A method for detecting game behavior anomalies based on spatiotemporal feature fusion

Abstract

This invention proposes a game behavior anomaly detection method based on spatiotemporal feature fusion. The method includes the following steps: Visual encoding of behavior data: Collecting user operation time-series data, encoding it by hue mapping according to event type, mapping basic operation events, core interaction events, numerical change events, and no-operation events to differentiated colors, where numerical events use gradient colors to represent the intensity of change; Dividing the time-series data into row vectors based on preset time units, generating a two-dimensional behavior map by stacking multiple rows, representing temporal continuity horizontally and reflecting the periodic regularity of behavior vertically, forming a visual data carrier containing spatiotemporal features; Construction of a dual-channel detection model: Constructing a two-layer architecture of a supervised detection channel and an enhanced detection channel. The supervised detection channel uses a deep convolutional neural network to extract spatial features of the map and connects to an interpretable classifier to output the behavior compliance probability.

Description

Technical Field

[0001] This invention belongs to the field of game cheat detection, and specifically relates to a method for detecting abnormal game behavior based on spatiotemporal feature fusion. Background Technology

[0002] Current game behavior anomaly detection technologies generally face multidimensional challenges: traditional rule engine-based detection systems rely heavily on human experience and preset conditions, making it difficult to cope with the rapid changes in new cheating methods. In particular, when facing script cheats with time-series camouflage characteristics, the lag in updating their static rule base leads to a high false negative rate. Although detection methods based on single-dimensional statistical analysis can capture some abnormal numerical fluctuations, they cannot effectively analyze the spatiotemporal correlation between behavioral events. For example, they lack the ability to model the temporal coupling characteristics of periodic operations and game scene context, making it easy to misjudge high-frequency operations of normal players during activities.

[0003] Existing machine learning models mostly use single-modal feature input, simply converting time series data into statistical indicators or independent event sequences for processing. This severs the inherent connection between temporal continuity and spatial distribution, resulting in the loss of feature information of key behavioral patterns. Typically, this manifests as the inability to identify the grid-like distribution pattern of mechanical operations generated by plug-ins on a two-dimensional spatiotemporal plane.

[0004] While mainstream deep learning solutions can automatically extract features, their poor model interpretability makes it difficult for operators to trace the basis for judgment. Furthermore, traditional convolutional neural networks suffer from feature confusion when directly processing raw time-series data, failing to distinguish the subtle differences between the strategic actions of normal players and malicious scripts. Existing detection systems generally lack dynamic evolution capabilities; when game versions are updated to introduce new gameplay, the original models need to be fully retrained, unable to quickly adapt to changes in behavioral patterns through incremental learning. Group anomaly detection often uses simple association rules, making it difficult to discover the spatiotemporal synchronization features hidden in cross-account collaborative cheating, such as the distributed behavioral resonance phenomenon formed by collusion groups within a specific time window.

[0005] Visualization analysis techniques are mostly limited to basic chart display, failing to encode spatiotemporal features into structured images that can be parsed by deep learning models, resulting in low efficiency for manual review. Existing technologies generally suffer from computational latency when processing real-time streaming data, making it impossible to complete complex spatiotemporal feature analysis within millisecond-level time windows, allowing some transient cheating behaviors to escape detection. Traditional anomaly scoring mechanisms lack a multi-channel verification system, and single detection results are easily affected by noise, leading to misjudgments. There is also a lack of a collaborative verification mechanism between supervised learning and unsupervised mining. Feature engineering still relies heavily on manual design and has failed to build an automated feature derivation system, resulting in low efficiency in feature extraction for new variant cheats.

[0006] These shortcomings collectively limit the accuracy and real-time performance of abnormal game behavior detection, necessitating the construction of a new detection system that integrates spatiotemporal feature analysis and adaptive learning. Summary of the Invention

[0007] This invention proposes a game behavior anomaly detection method based on spatiotemporal feature fusion. This method solves the problems of spatiotemporal feature fragmentation, lagging recognition of new anomaly patterns, difficulty in detecting group collaborative cheating, and insufficient dynamic evolution capability of the detection system in existing game behavior detection technologies, and achieves high-precision real-time detection of complex anomaly behaviors.

[0008] The technical solution of this invention is implemented as follows: a method for detecting abnormal game behavior based on spatiotemporal feature fusion, the method comprising the following steps:

[0009] Behavioral data visualization encoding: Collect user operation time-series data, and perform color mapping encoding according to event type. Basic operation events, core interaction events, numerical change events, and no operation events are mapped to different colors. Among them, numerical events use gradient colors to represent the intensity of change. Based on preset time units, the time-series data is divided into row vectors. By stacking multiple rows, a two-dimensional behavioral map is generated. The horizontal dimension represents the continuity of time, and the vertical dimension reflects the periodic regularity of behavior, forming a visual data carrier containing spatiotemporal characteristics.

[0010] Dual-channel detection model construction: A two-layer architecture of supervised detection channel and enhanced detection channel is constructed. The supervised detection channel uses a deep convolutional neural network to extract spatial features of the graph and connects to an interpretable classifier to output the compliance probability of behavior. The enhanced detection channel identifies periodic distribution features in the graph based on the target detection framework to capture mechanical behavior patterns. The initial model is generated by training with historical positive and negative samples and the dual-channel parallel detection logic is established.

[0011] Real-time anomaly detection and tracking: Real-time behavioral data is encoded into a standard graph and input into a dual-channel model. The compliance probability of behavior is calculated through the supervision channel and combined with the regularity feature identification results of the enhancement channel to generate an anomaly confidence score. Based on the score threshold, a multi-level response mechanism is triggered to intercept high-risk accounts in real time and retain their behavioral trajectories. At the same time, suspicious samples are injected into the anomaly feature database.

[0012] Group anomaly pattern mining: Based on the anomaly feature library, an adaptive density clustering algorithm is used to identify group behavior patterns with similar spatiotemporal characteristics. The clustering results are then graded and verified using expert rules to extract script features, collaboration features, and novel variant features. The verified feature parameters are then back-injected into the detection model to expand the dimensions of anomaly identification.

[0013] Closed-loop self-optimization system: Establishes a dynamic coding rule update mechanism, adds a new hue layer to represent new abnormal behaviors and supports semi-transparent overlay and fusion, constructs incremental learning trigger conditions, and automatically optimizes model parameters to be compatible with new and old features when new anomalies accumulate to a set scale. At the same time, it constructs a three-level early warning strategy based on the danger level of the anomaly mode, and implements differentiated handling solutions for real-time blocking, manual review and continuous tracking respectively.

[0014] Existing game behavior anomaly detection technologies have multiple defects: traditional rule engine-based systems rely on manually preset conditions, which are difficult to cope with the rapid changes in script cheats. Especially when dealing with cheating behaviors with time-series camouflage characteristics, the lag in static rule updates leads to a high false negative rate.

[0015] While statistical analysis methods can capture numerical anomalies, they cannot analyze the spatiotemporal correlation between events. For example, they lack modeling of the temporal coupling between periodic operations and game scenarios, leading to misjudgment of high-frequency operations by normal players during events. Unimodal machine learning models simplify time-series data into statistical indicators or independent sequences, severing the spatiotemporal continuity and causing the loss of the gridded spatiotemporal distribution characteristics generated by cheat programs.

[0016] The poor interpretability of deep learning models makes it difficult for operators to trace the basis for judgment, and traditional convolutional networks confuse the microscopic differences between normal strategies and malicious scripts when processing raw time-series data; the system lacks dynamic evolution capabilities, and requires full retraining after game version updates, and cannot quickly adapt to new behavior patterns through incremental learning; group detection uses simple association rules, which makes it difficult to detect the spatiotemporal synchronization features in cross-account collaborative cheating (such as the behavioral resonance of gangs); visualization technology remains at the basic chart level and does not encode spatiotemporal features into structured images, resulting in inefficient manual review;

[0017] Real-time streaming data processing suffers from computational latency, making it impossible to complete complex spatiotemporal analysis within millisecond-level windows, and instantaneous cheating behaviors can easily escape detection; traditional anomaly scoring lacks multi-channel verification, single detection results are easily affected by noise, and there is a lack of supervised and unsupervised collaborative verification; feature engineering relies on manual design, and the extraction efficiency of new variant plug-in features is low.

[0018] The core challenges of these problems lie in: how to effectively integrate spatiotemporal features to capture the gridded distribution patterns of mechanical behavior; how to construct dynamically evolving detection models to adapt to rapidly iterating cheating methods; how to improve the feature extraction capabilities of deep learning models for temporal behavior patterns through visual encoding; how to balance computational efficiency with the accuracy of complex spatiotemporal analysis in real-time detection; how to establish a multi-level verification mechanism for group anomalies to identify hidden collaborative cheating patterns; and how to achieve self-evolution of the detection system without compromising its original recognition capabilities.

[0019] As a preferred embodiment, the collaborative mechanism between the supervisory detection channel and the enhanced detection channel includes a dynamic weight allocation module, which automatically adjusts the fusion weight of the dual-channel output results according to the spatiotemporal distribution characteristics of the real-time behavior map, wherein the proportion of periodic feature recognition results increases exponentially with the length of the detection period.

[0020] As a preferred embodiment, the dynamic weight allocation module includes a spatiotemporal coupling analysis unit, which is specifically designed with the following adjustment mechanism for the characteristics of game behavior data:

[0021] Time Segment Sensitive Adjustment: Divide time segments according to the game operation cycle, establish a time segment feature vector library, and when a time segment is detected to enter a specific segment in real time, automatically match the corresponding historical spatiotemporal distribution pattern and dynamically adjust the dual-channel weight baseline value.

[0022] Spatial density perception adjustment: The behavior map is divided into grid blocks, and the spatial distribution dispersion index of event clusters is calculated. When the event distribution in the grid cell shows a high-density rectangular arrangement feature, the weight enhancement mechanism of the enhanced detection channel is triggered.

[0023] Spatiotemporal coupling attenuation factor: Construct a dynamic weight update function that adaptively configures the settings based on the game scene type analyzed in real time;

[0024] Game phase context adaptation: By accessing the game status interface to obtain the current phase of the player, an upper limit threshold is set for the weight increase of periodic features during the resource settlement period to avoid misjudging normal high-frequency operations.

[0025] As a preferred embodiment, the behavior map generation process includes a temporal compression compensation mechanism, which automatically activates a nonlinear time axis compression algorithm when a series of no-operation events are detected, thereby increasing the temporal resolution of key behavior events while maintaining the total pixel dimension.

[0026] As a preferred embodiment, the closed-loop self-optimization system includes an adversarial incremental training module, which synchronously injects normal samples that have undergone perturbation processing during the model parameter optimization stage, and ensures that the ability to identify newly added abnormal features does not affect the judgment accuracy of the original samples through adversarial loss function constraints.

[0027] As a preferred implementation, the expert rule verification process adopts a multi-layer cascaded verification architecture. The first layer filters potential abnormal groups through convolutional feature similarity, the second layer uses graph neural networks to analyze the relationship topology between accounts, and the final layer combines the semantics of the game scene context to verify the rationality of abnormal patterns.

[0028] As a preferred embodiment, the hue mapping encoding includes a dynamic expansion mechanism. When a new abnormal behavior feature is detected, an auxiliary hue layer is added while retaining the basic color system, and the multi-dimensional behavior feature is fused and represented by overlaying transparency.

[0029] As a preferred embodiment, the triggering logic of the enhanced detection channel is set to automatically activate when the compliance probability of the behavior output by the supervision channel is lower than a first threshold, and simultaneously increase the danger level of the abnormal confidence score after detecting periodic distribution characteristics.

[0030] After adopting the above technical solution, the beneficial effects of this invention are as follows: This method significantly improves the comprehensive performance of game behavior anomaly detection through its original spatiotemporal feature fusion mechanism and dynamic evolution system: The pioneering multi-dimensional hue encoding transforms temporal behavior into a visual map containing spatiotemporal distribution characteristics, breaking through the limitations of traditional single-dimensional feature processing, enabling convolutional neural networks to accurately capture the unique gridded distribution pattern of cheating operations; The constructed dual-channel detection architecture innovatively integrates deep learning and object detection technologies, outputting compliance probability through the interpretable classifier of the supervised model, combined with the periodic feature recognition of the enhanced channel, forming a dual verification mechanism, effectively distinguishing the micro-differences between strategic operations and script behavior, and significantly reducing the false judgment rate;

[0031] The real-time detection stage employs a multi-level response strategy, completing spatiotemporal feature analysis and risk level determination within a millisecond window to accurately intercept transient cheating behaviors. The group anomaly mining module, through the synergy of adaptive density clustering algorithm and expert rule verification, can discover distributed collaborative cheating patterns that are difficult to identify using traditional methods, such as the spatiotemporal synchronization characteristics of cheating gangs. The closed-loop self-optimization system, through dynamic coding rule updates and incremental learning mechanisms, enables the detection model to autonomously absorb new anomaly features, avoiding system failures caused by version updates. At the same time, an adversarial training protection mechanism is adopted to ensure that the learning of new features does not affect the original detection capabilities. The nonlinear gradient color mapping in the visualization coding enhances the feature contrast of key numerical ranges and improves the efficiency of manual review.

[0032] The three-tiered early warning strategy, combined with spatiotemporal correlation analysis, enables collaborative monitoring of low-risk group anomalies, effectively identifying hidden collaborative risks. A feature feedback channel injects validated anomaly patterns back into the model, forming a continuously evolving detection capability. The overall solution achieves breakthroughs in detection accuracy, real-time response, pattern discovery, and system adaptability, providing end-to-end technical support for secure game operations. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 This is a flowchart of the method of the present invention;

[0035] Figure 2 This is a structural diagram of the AI ​​behavior data detection system of the present invention;

[0036] Figure 3 This is a diagram illustrating abnormal account behavior according to the present invention;

[0037] Figure 4 This invention provides image data diagrams of abnormal account behavior.

[0038] Figure 5 This is the negative sample image library for this invention;

[0039] Figure 6 This is a positive sample image library for the present invention;

[0040] Figure 7 This is a comparison chart of the regular behaviors of abnormal samples in this invention;

[0041] Figure 8 This is a data graph showing the regular behavior of abnormal samples in this invention;

[0042] Figure 9 This is a graph showing script behavior detected by AI in this invention. Detailed Implementation

[0043] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0044] Example:

[0045] like Figure 1 As shown, a method for detecting game behavior anomalies based on spatiotemporal feature fusion is described, the method comprising the following steps:

[0046] Behavioral data visualization encoding: Collect user operation time-series data, and perform color mapping encoding according to event type. Basic operation events, core interaction events, numerical change events, and no operation events are mapped to different colors. Among them, numerical events use gradient colors to represent the intensity of change. Based on preset time units, the time-series data is divided into row vectors. By stacking multiple rows, a two-dimensional behavioral map is generated. The horizontal dimension represents the continuity of time, and the vertical dimension reflects the periodic regularity of behavior, forming a visual data carrier containing spatiotemporal characteristics.

[0047] Dual-channel detection model construction: A two-layer architecture of supervised detection channel and enhanced detection channel is constructed. The supervised detection channel uses a deep convolutional neural network to extract spatial features of the graph and connects to an interpretable classifier to output the compliance probability of behavior. The enhanced detection channel identifies periodic distribution features in the graph based on the target detection framework to capture mechanical behavior patterns. The initial model is generated by training with historical positive and negative samples and the dual-channel parallel detection logic is established.

[0048] Real-time anomaly detection and tracking: Real-time behavioral data is encoded into a standard graph and input into a dual-channel model. The compliance probability of behavior is calculated through the supervision channel and combined with the regularity feature identification results of the enhancement channel to generate an anomaly confidence score. Based on the score threshold, a multi-level response mechanism is triggered to intercept high-risk accounts in real time and retain their behavioral trajectories. At the same time, suspicious samples are injected into the anomaly feature database.

[0049] Group anomaly pattern mining: Based on the anomaly feature library, an adaptive density clustering algorithm is used to identify group behavior patterns with similar spatiotemporal characteristics. The clustering results are then graded and verified using expert rules to extract script features, collaboration features, and novel variant features. The verified feature parameters are then back-injected into the detection model to expand the dimensions of anomaly identification.

[0050] Closed-loop self-optimization system: Establishes a dynamic coding rule update mechanism, adds a new hue layer to represent new abnormal behaviors and supports semi-transparent overlay and fusion, constructs incremental learning trigger conditions, and automatically optimizes model parameters to be compatible with new and old features when new anomalies accumulate to a set scale. At the same time, it constructs a three-level early warning strategy based on the danger level of the anomaly mode, and implements differentiated handling solutions for real-time blocking, manual review and continuous tracking respectively.

[0051] In practical applications of game cheat detection, this solution achieves accurate identification and continuous countermeasures against cheating behavior through spatiotemporal feature fusion and dynamic learning mechanisms. The system first connects to the game server's real-time log stream to collect player operation event sequence data, including core interaction events such as character movement, skill release, and item trading, as well as numerical operation events such as game currency changes and equipment attribute modifications. The data preprocessing module performs feature mapping on the raw event stream according to preset spatiotemporal encoding rules: basic operation events (such as movement commands) are marked in blue, core interaction events (such as entering a dungeon) are mapped in yellow, numerical gain and loss events are encoded using gradient colors from red to dark red and green to dark green, respectively, and periods without operation are filled with black. The encoding engine uses 1 second as the basic time unit, converting a continuous 300-second behavior sequence into horizontal pixel rows, stacking 288 rows vertically to construct a 24-hour behavior map, forming a two-dimensional spatiotemporal feature matrix that combines temporal continuity and periodic regularity.

[0052] When detecting script cheats, the spatiotemporal encoding mechanism can effectively capture the typical characteristics of cheat behavior: for example, automatic gold farming scripts will trigger repetitive operations at fixed time intervals, which are distributed in an equally spaced yellow core event matrix in the behavior graph; while variable speed cheats will cause unnatural color block abrupt changes in the gradient color distribution due to abnormal operation frequency. The encoded standard graph is input into the dual-channel detection model. The supervised detection channel adopts an improved VGG19 network structure, extracts spatial texture features (such as color distribution gradient and event cluster morphology) through convolutional layers, and then connects to an interpretable logistic regression classifier after global average pooling, outputting a behavior compliance probability value based on historical sample training; at the same time, the enhanced detection channel is based on the YOLOv8 object detection framework, and scans the graph for periodically arranged rectangular feature regions through the anchor box mechanism to identify the gridded distribution pattern unique to mechanical operations. The dual-channel output results are collaboratively judged through a dynamic weight fusion module: during peak gaming periods, the enhanced channel increases the detection weight of periodic features exponentially to effectively deal with scenarios where script cheats are concentrated; when high-density rectangular arrangement features are detected, the system automatically increases the danger level threshold of the abnormal confidence score.

[0053] The real-time judgment process employs a streaming architecture. When an account's behavior graph, after analysis by a dual-channel model, has an anomaly confidence score exceeding a preset threshold, the real-time interception module immediately freezes the account's transaction function. Simultaneously, it activates the behavior trajectory tracking submodule to record subsequent operation events and generate a derived graph. Suspicious samples are synchronously injected into the anomaly feature library, triggering a group anomaly mining process: an adaptive density clustering algorithm uses spatiotemporal feature similarity (such as the SSIM index and KL divergence of event distribution) to group negative samples and identify cheat clusters with similar characteristics. For example, for distributed gold farming studio accounts, their behavior graphs show synchronous periodic yellow event bands within a specific time window; while new variant cheats may exhibit an asymmetric gradient color block distribution. The expert verification system employs a multi-layered cascade strategy: the first layer uses convolutional feature matching to filter out groups similar to known cheat patterns; the second layer uses graph neural networks to analyze topological relationships between accounts, such as device fingerprint associations and IP addresses; the final layer combines game scene semantic verification (such as whether abnormal operations conform to the current dungeon mechanism) to eliminate misjudged samples caused by improved player skills.

[0054] The closed-loop optimization system injects confirmed new cheat patterns into the coding rule base and detection model through a feature feedback channel: when illegal item trading behavior injected via third-party interfaces is detected, a new purple coding layer is dynamically added to represent such events, forming a hybrid feature expression on the original graph using a semi-transparent overlay method; the incremental learning module freezes the original convolution kernel parameters during model updates, training only on the newly added feature dimensions to ensure that historical detection capabilities are not affected. Addressing the frequent changes in attack patterns by cheat developers, the system introduces an adversarial example generator to simulate the variation patterns of cheat features (such as random perturbation event intervals and added noise events) to enhance the model's robustness. A multi-level response strategy dynamically adjusts the handling plan based on the threat level: accounts with detected known script characteristics are banned in real time; suspicious accounts with new characteristics undergo manual review, while continuously tracking the group behavior patterns of their associated accounts; and low-risk abnormal accounts have their data collection frequency reduced to optimize system load. Through the closed-loop operation of the above process, the system develops an evolutionary detection capability in continuous confrontation: the dynamic expansion of spatiotemporal coding rules solves the problem of feature solidification in traditional methods; the collaborative decision mechanism of the dual-channel model breaks through the accuracy bottleneck of a single detection dimension; the combination of group feature mining and incremental learning effectively curbs the spread of cheat variants, and finally builds an intelligent security protection system that adapts to the complex game ecosystem.

[0055] Implementation Method 1: Collaboration Mechanism of Dynamic Weight Allocation Module

[0056] In daily game operations, the dynamic weight allocation module intelligently adjusts detection strategies through a spatiotemporal coupling analysis unit. Taking cheat detection in a massively multiplayer online role-playing game (MMORPG) as an example, during game events (such as weekend dungeon opening times), the system automatically retrieves historical data from the time-period feature vector library to identify the spatiotemporal distribution characteristics of high-incidence script cheats during that time period (such as dense timed task triggers), and increases the baseline value of the enhanced detection channel's weight to strengthen sensitivity to periodic features. When a player is detected in the resource settlement phase (such as the guild war reward distribution period), the module obtains context information through the game status interface and sets an upper limit threshold for the increase in the weight of periodic features (such as not exceeding 30% of the baseline value) to prevent high-frequency clicks by normal players when receiving rewards from being mistakenly judged as script operations. This also addresses anomalies caused by new types of speed-changing cheats. Spatial distribution (e.g., skill release events appear as discontinuous high-density rectangular arrangements in the behavior graph) is assessed by the spatial density perception adjustment unit through gridded block calculation (dividing the 300×288 pixel graph into 10×10 grids). When the event density within a certain grid cell exceeds a critical value and the shape factor conforms to rectangular characteristics, the weight of the enhanced channel is automatically increased to a dominant position (≥70%), ensuring timely capture of cheating features. The spatiotemporal coupling decay function dynamically adjusts parameters based on real-time stress test data from competitive battle scenarios. For example, during peak PVP (player versus player) battles, the time decay coefficient β is set to 0.05 to extend the influence duration of periodic features, while in social interaction scenarios it is adjusted to 0.02 to reduce false trigger rates. This mechanism significantly improves detection accuracy in actual combat. For instance, after a version update, a variant of the gold farming script appeared, whose operation interval changed from a fixed 300 seconds to a random fluctuation of 250-350 seconds. The system automatically reduced the weight of the time dimension through spatiotemporal coupling analysis while enhancing the weight of spatial density detection, successfully capturing the variant sample within 24 hours.

[0057] Implementation Method 2: Timing Compression Compensation Mechanism

[0058] In the scenario of detecting AFK scripts in open-world games, the temporal compression compensation mechanism demonstrates unique value. When a player character is in an AFK state for a long time (such as during automatic resource gathering), large black areas of inactivity appear in the behavior graph. Traditional encoding methods dilute key events (such as suddenly triggered combat actions). This solution uses a non-linear timeline compression algorithm to automatically enable dynamic timeline scaling when continuous inactivity events exceed 50 seconds: compressing the pixel rows of the inactivity period to 1 / 5 of the original length, while expanding the time window of subsequent key events (such as skill combos when encountering enemy players) to 3 times the resolution. For example, if a studio account continuously mines from 3 AM to 5 AM, only triggering item trading operations on the hour, the compression mechanism compresses the 180-minute inactivity period in the 2-hour behavior data into 36 rows of pixels, while expanding the hourly time window of the trading event into 6 high-resolution rows of pixels, allowing the YOLOv8 model to clearly identify precisely hourly triggered clusters of trading operations (presented as vertically aligned yellow rectangular bands). This approach is particularly important in anti-cheat measures for sandbox games. In one real-world case, a compression mechanism amplified the short-duration bursts of stealth cheats (such as triggering the stealth skill 10 times in 0.5 seconds), creating distinct bright stripes in the behavior graph. This helped the monitoring and detection channel identify suspicious samples in the first round of screening, completing feature locking earlier than traditional methods.

[0059] Implementation Method 3: Adversarial Incremental Training Module

[0060] To counter adversarial attacks launched by cheat developers against the detection model, this solution's adversarial incremental training module constructs a robust feature isolation barrier. When the system discovers a new type of phishing cheat (such as an information hijacking script disguised as a normal transaction) through group anomaly detection, the incremental training process is initiated: First, 5% of the data is randomly sampled from the normal sample library, and perturbation samples are generated by adding Gaussian noise (σ=0.1) and time axis jitter (±3 seconds offset), which are then mixed with the new abnormal samples at a ratio of 4:1 and input into the training set. During model optimization, the adversarial loss function simultaneously constrains the cosine similarity (threshold ≥0.85) and classification boundary distance (≥0.3 feature space units) of the old and new feature spaces, ensuring that the newly added phishing cheat identification dimensions (such as the abnormal hue flashing pattern of the transaction confirmation box) do not encroach on the original feature space. In a real-world deployment, this mechanism successfully defended against gradient attacks targeting the detection model: when cheating groups attempted to deceive by fine-tuning the operation interval parameters (making the periodic features of the behavior graph closer to the fluctuations of normal player behavior), the integrity of the original feature space preserved by the adversarial training allowed the model to still accurately identify variant samples through color distribution gradient anomalies (the red transaction confirmation color block of the new cheat had a 0.5% hue shift), while the traditional full-update model had a very low recognition rate under such attacks.

[0061] Implementation Method 4: Multi-layer Cascaded Verification Architecture

[0062] In cross-server battlefield collaborative cheat detection scenarios, a multi-layered cascaded verification architecture effectively solves the challenge of identifying complex cheating behaviors. In the first-layer convolutional feature matching stage, the system calculates the SSIM (structural similarity index) between the behavior graph of suspicious groups and known cheating patterns, filtering out candidate groups with a similarity > 0.6. In the second-layer graph neural network analysis stage, an account association topology graph is constructed (nodes represent accounts, and edge weights integrate indicators such as device fingerprint overlap, IP geographical proximity, and transaction network density). The GraphSAGE algorithm is used to extract subgraph features, identifying three hidden association clusters (containing 12, 8, and 5 accounts respectively). In the final semantic verification stage, combined with battlefield log analysis: the first association cluster of accounts exhibits abnormal synchronous movement during the stronghold capture phase (position update error < 0.5 meters per second), but its operations conform to the battlefield advancement strategy, indicating it is a high-level player team; the second association cluster of accounts exhibits regular movement along the inverse map optimal path during the resource collection phase, and the standard deviation of collection time is < 50ms, indicating it is an automated script based on game scene rules. The false positive rate is lower than that of traditional single-layer detection. The novel collaborative plug-in mode (which circumvents device detection by alternating logins) was discovered and injected into the feature library, becoming an important basis for subsequent detection.

[0063] Implementation Method 5: Dynamic Hue Expansion Mechanism

[0064] When a new type of wallhack exploiting a game engine vulnerability is detected, the dynamic hue expansion mechanism responds quickly. This type of cheat triggers reconnaissance commands in non-visual areas, a behavior that traditional coding systems cannot characterize. The system automatically adds a semi-transparent purple auxiliary layer (60% transparency) on top of the base hue layer, mapping the wallhack commands as purple spots of varying shades (color depth is positively correlated with command trigger frequency). In the behavior graph, normal players' reconnaissance events are randomly distributed, while wallhacks form dense purple clusters in specific coordinate areas (such as behind walls). In a real-world test, this mechanism completed feature adaptation within 8 hours: the first sample detected an unknown coordinate location event cluster, and the feature library automatically allocated a backup hue channel; after three rounds of incremental training, the newly added purple feature layer successfully identified 12 variant wallhacks, including advanced versions using time-delayed triggering and regional segmentation scanning. The semi-transparent overlay design ensures that historical detection capabilities are not interfered with, and the original script detection model achieves high accuracy in recognizing traditional gold-farming scripts after the introduction of the new hue layer.

[0065] Implementation Method Six: Enhanced Detection Channel Trigger Logic

[0066] In the detection of fake popularity and inflated metrics in social games, the intelligent triggering mechanism of the enhanced detection channel plays a crucial role. When the compliance probability output by the monitoring channel of a live streaming account drops to 0.35 (threshold set at 0.4), the enhanced detection channel is automatically activated: the YOLOv8 model performs a full scan of the behavioral graph, discovering that gift-giving events exhibit equally spaced red vertical stripes at the boundaries every 5 minutes (corresponding to the script characteristics of timed gift sending), immediately raising the anomaly confidence score from 0.6 to 0.89, triggering a high-risk response. Simultaneously, the system performs a secondary verification based on the game phase context (normal gift-giving frequency should be <10 times / minute during non-activity periods). In an application on a virtual idol live streaming platform, this mechanism increased the recall rate of inflated metrics detection to 93.5%, while ensuring a false ban rate of <0.03% for legitimate users. For variant inflated metrics scripts (using a mixed mode of random intervals and fixed periods), the enhanced channel analyzes spectral characteristics through Fourier transform, identifying the hidden fundamental frequency period when the monitoring channel probability value is 0.38, providing an early warning 14 minutes earlier than traditional single-channel detection.

[0067] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A method for detecting abnormal game behavior based on spatiotemporal feature fusion, characterized in that, The method includes the following steps: Behavioral data visualization encoding: Collect user operation time sequence data, and perform color mapping encoding according to event type. Basic operation events, core interaction events, numerical change events and no operation events are mapped to different colors respectively. Among them, numerical events use gradient colors to represent the intensity of change. Based on a preset time unit, time series data is divided into row vectors. A two-dimensional behavior map is generated by stacking multiple rows. The horizontal dimension represents the continuity of time, and the vertical dimension reflects the periodic regularity of behavior, forming a visual data carrier containing spatiotemporal features. Dual-channel detection model construction: A two-layer architecture of supervised detection channel and enhanced detection channel is constructed. The supervised detection channel uses a deep convolutional neural network to extract spatial features of the graph and connects to an interpretable classifier to output the compliance probability of behavior. The enhanced detection channel identifies periodic distribution features in the graph based on the target detection framework to capture mechanical behavior patterns. The initial model is generated by training with historical positive and negative samples and the dual-channel parallel detection logic is established. Real-time anomaly detection and tracking: Real-time behavioral data is encoded into a standard graph and input into a dual-channel model. The compliance probability of behavior is calculated through the supervision channel and combined with the regularity feature identification results of the enhancement channel to generate an anomaly confidence score. Based on the score threshold, a multi-level response mechanism is triggered to intercept high-risk accounts in real time and retain their behavioral trajectories. At the same time, suspicious samples are injected into the anomaly feature database. Group anomaly pattern mining: Based on the anomaly feature library, an adaptive density clustering algorithm is used to identify group behavior patterns with similar spatiotemporal characteristics. The clustering results are then graded and verified using expert rules to extract script features, collaboration features, and novel variant features. The verified feature parameters are then back-injected into the detection model to expand the dimensions of anomaly identification. Closed-loop self-optimization system: Establishes a dynamic coding rule update mechanism, adds a new hue layer to represent new abnormal behaviors and supports semi-transparent overlay and fusion, constructs incremental learning trigger conditions, and automatically optimizes model parameters to be compatible with new and old features when new anomalies accumulate to a set scale. At the same time, it constructs a three-level early warning strategy based on the danger level of the anomaly mode, and implements differentiated handling solutions for real-time blocking, manual review and continuous tracking respectively.

2. The game behavior anomaly detection method based on spatiotemporal feature fusion as described in claim 1, characterized in that: The collaborative mechanism between the supervisory detection channel and the enhanced detection channel includes a dynamic weight allocation module, which automatically adjusts the fusion weight of the dual-channel output results according to the spatiotemporal distribution characteristics of the real-time behavior map. The proportion of periodic feature recognition results increases exponentially with the length of the detection period.

3. The method according to claim 2, characterized in that, The dynamic weight allocation module includes a spatiotemporal coupling analysis unit, which is specifically designed with the following adjustment mechanism for the characteristics of game behavior data: Time Segment Sensitive Adjustment: Divide time segments according to the game operation cycle, establish a time segment feature vector library, and when a time segment is detected to enter a specific segment in real time, automatically match the corresponding historical spatiotemporal distribution pattern and dynamically adjust the dual-channel weight baseline value. Spatial density perception adjustment: The behavior map is divided into grid blocks, and the spatial distribution dispersion index of event clusters is calculated. When the event distribution in the grid cell shows a high-density rectangular arrangement feature, the weight enhancement mechanism of the enhanced detection channel is triggered. Spatiotemporal coupling attenuation factor: Construct a dynamic weight update function that adaptively configures the settings based on the game scene type analyzed in real time; Game phase context adaptation: By accessing the game status interface to obtain the current phase of the player, an upper limit threshold is set for the weight increase of periodic features during the resource settlement period to avoid misjudging normal high-frequency operations.

4. The game behavior anomaly detection method based on spatiotemporal feature fusion as described in claim 1, characterized in that: The behavior map generation process includes a temporal compression compensation mechanism. When a series of no-operation events are detected, a nonlinear time axis compression algorithm is automatically activated to amplify the temporal resolution of key behavior events while maintaining the total pixel dimension.

5. The game behavior anomaly detection method based on spatiotemporal feature fusion as described in claim 1, characterized in that: The closed-loop self-optimization system includes an adversarial incremental training module, which synchronously injects normal samples that have undergone perturbation during the model parameter optimization stage. The adversarial loss function constraint ensures that the ability to identify newly added abnormal features does not affect the judgment accuracy of the original samples.

6. The game behavior anomaly detection method based on spatiotemporal feature fusion as described in claim 1, characterized in that: The expert rule verification process adopts a multi-layered cascaded verification architecture. The first layer filters potential abnormal groups through convolutional feature similarity. The second layer uses graph neural networks to analyze the relationship topology between accounts. The final layer combines the semantics of the game scene context to verify the rationality of abnormal patterns.

7. The game behavior anomaly detection method based on spatiotemporal feature fusion as described in claim 1, characterized in that: The hue mapping encoding includes a dynamic expansion mechanism. When a new abnormal behavior feature is detected, an auxiliary hue layer is added while retaining the basic color system, and the multi-dimensional behavior feature is fused and represented by overlaying transparency.

8. The game behavior anomaly detection method based on spatiotemporal feature fusion as described in claim 1, characterized in that: The triggering logic of the enhanced detection channel is set as follows: it is automatically activated when the compliance probability of the behavior output by the supervision channel is lower than the first threshold, and the danger level of the abnormal confidence score is increased synchronously after periodic distribution characteristics are detected.

Images