,X ′ ,W ′ ), where E ′ is the updated edge set after adversarial perturbation;

[0101] S44. Compare the original standardized behavior graph dataset G with the adversarial sample behavior graph G ′ The deep graph autoencoder model is jointly input for training to obtain the adversarially enhanced low-dimensional potential representation of nodes and the reconstruction errors of nodes and edges;

[0102] S45. Based on the adversarial enhanced latent representation, the dynamic community discovery algorithm is synchronously input to dynamically update the player community partition and evolution information;

[0103] S46. During the joint training process, respectively calculate the reconstruction errors of the original sample and the adversarial sample in terms of node feature reconstruction, adjacency matrix reconstruction, and edge weight reconstruction, and determine the overall joint training loss based on the weighted result of the reconstruction error of the original sample and the reconstruction error of the adversarial sample;

[0104] S47. During the training process, all learnable parameters of the deep graph autoencoder model and the dynamic community discovery algorithm are continuously updated based on the joint training loss;

[0105] S48. Output the low-dimensional potential representation of nodes after adversarial sample enhancement training, the reconstruction error of nodes and edges, and the community partition and community evolution information.

[0106] In this embodiment, the S5 specifically includes:

[0107] S51. Based on the output low-dimensional latent representation of nodes, reconstruction errors of nodes and edges, and output community partitioning and community evolution information, data of all player nodes and player communities are aggregated to construct feature sets of nodes and communities.

[0108] S52. For each player node, calculate the node feature reconstruction error, edge structure reconstruction error, and edge weight reconstruction error, which respectively reflect the reconstruction deviations of the node in attributes, structure, and interaction weight;

[0109] S53. For each player community, calculate the average feature reconstruction error of all nodes in the community, calculate the proportion of community size change between two consecutive moments, and calculate the proportion of changes in the community labels of nodes in the community at adjacent moments, reflecting the overall structural changes and member stability of the community;

[0110] S54. According to the node reconstruction error, the community average reconstruction error, the community size change rate, and the community label evolution rate, a multi-threshold discrimination criterion is set, and a node anomaly discrimination threshold and a community anomaly discrimination threshold are set respectively;

[0111] S55. For player nodes whose reconstruction error or structural change index exceeds a threshold, mark them as abnormal nodes; for player communities whose average reconstruction error, scale change rate, or label evolution rate exceeds a threshold, mark them as abnormal communities;

[0112] S56: Output the numbers of all player nodes and player communities marked as abnormal and the corresponding abnormal index values ​​to form abnormal behavior detection results.

[0113] In this embodiment, S6 specifically includes:

[0114] S61. Receive and organize the generated abnormal behavior detection results, determine the specific list of player nodes and player communities that are judged to be abnormal, and the reasons for the abnormality;

[0115] S62. For player nodes and player communities that are determined to be abnormal, risk warning information is issued to the backend security management personnel or monitoring platform to remind relevant personnel to pay attention to and handle risk events in a timely manner;

[0116] S63. Based on the severity of the abnormal behavior, account restriction measures will be taken against player nodes and player communities that are judged to be abnormal, including suspending login, freezing accounts, restricting transaction permissions, and blocking social operations;

[0117] S64. Conduct behavioral tracing for all player nodes and player communities where restrictive measures have been taken, analyzing recent game behaviors, interaction objects, historical operation records, and associations, and locating suspicious behavior chains and potential related groups.

[0118] S65. Organize the feedback information and actual results obtained during the risk warning, account restriction, and behavior tracing process. Based on the feedback information during the process, dynamically adjust and update the parameters of the deep graph autoencoder model to optimize the detection capabilities of new abnormal behaviors and cheating methods.

[0119] Example 1:

[0120] In order to verify the feasibility of the present invention in implementation, the present invention is applied to a large-scale multiplayer online competitive game. With the rapid growth of the number of active players, cheating behaviors have shown a trend of diversification and intelligence. Traditional anti-cheating systems mostly use rule-based anomaly detection, blacklist filtering and simple behavior threshold statistics, which are difficult to adapt to the evolving new cheating methods, especially in terms of gang crimes, automated script operations and forged behavior data. In the actual operation process, the platform often receives complaints from players about resource theft, account swiping, transaction manipulation and other problems, which affects the user experience and threatens the healthy operation of the virtual economic system.

[0121] To address the above pain points, the platform deployed for the first time on a certain server the game anti-cheating model training method proposed in this invention based on adversarial sample recognition. Based on a deep graph autoencoder model and a dynamic community discovery algorithm, the solution automatically models player logs, social networks, transaction behaviors, and real-time communication data to generate a high-dimensional behavior graph structure. Each node represents a player account, and edges represent multiple interactive relationships. Both nodes and edges carry multi-dimensional attributes. The system standardizes the collected behavior graphs and removes invalid and suspicious data. The deep graph autoencoder performs multi-scale structural encoding and compression on the attributes of nodes and edges, and performs feature aggregation and joint reconstruction through an adaptive mechanism. This process improves the distinguishability of abnormal features.

[0122] In order to solve the problem that traditional systems are easily evaded by scripts to forge data or large-scale group collaboration, the present invention introduces an automatic generation mechanism for adversarial samples, injects targeted disturbances into the attributes and structure of the behavior graph, and trains the model with higher robustness. The dynamic community discovery algorithm can track the evolution of players' social circles and collaborative networks, and use the dynamic adjustment of community stability and scale thresholds to keenly capture complex behavioral structures such as group collaboration and collaborative cheating. Whenever a potential abnormal node or community is detected, the system automatically pushes a risk warning and can trigger a series of defense processes such as freezing, tracing, and restriction. The model detection effect and parameters are automatically updated based on real-time feedback, forming a continuously adaptive security closed loop.

[0123] Among the 8.7 million active accounts and approximately 340 million behavioral data collected by a certain server, the method of the present invention detected a total of 20,742 abnormal accounts and identified 328 high-risk communities, 87 of which were gang-type cheating communities. Compared with traditional anti-cheating systems, the operation frequency, behavioral links and resource flows of cheating group accounts detected by the present invention far exceed those of ordinary players. Statistics show that after deploying the solution of the present invention, the number of complaints from platform players decreased by 47.6%, the number of abnormal economic fluctuations decreased by nearly two-thirds, and the average daily activity of players increased by about 2.5%. The detection accuracy of the model in the original sample environment was 97.8%, and it remained at 93.1% in the adversarial sample environment, while the accuracy of the traditional solution was only 85.4%. The system's average response time for handling high-risk accounts was shortened from 3.6 minutes to 2.1 minutes, and the false positive rate and missed positive rate were reduced to 1.8% and 2.4% respectively.

[0124] Table 1 Comparison of detection results between anti-cheating methods based on adversarial sample identification and traditional solutions

[0125] index Method of the present invention Traditional anti-cheating solutions Number of active accounts 8,705,143 8,702,986 Total amount of behavioral data (items) 339,125,010 337,908,434 Detect abnormal account numbers 20,742 13,306 Number of detected abnormal communities 328 184 Number of gang-type cheating communities discovered 87 31 Detection accuracy (original sample) 97.8％ 85.4％ Detection accuracy (adversarial examples) 93.1％ 67.9％ Average false positive rate 1.8％ 6.6％ Average missed detection rate 2.4％ 8.5％ Number of complaints 3,067 5,853 Number of abnormal economic fluctuations 141 391 Response time for handling gang accounts (minutes) 2.1 3.6 Players' daily average activity increase rate 2.5％ 0.8％

[0126] Table 1 summarizes the key detection results and operational data of our anti-cheating model based on adversarial sample identification and traditional anti-cheating solutions in actual large-scale gaming platforms. In terms of the number of active accounts and the total amount of behavioral data, the two solutions operate in the same environment, ensuring objectivity and data comparability. In terms of anomaly detection capabilities, our method detected significantly more abnormal accounts (20,742) and communities (328) than traditional anti-cheating solutions. It also significantly outperformed traditional anti-cheating solutions in detecting group-based cheating communities, identifying 87, nearly three times the number of traditional solutions.

[0127] In terms of detection accuracy, the proposed method achieved a detection accuracy of 97.8% in the original sample environment and maintained a high accuracy of 93.1% in the adversarial sample environment, compared to only 85.4% and 67.9% for traditional anti-cheating solutions, respectively. This demonstrates the proposed method's high static detection capabilities and its strong robustness and anti-interference capabilities against adversarial attack samples. The proposed method's average false positive and false negative rates were 1.8% and 2.4%, respectively, significantly lower than the 6.6% and 8.5% rates of traditional solutions. This reduced negative user experiences such as false bans and missed detections, and enhanced player trust. Regarding platform operational effectiveness, after the implementation of the proposed method, player complaints decreased from 5,853 to 3,067, and incidents of abnormal economic fluctuations decreased from 391 to 141, stabilizing the virtual economy and maintaining a healthy gaming ecosystem. The response time for handling group accounts was shortened to an average of 2.1 minutes, significantly improving processing efficiency compared to traditional methods. The average daily player activity increased by 2.5%, significantly exceeding the 0.8% rate of traditional solutions, demonstrating both player experience and platform stickiness.

[0128] This invention outperforms traditional anti-cheating solutions in multiple dimensions, including comprehensive detection capabilities, adversarial robustness, misjudgment control, economic security, and user experience in large-scale and complex environments, providing the gaming industry with a safe, efficient, and intelligent anti-cheating technology path.

[0129] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A method for training a game anti-cheating model based on adversarial sample recognition, characterized in that: The steps include: S1. Collect the operation logs, social relationships, transaction records, and communication information of players in the online game environment, construct a behavior graph dataset, and preprocess the behavior graph dataset to obtain a standardized behavior graph dataset; S2. Based on the standardized behavior graph dataset, a deep graph autoencoder model is constructed. The node and edge features are encoded through a multi-layer graph convolutional network to obtain a low-dimensional potential representation of the behavior graph and output the reconstruction error of the nodes and edges. S3. Based on low-dimensional latent representation, a dynamic community discovery algorithm is used to identify and partition the community structure of player nodes and dynamically track the evolution of the player community. S4. Based on the standardized behavior graph dataset and low-dimensional latent representation, we construct adversarial samples, and input the standardized behavior graph dataset and adversarial samples into the deep graph autoencoder model and dynamic community discovery algorithm for training. S5. During the training process, based on the reconstruction errors of nodes and edges, low-dimensional latent representations, community structure partitions, and player community evolution, abnormal behaviors of player nodes and player communities are evaluated and marked to obtain abnormal behavior detection results. S6. Output the abnormal behavior detection results. For player nodes and player communities that are judged to be abnormal, execute the risk warning, account restriction, behavior tracing and anti-cheating processing procedures in sequence, and dynamically update the deep graph autoencoder model parameters based on real-time feedback.

2. A method for training a game anti-cheating model based on adversarial sample recognition according to claim 1, characterized in that: The preprocessing of the behavior graph dataset specifically includes data cleaning, abnormal data removal, and standardization of node and edge attributes.

3. The method for training a game anti-cheating model based on adversarial sample recognition according to claim 1, characterized in that: The S2 specifically includes: S21. Based on the standardized behavior graph dataset G = (V, E, X, W), where V is the set of player nodes, E is the set of interaction edges, X is the node attribute feature matrix, and W is the edge weight feature matrix, for each node, the structural features and attribute features of neighbors of different orders are collected as multi-scale input; S22. In the encoder structure, a multi-scale structure adaptive aggregation mechanism is designed to calculate the neighbor sets N of different orders for each node v. s (v) Using learnable weights α s Perform weighted aggregation to obtain the feature representation of the node in the l+1 layer S23. At each layer of the encoder, by setting up an inter-layer residual connection mechanism, the output result of this layer is directly added to the output result of the previous layer, and the information of each layer is directly passed to the next layer; S24, the low-dimensional potential representation Z finally output by the encoder is used as the structural attribute expression of the node and passed to the decoder part; S25. In the decoder, the node features, the connection relationship between nodes, and the edge weights are jointly reconstructed using the low-dimensional potential representation, that is, the reconstructed value of the node feature, the reconstructed probability of the edge existence, and the reconstructed value of the edge weight are simultaneously generated; S26. Calculate node features, adjacency matrix and edge weight reconstruction error, and define the joint loss function as S27. Introduce regularization terms into the loss function, including feature sparsity regularization and latent space smoothness regularization, to constrain the expression of the low-dimensional latent representation Z; S28. Based on the joint loss function, all learnable parameters are updated iteratively to complete the deep graph autoencoder model training, and the reconstruction error of the nodes and edges and the low-dimensional potential representation of the nodes are output.

4. The method for training a game anti-cheating model based on adversarial sample recognition according to claim 1, characterized in that: The S3 specifically includes: S31. Based on the low-dimensional potential representation Z of the node, perform preliminary community division on all player nodes V to obtain the initial community label set C t ; S32: The community label C at the current time t is obtained. t and the community label C at the previous moment t-1 t-1 Perform multi-feature pairing, integrate node set overlap, node attribute similarity, and edge structure similarity, and use a weighted comprehensive formula to calculate the community stability score S c,t ; S33, based on the obtained community stability score S c,t , set the stability score threshold τ, judge each community as a structurally stable community or a structurally fluctuating community, and record the community status; S34, according to the discrimination results, an adaptive adjustment mechanism is used to adjust the size threshold of each community θ size,t Conduct nonlinear adjustments, with different adjustment strategies corresponding to different types of communities; S35. Adjust the current community based on the determined community size threshold, merge or discard communities whose size is smaller than the community size threshold, and output the adjusted community division result; S36. For each community, establish a temporal memory unit to continuously record the community labels and scale change sequence H at the last n moments. c and use the adjusted community division results as the latest historical sequence; S37. Based on the temporal memory unit, short-term fluctuations in community labels and sizes are smoothed. If community attributes, structure, or size are observed to change continuously and significantly within the temporal window, it is determined to be an evolutionary event such as community splitting, merging, or the generation of a new community, and a list of evolutionary events is output.

5. The method for training a game anti-cheating model based on adversarial sample recognition according to claim 1, characterized in that: The S4 specifically includes: S41. Based on the obtained standardized behavior graph dataset G = (V, E, X, W) and the obtained low-dimensional potential representation of the node Z, use the perturbation injection method to generate adversarial perturbation matrices ΔX, ΔA, and ΔW for node attributes, edge structure, and edge weights, where V is the set of player nodes, E is the set of interaction edges, X is the node attribute feature matrix, and W is the edge weight feature matrix; S42. Add the original node feature X to the perturbation matrix ΔX to obtain the adversarial node feature X ′ ; Add the original adjacency matrix A to the perturbation matrix ΔA to obtain the adversarial adjacency matrix A ′ ; Add the original edge weight matrix W and the perturbation matrix ΔW to obtain the adversarial edge weight matrix W ′ ; S43. Construct adversarial sample behavior graph G ′ =(V,E ′ ,X ′ ,W ′ ), where E ′ is the updated edge set after adversarial perturbation; S44. Compare the original standardized behavior graph dataset G with the adversarial sample behavior graph G ′ The deep graph autoencoder model is jointly input for training to obtain the adversarially enhanced low-dimensional potential representation of nodes and the reconstruction errors of nodes and edges; S45. Based on the adversarial enhanced latent representation, the dynamic community discovery algorithm is synchronously input to dynamically update the player community partition and evolution information; S46. During the joint training process, respectively calculate the reconstruction errors of the original sample and the adversarial sample in terms of node feature reconstruction, adjacency matrix reconstruction, and edge weight reconstruction, and determine the overall joint training loss based on the weighted result of the reconstruction error of the original sample and the reconstruction error of the adversarial sample; S47. During the training process, all learnable parameters of the deep graph autoencoder model and the dynamic community discovery algorithm are continuously updated based on the joint training loss; S48. Output the low-dimensional potential representation of nodes after adversarial sample enhancement training, the reconstruction error of nodes and edges, and the community partition and community evolution information.

6. The method for training a game anti-cheating model based on adversarial sample recognition according to claim 1, characterized in that: The S5 specifically includes: S51. Based on the output low-dimensional latent representation of nodes, reconstruction errors of nodes and edges, and output community partitioning and community evolution information, data of all player nodes and player communities are aggregated to construct feature sets of nodes and communities. S52. For each player node, calculate the node feature reconstruction error, edge structure reconstruction error, and edge weight reconstruction error, which respectively reflect the reconstruction deviations of the node in attributes, structure, and interaction weight; S53. For each player community, calculate the average feature reconstruction error of all nodes in the community, calculate the proportion of community size change between two consecutive moments, and calculate the proportion of changes in the community labels of nodes in the community at adjacent moments, reflecting the overall structural changes and member stability of the community; S54, setting a multi-threshold discrimination criterion based on the node reconstruction error, the community average reconstruction error, the community size change rate, and the community label evolution rate, and setting a node anomaly discrimination threshold and a community anomaly discrimination threshold respectively; S55. For player nodes whose reconstruction error or structural change index exceeds a threshold, mark them as abnormal nodes; for player communities whose average reconstruction error, scale change rate, or label evolution rate exceeds a threshold, mark them as abnormal communities; S56: Output the numbers of all player nodes and player communities marked as abnormal and the corresponding abnormal index values ​​to form abnormal behavior detection results.

7. The method for training a game anti-cheating model based on adversarial sample recognition according to claim 1, characterized in that: The S6 specifically includes: S61. Receive and organize the generated abnormal behavior detection results, determine the specific list of player nodes and player communities that are judged to be abnormal, and the reasons for the abnormality; S62. For player nodes and player communities that are determined to be abnormal, risk warning information is issued to the backend security management personnel or monitoring platform to remind relevant personnel to pay attention to and handle risk events in a timely manner; S63. Based on the severity of the abnormal behavior, account restriction measures will be taken against player nodes and player communities that are judged to be abnormal, including suspending login, freezing accounts, restricting transaction permissions, and blocking social operations; S64. Conduct behavioral tracing for all player nodes and player communities where restrictive measures have been taken, analyzing recent game behaviors, interaction objects, historical operation records, and associations, and locating suspicious behavior chains and potential related groups. S65. Organize the feedback information and actual results obtained during the risk warning, account restriction, and behavior tracing process. Based on the feedback information during the process, dynamically adjust and update the parameters of the deep graph autoencoder model to optimize the detection capabilities of new abnormal behaviors and cheating methods.

Images