Plug-in behavior identification method and device based on large model, electronic equipment, readable storage medium and computer program product

Abstract

The invention relates to a plug-in behavior recognition method based on a large model. The method comprises the steps that operation time sequence data of a target player in a game scene are collected in real time; extracting physical characteristic indexes of the operation time sequence data through a pre-trained large model; and performing dynamic threshold judgment, comparing the physical characteristic indexes with a human behavior baseline library, and when any index continuously deviates from a human reference range, generating a plug-in behavior mark. Human operation characteristics are dynamically learned through a large model, high-precision single-account plug-in identification is realized, dependence on a rule base and account tracking can be reduced, plug-in analysis and positioning can be accurately and timely completed only by relying on user operation data, plug-in positioning efficiency is greatly improved, and the error sealing rate is effectively reduced.

Description

Technical Field

[0001] The present application relates to the field of plug-in identification, and specifically, to a method, device, electronic device, readable storage medium and computer program product for plug-in behavior identification based on a large model. Background Art

[0002] The gaming industry currently faces a severe challenge from the widespread proliferation of cheat programs. Cheating methods include data tampering, automated operations, and cross-platform attacks. These have led to a significant increase in player churn, severe losses in annual revenue for game developers, and the risk of user privacy breaches. According to industry statistics, the average number of cheat attacks in popular competitive games reaches tens of millions per day, severely undermining fair competition.

[0003] Existing countermeasures have fundamental bottlenecks. Rule-based detection requires manual pre-definition of plug-in features, but the iteration cycle of plug-in variants is short, and the update of the rule base is delayed, resulting in coverage that cannot meet the needs; multi-account tracking technology can only identify studio group cheating, and has little effect on single-account plug-ins of the scattered type; hard-coded solutions such as memory scanning have a high false blocking rate problem, and the analysis of each new plug-in consumes a lot of human resources, and the operation and maintenance costs are growing exponentially.

[0004] Faced with the rapid and aggressive evolution of plug-ins, the market urgently needs an accurate and efficient plug-in identification method that can solve the above problems. Summary of the Invention

[0005] In order to solve the existing technical problems, the present application provides a method, device, electronic device, readable storage medium and computer program product for plug-in behavior recognition based on a large model.

[0006] In a first aspect, the present application provides a method for identifying cheating behaviors based on a large model, the method steps specifically including:

[0007] Real-time collection of target players' operation timing data in the game scene;

[0008] Extract physical feature indicators of operation time series data through pre-trained large models;

[0009] Perform dynamic threshold judgment and compare physical feature indicators with the human behavior baseline library. When any indicator continuously deviates from the human baseline range, a cheating behavior mark is generated.

[0010] Optionally, the operation timing data includes mouse movement trajectory, interaction event timestamps, and character coordinate sequence.

[0011] Optionally, the physical characteristic indicators include the degree of fluctuation of mouse movement acceleration, the randomness of intervals between consecutive operation events, and the ratio of actual path movement time to theoretical shortest path time.

[0012] Optionally, the physical characteristic indicators also include character turning angle correction frequency and resource acquisition rate fluctuation variance.

[0013] Optionally, an adversarial training step is further included:

[0014] Responding to a surge in hacking samples or an increase in the model's misjudgment rate;

[0015] Generate variant training data containing artificial operation noise based on newly added cheat samples;

[0016] Incremental training of large models based on newly added plug-in samples;

[0017] Silently deploy the updated large model.

[0018] Optionally, dynamic threshold determination relies only on single-account operation data, without the need to associate multiple account behaviors.

[0019] In a second aspect, an embodiment of the present application provides a device for identifying cheating behaviors based on a large model, including:

[0020] A data acquisition module configured to capture game operation timing data in real time;

[0021] A feature quantization module is configured to extract physical feature indicators of operation time series data through a pre-trained large model;

[0022] Dynamic judgment module: configured to compare physical feature indicators with the human baseline library and generate cheating behavior markers;

[0023] Adversarial training module: configured to perform variant data generation and weighted training in response to a surge in cheat samples.

[0024] In a third aspect, an embodiment of the present application provides an electronic device comprising a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and runnable on the processor. The transceiver, the memory, and the processor are connected via a bus. When the computer program is executed by the processor, the steps in the method for identifying plug-in behaviors based on a large model in any one of the first aspects are implemented.

[0025] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps in the method for identifying plug-in behaviors based on a large model in any one of the first aspects.

[0026] In a fifth aspect, an embodiment of the present application provides a computer program product, including a computer program, which, when executed by a processor, implements the steps in the method for identifying plug-in behaviors based on a large model in any one of the first aspects.

[0027] This application uses a large model to dynamically learn human operation characteristics to achieve high-precision single-account plug-in identification, which can reduce dependence on rule bases and account tracking. It can accurately and timely complete plug-in analysis and positioning by relying solely on user operation data, greatly improving the efficiency of plug-in positioning and effectively reducing the false blocking rate. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the background technology, the drawings required for use in the embodiments of the present application or the background technology will be described below.

[0029] Figure 1 A flowchart of a method for identifying plug-in behaviors based on a large model provided in an embodiment of the present application is shown.

[0030] Figure 2 A flowchart of the adversarial training steps provided in an embodiment of the present application is shown.

[0031] Figure 3 A schematic diagram of the specific structure of a device for identifying plug-in behaviors based on a large model provided in an embodiment of the present application is shown.

[0032] Figure 4 A structural diagram of an electronic device is shown that provides a method for identifying plug-in behaviors based on a large model according to an embodiment of the present application.

[0033] The reference numerals in the figures represent:

[0034] 301: data acquisition module; 302: feature quantification module;

[0035] 303: dynamic judgment module; 304: adversarial training module;

[0036] 1110: bus; 1120: processor; 1130: transceiver;

[0037] 1140: bus interface; 1150: memory; 1160: user interface;

[0038] 1151: operating system; 1152: application program. DETAILED DESCRIPTION

[0039] In the description of the embodiments of the present invention, those skilled in the art should understand that the embodiments of the present invention can be implemented as methods, apparatuses, electronic devices, computer-readable storage media, and computer program products. Therefore, the embodiments of the present invention can be specifically implemented in the following forms: complete hardware, complete software (including firmware, resident software, microcode, etc.), or a combination of hardware and software. In addition, in some embodiments, the embodiments of the present invention can also be implemented in the form of a computer program product in one or more computer-readable storage media, wherein the computer-readable storage medium contains computer program code.

[0040] The above-mentioned computer-readable storage medium may adopt any combination of one or more computer-readable storage media. Computer-readable storage media include: electrical, magnetic, optical, electromagnetic, infrared or semiconductor systems, devices or components, or any combination thereof. More specific examples of computer-readable storage media include: portable computer disks, hard disks, random access memories (RAM), read-only memories (ROM), erasable programmable read-only memories (EPROM), flash memories (Flash Memory), optical fibers, compact disc read-only memories (CD-ROMs), optical storage devices, magnetic storage devices or any combination thereof. In an embodiment of the present invention, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, device, or component.

[0041] The computer program code contained in the computer-readable storage medium may be transmitted using any appropriate medium, including wireless, wire, optical cable, radio frequency (RF), or any suitable combination thereof.

[0042] The computer program code for performing the operations of the embodiments of the present invention can be written in assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, integrated circuit configuration data, or in one or more programming languages ​​or a combination thereof, wherein the programming language includes an object-oriented programming language, such as Java, Smalltalk, C++, and also includes a conventional procedural programming language, such as C language or a similar programming language. The computer program code can be executed entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, and entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer or to an external computer via any type of network, including a local area network (LAN) or a wide area network (WAN).

[0043] The embodiments of the present invention describe the provided methods, devices, and electronic devices through flowcharts and / or block diagrams.

[0044] It should be understood that each block in the flowchart and / or block diagram, as well as combinations of blocks in the flowchart and / or block diagram, can be implemented by computer-readable program instructions. These computer-readable program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine. These computer-readable program instructions are executed by the computer or other programmable data processing device to produce a device that implements the functions / operations specified in the blocks in the flowchart and / or block diagram.

[0045] These computer-readable program instructions may also be stored in a computer-readable storage medium that enables a computer or other programmable data processing device to operate in a specific manner. In this way, the instructions stored in the computer-readable storage medium produce an instruction device product that implements the functions / operations specified in the blocks in the flowchart and / or block diagram.

[0046] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device, so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby enabling the instructions executed on the computer or other programmable data processing apparatus to provide a process that implements the functions / operations specified by the blocks in the flowchart and / or block diagram.

[0047] The embodiments of the present invention are described below with reference to the accompanying drawings.

[0048] The digital entertainment industry is currently facing a systemic infestation of cheat programs, which undermine fairness rules through data tampering, programmed automated operations, and unauthorized visual penetration. This has directly led to a sharp increase in player churn, a significant reduction in manufacturer revenue, and the risk of user privacy leaks. Traditional countermeasures suffer from three structural flaws: First, the rule base relies on models that require manual pre-definition of cheat characteristics (such as operation frequency thresholds), but the rate of cheat variant iteration far exceeds the ability to update rules, resulting in a precipitous decline in recognition coverage; second, multi-account tracking technology can only identify organized cheating rings and is completely ineffective against the dominant single-account decentralized cheats; third, hard-coded detection mechanisms (such as memory scanning) have a high false positive rate, and the analysis of each new cheat requires a significant amount of manpower, creating a continuous resource black hole.

[0049] Figure 1 The flowchart of a method for identifying cheating behaviors based on a large model provided by an embodiment of the present invention is shown. Figure 1 As shown, the method includes the following steps:

[0050] Real-time collection of target players' operation timing data in the game scene;

[0051] Extract physical feature indicators of operation time series data through pre-trained large models;

[0052] Perform dynamic threshold judgment and compare physical feature indicators with the human behavior baseline library. When any indicator continuously deviates from the human baseline range, a cheating behavior mark is generated.

[0053] The principle behind the real-time collection of operation time series data is to capture the physical regularities of cheating behavior at the micro-operational level. Unlike traditional systems that only record discrete operation events, this step constructs a millisecond-level spatiotemporal matrix to simultaneously track the coordinate sequence of the operation trajectory, event timestamps, and environmental scene status. This high-resolution data collection can fully reproduce the unique mechanical regularities of cheating, such as absolutely uniform movement or periodic precise operation. Its core value lies in breaking through the technical difficulties of single-account identification—without relying on multi-account related data, the spatiotemporal continuity characteristics of a single user's operation sequence can expose non-physiological behavior patterns, laying the foundation for subsequent physical feature extraction. Actual deployments have shown that this step has achieved a breakthrough improvement in the signal-to-noise ratio of effective data.

[0054] The key innovation in extracting physical feature indicators using large models lies in converting the subjective "human sense of operation" into computable physical kinematic eigenvalues. The pre-trained large model uses a multi-level feature deconstruction engine: first, it filters out environmental noise such as network jitter, then extracts core indicators such as the acceleration fluctuation degree and path deviation rate of the operation trajectory, and finally generates a physical feature vector that can be quantified and compared. This step fundamentally overcomes the feature blind spots of traditional rule bases. For example, when a plug-in incorporates random jitter disguise, the model can still identify the underlying violation through fluctuation spectrum anomalies. Testing has proven that this capability has significantly increased the coverage of plug-in variant identification while significantly reducing the risk of misjudgment. This advantage stems from the model's ability to generalize and learn a vast amount of human physiological operation patterns.

[0055] The dynamic threshold judgment mechanism establishes a dual closed-loop feedback system to cope with the continuous evolution of attack and defense confrontation. In the horizontal dimension, the human behavior baseline library injects multiple sample operation data every week to ensure that it adapts to the natural drift of players' operating habits; in the vertical dimension, when a concentrated outbreak of specific plug-in characteristics is detected, the system automatically tightens the judgment tolerance of the corresponding indicator. The judgment process adopts a sliding window verification strategy, requiring the characteristic indicators to continuously deviate from the human baseline range before triggering an alarm, effectively avoiding misjudgments caused by instantaneous interference. This design enables the system to have the ability to self-evolve: when the plug-in iterates new camouflage methods (such as simulating the randomness of human operations), the model can complete threshold calibration and form countermeasures in a very short time. Compared with the long rule update cycle of traditional solutions, this step compresses the defense response speed to the level of magnitude difference while maintaining a misjudgment standard close to the industry's zero tolerance.

[0056] Three key steps form a self-enhancing defense system. High-precision spatiotemporal data provides raw material for feature engine analysis; physical indicators extracted from large models provide actionable evidence for dynamic judgments; and feedback from threshold determinations drives the continuous evolution of the model. This cycle overcomes the fatal flaws of traditional anti-cheating methods: upgrading from discrete event analysis to continuous behavior decoding, and from manual rule-based operation and maintenance to AI-powered autonomous countermeasures. Ultimately, it achieves order-of-magnitude breakthroughs in recognition coverage, response timeliness, and false positive control, building a sustainable security infrastructure for the digital ecosystem.

[0057] In some embodiments, the operation timing data optionally includes mouse movement trajectory, interaction event timestamp, and character coordinate sequence. The multi-dimensional coupling architecture of operation timing data constitutes the original foundation of behavior recognition, which constructs a three-dimensional dynamic matrix by synchronously capturing spatial displacement continuity (mouse movement trajectory), operation rhythm characteristics (interaction event timestamp), and environmental interaction state (character coordinate sequence). The mouse movement trajectory records the vector changes of cursor movement at a high sampling frequency, exposing non-physiological movement patterns (such as absolute linear movement or constant angular velocity steering); the interaction event timestamp accurately marks the millisecond intervals of operations such as key triggering and skill release, revealing the mechanical operation cycle law; the character coordinate sequence is bound to the topological structure of the game scene, and a spatial movement path map is constructed by tracking continuous coordinate points. The three work together to form a time-space-environment coupled behavior fingerprint, enabling the system to deconstruct the difference boundary between human operation and machine script from the essence of physical kinematics. When cheats attempt to mimic the randomness of human operation (such as by introducing jitter between clicks), the system can exploit dimensionality reduction by coupling trajectory, timing, and displacement anomalies. For example, fake random clicks struggle to synchronize ergonomic trajectory acceleration fluctuations with environmental path rationality, and three-dimensional feature conflicts expose flaws in the camouflage. Single-dimensional features can be affected by network latency or hardware performance, but cross-validation of three-source data significantly improves feature confidence. Trajectory anomalies must form a logical closed loop with displacement path anomalies and operation rhythm anomalies to trigger judgment, reducing the risk of misjudgment by orders of magnitude. The three-dimensional structure of the raw data provides rich associative learning material for the large model. By analyzing the temporal correlation between trajectory curvature changes and steering operations, the model can autonomously discover new cheat features (such as predictive path corrections for auto-aiming tools), breaking through the limitations of pre-defined features in traditional rule bases. This three-dimensional data architecture elevates discrete operation events to a continuous behavioral field for analysis, enabling the system to penetrate the superficial behavioral disguise of cheats and directly capture their kinetic nature, which violates physical laws. Compared with traditional single-point data collection solutions (such as only recording kill results), this design achieves a breakthrough improvement in recognition coverage, while providing atomic-level data support for adversarial evolutionary training.

[0058] In some embodiments, the physical characteristic indicators optionally include the degree of fluctuation in mouse movement acceleration, the randomness of the intervals between consecutive operation events, and the ratio of actual path movement time to the theoretical shortest path time. The construction of this physical characteristic indicator system focuses on the essential differences between human physiological constraints and machine behavior. The degree of fluctuation in mouse movement acceleration quantifies the dynamic characteristics of the operation trajectory. By calculating the amplitude of the velocity vector change per unit time, it captures the physical flaws caused by natural jitter caused by human hand muscle tremors and the absolute linear movement of cheat programs. The randomness of the intervals between consecutive operation events analyzes behavioral rhythm patterns. Based on the statistical distribution characteristics of the event timestamp sequence, it distinguishes the natural fluctuations of human neural reflex delays from the periodic regularity of the mechanical precision triggering of cheat programs. The ratio of actual path movement time to the theoretical shortest path time incorporates environmental context constraints and exposes teleportation cheats that violate the rules of physical space by comparing the player's actual movement time with the optimal path time determined by the map topology. These three indicators form an orthogonal feature space, constructing an unforgeable human operation fingerprint from the dimensions of kinematics, behavioral rhythms, and spatial rules. When cheat programs attempt to mimic human randomness (such as adding jitter to operation timing), the system achieves dimensionality reduction through multi-dimensional feature conflict detection. For example, fake random click intervals cannot simultaneously simulate ergonomic acceleration fluctuations and environmental path rationality. Physical and logical inconsistencies between the indicators will reveal the true nature of the fraud. A single feature is susceptible to interference from network latency or hardware anomalies, but the three indicators work together to form a cross-validation mechanism: a judgment is triggered only when abnormal acceleration fluctuations, abnormal operation rhythms, and abnormal path rationality form a coupled chain of evidence, reducing the risk of false positives by orders of magnitude. The physical intrinsics of the indicator system empower the model to continuously evolve. Even if a cheat modifies surface behavioral parameters (such as adjusting click frequency), the system can still identify core evidence of violations of fundamental physical laws (such as the absence of acceleration fluctuations) through kinematic feature spectrum analysis, providing unconfoundable learning samples for incremental training. This feature system quantifies the biomechanical constraints of human operation (muscle tremor, neural reflex delay) and the physical boundaries of environmental interaction (maximum movement speed) at the anatomical level, forming a computable "behavioral physiological" judgment benchmark. Compared with traditional feature design based on operation results (such as abnormal kill counts), this solution achieves a breakthrough improvement in recognition coverage and provides a physically explainable decision-making basis for the dynamic threshold system, laying the foundation for a self-evolving anti-cheating architecture.

[0059] In some embodiments, optionally, the physical feature indicators also include the character turning angle correction frequency and the resource acquisition rate fluctuation variance. The newly added physical feature indicators further enhance the multimodal behavior coupling analysis capability. The character turning angle correction frequency quantifies the micro-operation mode of viewing angle adjustment. By counting the number of slight adjustments of the viewing angle direction angle per unit time, it captures the dynamic feedback mechanism unique to the human hand-eye coordination system (such as continuous fine-tuning when aiming at a target) and the mechanical defects of the plug-in program's linear steering; the resource acquisition rate fluctuation variance analyzes the natural randomness of economic behavior. Based on the distribution characteristics of the resource acquisition interval time, it distinguishes between the player's rate fluctuation caused by environmental interference (such as terrain occlusion affecting operations) and the abnormal stability of the script program's constant efficiency. This group of indicators and the basic feature system form a closed loop of the behavioral chain, covering the three core game interaction dimensions of combat operation (turn correction), exploration movement (path time), and economic behavior (resource acquisition). When cheats simulate human behavior in a single dimension (such as adding random jitter to combat operations), the system uncovers flaws through cross-modal feature correlation analysis. For example, the randomness of fake combat operations cannot synchronously simulate the natural fluctuations of resource collection. This logical break in the behavioral chain triggers a complex cheating determination, completely blocking the infiltration path of hybrid cheats. The spectral characteristics of steering correction frequencies (such as high-frequency micro-corrections) provide early signals for predicting auto-aim cheats, while abnormal resource collection fluctuations can provide a seven-day advance warning of economic system cheating. This creates a two-tiered defense in depth, enabling identification nodes to trace back from the results to the initial stages of behavior. Combat-economic dual-dimensional indicators construct a holographic portrait of human operation. By visually comparing the differences between the player's behavioral spectrum (such as the steering correction frequency band distribution) and the cheat's characteristic spectrum, ban decisions are physically verifiable, significantly reducing the cost of appeal processing. This set of indicators fills two major gaps in behavioral recognition: micro-operation feedback and the interaction between the economic system, upgrading the feature system from analyzing isolated actions to monitoring the entire interactive chain. Compared with single-dimensional detection solutions, this design significantly shortens the life cycle of advanced plug-ins and provides the first set of quantifiable risk control standards for the security of the game's economic system, achieving dual protection of "combat fairness" and "economic ecological health."

[0060] In some embodiments, as Figure 2 As shown, optionally, the adversarial training step is further included:

[0061] Responding to a surge in hacking samples or an increase in the model's misjudgment rate;

[0062] Generate variant training data containing artificial operation noise based on newly added cheat samples;

[0063] Incremental training of large models based on newly added plug-in samples;

[0064] Silently deploy the updated large model.

[0065] The adversarial training mechanism builds the core engine of the adaptive defense closed loop. The intelligent trigger system continuously monitors the distribution of cheat samples and the trend of model misjudgment. When it detects a concentrated outbreak of new cheating behavior characteristics or a significant decline in decision confidence, it automatically activates the training process, forming a nerve center for attack and defense situation awareness. The variant data generator injects artificial operation noise into new cheat samples - simulating the trajectory disturbance of human hand tremors, the time jitter of neural reflex delays, and the path deviation caused by environmental interference - to generate adversarial samples that combine the essence of cheating with human appearance, greatly enhancing the model's feature decoupling capabilities. The incremental training module adopts a differentiated weight strategy for new and old samples, prioritizing the learning of camouflage and cracking features in variant data, while retaining basic cheating recognition capabilities through knowledge distillation technology, realizing the dynamic expansion of the model's cognitive boundaries. The silent deployment interface uses model hot replacement and traffic grayscale distribution technology to make the update process zero-perception to online players, ensuring the continuity of the gaming experience. When cheat developers release variant versions (such as modifying memory encryption algorithms), the system uses early feature surge detection to capture abnormal patterns before the threat spreads, generating targeted variant samples for interception training. This allows the defense response speed to exceed the cheat propagation speed, completely reversing the passive response disadvantage of traditional solutions. Physically plausible simulations of artificial noise (such as hand tremor spectrum restoration) force the model to penetrate the surface behavioral layer and directly learn the intrinsic characteristics of cheating. For example, after the auto-aim cheat adds random turn camouflage, the model can still correct the delay loss and lock the essential violation through microsecond-level perspective, causing the effective period of the cheat variant to show a cliff-like decline. Silent deployment technology combined with resource utilization optimization algorithms achieves zero interference of the model update process on core experience indicators such as game frame rate and network latency, eliminating negative experiences such as lag and disconnection caused by traditional anti-cheating solutions, and achieving a breakthrough improvement in player retention rate. This closed-loop mechanism transforms each cheat attack into nutrients for model evolution—new cheat samples, after being mutated, become training material for enhanced cognition, exponentially increasing the system's defense capabilities. Ultimately, this creates a self-reinforcing ecosystem where "the higher the attack intensity, the stronger the model's robustness." This mechanism breaks through the static defense paradigm of traditional security solutions. By transforming cheat defense into a continuous learning engine, it enables the autonomous evolution of the defense system for the first time. Compared to rule-based solutions that require downtime for maintenance, this design ensures business continuity while achieving a revolutionary increase in recognition coverage over time, building an intelligent security infrastructure that "gets stronger with use."

[0066] In some embodiments, dynamic threshold determinations can optionally rely solely on single-account operation data, eliminating the need to correlate multi-account behavior. This isolated single-account analysis mechanism transcends traditional anti-cheat reliance on group behavior correlations, achieving precise determinations by deeply mining the physical intrinsics of individual operation data. The system establishes a personalized behavioral baseline based on the target player's own operation history, comparing the deviation of their current physical characteristic indicators (such as mouse acceleration fluctuation spectrum and path selection pattern) against the historical baseline in real time. This design essentially transforms the determination of "human-likeness" into a dual verification of individual behavioral consistency and compliance with physical laws. Even if a player's operating habits deviate from the general average (e.g., unusual reaction speed), as long as their current operating pattern aligns with their historical behavioral characteristics and meets physical constraints (e.g., acceleration fluctuations do not approach zero), they will still be judged as normal behavior. This recognition paradigm based on individual operation fingerprints completely breaks away from the computational framework of cross-account data comparison. This solution eliminates privacy compliance risks by eliminating the need to collect or analyze other players' data, completely circumventing compliance concerns regarding user behavior correlation analysis in regulations such as GDPR, significantly reducing barriers to global market deployment. It also eliminates blind spots in decentralized cheat protection, providing comprehensive coverage for "lone wolf" cheats (single-account cheating), which account for the majority of attacks, filling a significant protection gap left by traditional solutions that rely on group behavior. It also improves compatibility with high-level player behavior, eliminating the misclassification of professional players' unconventional operating patterns (such as ultra-high click rates) due to deviations from the general public. The system learns their unique behavioral characteristics through historical baselines, achieving a significant improvement in competitive fairness and compatibility with the high-level player experience. It also optimizes real-time computing performance by eliminating heavy computational steps such as cross-account data synchronization and behavioral correlation graph construction. This reduces single-account judgment latency by orders of magnitude, meeting the millisecond-level response requirements for millions of concurrent users. This mechanism restructures the underlying logic of behavior recognition, shifting from "relative normality" based on group comparison to "absolute normality" based on physical characteristics. Just like using DNA matching to replace physical recognition, even if a cheater deliberately mimics the behavior of a normal player, the inherent physical violations of their actions (such as the zero-acceleration steady state of mouse movement) and the sudden break from their individual historical patterns will still reveal evidence of a violation. This not only achieves a breakthrough in recognition accuracy, but also achieves a generational leap in privacy protection, computing efficiency, and high-level player compatibility, setting a new technological benchmark for gaming security.

[0067] In some embodiments, as Figure 3 As shown, the embodiment of the present application provides a device for identifying plug-in behaviors based on a large model, including:

[0068] The data acquisition module 301 is configured to capture game operation timing data in real time;

[0069] The feature quantification module 302 is configured to extract physical feature indicators of the operation time series data through a pre-trained large model;

[0070] Dynamic decision module 303: configured to compare the physical feature indicators with the human baseline library and generate a cheating behavior marker;

[0071] Adversarial training module 304: configured to perform variant data generation and weighted training in response to a surge in cheat samples. The data acquisition module 301 captures the target player's high-dimensional operation flow (including mouse trajectory point sequences, millisecond-level timestamps of interactive events, and dynamic updates of character coordinates) in real time through the game engine interface, constructing a spatiotemporally coupled raw data matrix. The feature quantization module 302 uses a pre-trained large model to perform physical intrinsic deconstruction on the raw data. This involves calculating indicators such as the fluctuation spectrum of mouse movement acceleration, the random distribution entropy of operation intervals, and the path time rationality coefficient, generating a physical feature vector that can be quantified and compared. The dynamic judgment module 303 performs multi-dimensional deviation analysis on the feature vector against the human behavior baseline library. When acceleration fluctuations approach steady state (violating ergonomics) or path duration significantly falls below the physical lower limit, a cheating behavior flag is output and an alarm is triggered. The adversarial training module 304 monitors the distribution of cheat samples in real time. If a surge in specific cheating features or a decrease in judgment confidence is detected, the adversarial evolution engine is immediately activated. This generates variant samples injected with artificial operation noise and performs differential weight training on the new and old samples. Finally, the model parameters in the feature quantization module 302 are silently updated through the hot deployment interface, completing the dynamic defense capability upgrade. The millisecond-level capture capability of the data acquisition module 301 and the sliding window verification mechanism of the dynamic judgment module 303 work together to achieve a response time of seconds, which is two orders of magnitude more efficient than the manual review process of traditional anti-cheating solutions. The physical intrinsic deconstruction of the feature quantization module 302 (such as acceleration fluctuation spectrum analysis) penetrates the surface behavior layer. Even if the cheat adds random jitter disguise, it can still be locked through the inherent anomalies of kinematics. The variant sample generator of the adversarial training module 304 simulates the spectrum of human operation noise, allowing the model to continuously strengthen its learning ability for cheating intrinsics, forming a positive cycle of "higher attack intensity → stronger defense robustness." Model hot deployment technology ensures that the update process has zero interference with the game frame rate, solving the problem of lag, disconnection and other user experience damage caused by the resource occupation of the anti-cheating process in traditional solutions.

[0072] In addition, an embodiment of the present invention also provides an electronic device, including a bus, a transceiver, a memory, a processor, and a computer program stored in the memory and runnable on the processor. The transceiver, the memory, and the processor are respectively connected via a bus. When the computer program is executed by the processor, the various processes of the embodiment of the above-mentioned method for identifying plug-in behaviors based on a large model are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0073] For details, see Figure 4As shown, an embodiment of the present invention further provides an electronic device, which includes a bus 1110 , a processor 1120 , a transceiver 1130 , a bus interface 1140 , a memory 1150 and a user interface 1160 .

[0074] The transceiver 1130 is configured to receive and send data under the control of the processor 1120 .

[0075] In an embodiment of the present invention, a bus architecture (represented by bus 1110) may include any number of interconnected buses and bridges, and bus 1110 connects various circuits including one or more processors represented by processor 1120 and a memory represented by memory 1150.

[0076] Bus 1110 represents one or more of any of several types of bus structures, including a memory bus and memory controller, a peripheral bus, an Accelerated Graphical Port (AGP), a processor, or a local bus using any of a variety of bus architectures. By way of example and not limitation, such architectures include an Industry Standard Architecture (ISA) bus, a Micro Channel Architecture (MCA) bus, an Enhanced ISA (EISA) bus, a Video Electronics Standards Association (VESA), and a Peripheral Component Interconnect (PCI) bus.

[0077] The processor 1120 can be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above method embodiment can be completed by an integrated logic circuit of hardware in the processor or an instruction in the form of software. The above-mentioned processor includes: a general-purpose processor, a central processing unit (CPU), a network processor (NP), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), a complex programmable logic device (CPLD), a programmable logic array (PLA), a microcontroller unit (MCU) or other programmable logic devices, discrete gates, transistor logic devices, discrete hardware components. The various methods, steps and logic block diagrams disclosed in the embodiments of the present invention can be implemented or executed. For example, the processor can be a single-core processor or a multi-core processor, and the processor can be integrated into a single chip or located on multiple different chips.

[0078] The processor 1120 can be a microprocessor or any conventional processor. The method steps disclosed in conjunction with the embodiments of the present invention can be directly executed by a hardware decoding processor, or can be executed by a combination of hardware and software modules in the decoding processor. The software module can be located in a readable storage medium known in the art, such as a random access memory (RAM), a flash memory (Flash Memory), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), or a register. The readable storage medium is located in a memory, and the processor reads the information in the memory and performs the steps of the above method in conjunction with its hardware.

[0079] The bus 1110 may also connect various other circuits, such as peripheral devices, voltage regulators, or power management circuits. The bus interface 1140 provides an interface between the bus 1110 and the transceiver 1130. These are all well known in the art and are therefore not further described in this embodiment of the present invention.

[0080] The transceiver 1130 can be a single component or multiple components, such as multiple receivers and transmitters, providing a means for communicating with various other devices over a transmission medium. For example, the transceiver 1130 receives external data from other devices and transmits data processed by the processor 1120 to other devices. Depending on the nature of the computer system, a user interface 1160 may also be provided, such as a touch screen, physical keyboard, display, mouse, speaker, microphone, trackball, joystick, or stylus.

[0081] It should be understood that in an embodiment of the present invention, the memory 1150 may further include a memory remotely located relative to the processor 1120, and these remotely located memories may be connected to a server via a network. One or more parts of the aforementioned network may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless local area network (WLAN), a wide area network (WAN), a wireless wide area network (WWAN), a metropolitan area network (MAN), the Internet, a public switched telephone network (PSTN), a plain old telephone service network (POTS), a cellular telephone network, a wireless network, a wireless fidelity (Wi-Fi) network, or a combination of two or more of the aforementioned networks. For example, the cellular telephone network and the wireless network can be a Global System for Mobile Communications (GSM) system, a Code Division Multiple Access (CDMA) system, a Worldwide Interoperability for Microwave Access (WiMAX) system, a General Packet Radio Service (GPRS) system, a Wideband Code Division Multiple Access (WCDMA) system, a Long Term Evolution (LTE) system, an LTE Frequency Division Duplex (FDD) system, an LTE Time Division Duplex (TDD) system, an Advanced Long Term Evolution (LTE-A) system, a Universal Mobile Telecommunications (UMTS) system, an Enhanced Mobile Broadband (eMBB) system, a Massive Machine Type of Communication (mMTC) system, an Ultra Reliable Low Latency Communications (uRLLC) system, and the like.

[0082] It should be understood that the memory 1150 in the embodiment of the present invention may be a volatile memory or a non-volatile memory, or may include both volatile and non-volatile memories. Non-volatile memories include read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory.

[0083] Volatile memory may include random access memory (RAM), which is used as an external cache. By way of example and not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), and direct RAM bus random access memory (DRRAM). The memory 1150 of the electronic device described in the embodiments of the present invention includes, but is not limited to, the above and any other suitable types of memory.

[0084] In the embodiment of the present invention, the memory 1150 stores the following elements of the operating system 1151 and the application 1152: executable modules, data structures, or subsets thereof, or extended sets thereof.

[0085] Specifically, the operating system 1151 includes various system programs, such as a framework layer, a core library layer, and a driver layer, which are used to implement various basic services and process hardware-based tasks. The application 1152 includes various application programs, such as a media player and a browser, which are used to implement various application services. The program that implements the method of the embodiment of the present invention may be included in the application 1152. The application 1152 includes applets, objects, components, logic, data structures, and other computer system executable instructions that perform specific tasks or implement specific abstract data types.

[0086] In addition, an embodiment of the present invention also provides a computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the various processes of the above-mentioned method embodiment for plug-in behavior recognition based on a large model are implemented, and the same technical effect can be achieved. To avoid repetition, it will not be repeated here.

[0087] Computer-readable storage media include: transient and non-transient, permanent and non-permanent, removable and non-removable media, which are tangible devices that can retain and store instructions for use by instruction execution devices. Computer-readable storage media include: electronic storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, and any suitable combination of the above. Computer-readable storage media include: phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disc read-only memory (CD-ROM), digital versatile disc (DVD) or other optical storage, magnetic cassette storage, magnetic disk storage or other magnetic storage devices, memory sticks, mechanical encoding devices (such as punched cards or raised structures with grooves in which instructions are recorded), or any other non-transmission medium that can be used to store information that can be accessed by a computing device. As defined in the embodiments of the present invention, computer-readable storage media does not include temporary signals themselves, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (such as light pulses passing through fiber optic cables), or electrical signals transmitted through wires.

[0088] In the several embodiments provided in this application, it should be understood that the disclosed devices, electronic devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces, devices or units, or can be an electrical, mechanical or other form of connection.

[0089] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, and may be located in a single location or distributed across multiple network units. Some or all of these units may be selected based on actual needs to address the issues addressed by the embodiments of the present invention.

[0090] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0091] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiment of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a program product, which is stored in a storage medium and includes several instructions for causing a computer device (including: a personal computer, a server, a data center or other network device) to perform all or part of the steps of the method described in each embodiment of the present invention. The above-mentioned storage medium includes the various media that can store program codes as listed above.

[0092] In addition, an embodiment of the present invention provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the various processes of the above-mentioned method embodiment for plug-in behavior recognition based on a large model, and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0093] Example 1

[0094] Example of a large-scale model-based cheating behavior recognition system running

[0095] 1. Operational data capture phase

[0096] The data acquisition module captures player A's operation flow in real time, records the continuous coordinate point sequence of the mouse movement trajectory, marks the precise timestamps of interactive events such as shooting and jumping, and synchronously tracks the coordinate changes of the character in the game map.

[0097] 2. Physical feature quantification stage

[0098] The feature quantization module generates multi-dimensional feature vectors through pre-training large models, calculates the fluctuation spectrum of mouse movement acceleration (reflecting the natural shaking of hand operations), analyzes the random distribution characteristics of continuous shooting intervals (detecting mechanical periodic operations), compares the ratio of actual movement path time to the shortest time in map topology theory (identifying teleportation cheats), and expands the monitoring of the micro-correction frequency of the character's perspective turning (capturing non-human operations of the auto-aiming tool).

[0099] 3. Dynamic judgment stage

[0100] The dynamic judgment module performs triple verification, comparing the current feature vector with player A's historical behavior baseline (personalized adaptation), detecting whether the acceleration fluctuation is approaching a steady state (violating ergonomic principles), and verifying whether the path time ratio is significantly lower than the physically feasible threshold. When the above characteristics continue to deviate from the human baseline range, a cheating behavior flag is generated.

[0101] 4. Counter-evolution stage

[0102] When a surge in new perspective plug-in samples is detected, the adversarial training module generates variant samples injected with artificial hand shaking noise, performs incremental training with a new sample priority weight strategy, and updates the model parameters of the feature quantization module through silent hot deployment.

[0103] The above solution achieves accurate single-account identification. Even if player A acts alone, the mechanical features of his operation that violate the laws of physics (such as zero correction of the perspective turn) are still accurately captured; it achieves dynamic compatibility, and the high-frequency operations of professional player B are not misjudged because they are consistent with his personal historical baseline; it has real-time evolution capabilities, and the updated model penetrates the surface disturbance through acceleration spectrum analysis to disguise the random jitter added by variant plug-ins; it achieves a seamless protection experience, and the model update process does not cause game delays or freezes.

[0104] The above description is merely a specific implementation of the embodiments of the present invention, but the scope of protection of the embodiments of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the embodiments of the present invention should be included in the scope of protection of the embodiments of the present invention. Therefore, the scope of protection of the embodiments of the present invention should be based on the scope of protection of the claims.

Claims

1. A method for identifying cheating behaviors based on a large model, characterized in that: include: Real-time collection of target players' operation timing data in the game scene; Extracting physical characteristic indicators of the operation time series data through a pre-trained large model; Perform dynamic threshold determination and compare the physical feature indicators with the human behavior baseline library. When any indicator continuously deviates from the human baseline range, a cheating behavior mark is generated.

2. The method according to claim 1, characterized in that The operation timing data includes mouse movement trajectory, interaction event timestamp and character coordinate sequence.

3. The method according to claim 1 or 2, characterized in that The physical characteristic indicators include the fluctuation degree of mouse movement acceleration, the randomness of the interval between consecutive operation events, and the ratio of actual path movement time to theoretical shortest path time.

4. The method according to claim 3, characterized in that The physical characteristic indicators also include the character turning angle correction frequency and the resource acquisition rate fluctuation variance.

5. The method according to claim 4, characterized in that Further including adversarial training steps: Responding to a surge in hacking samples or an increase in the model's misjudgment rate; Generate variant training data containing artificial operation noise based on newly added cheat samples; Based on the newly added plug-in samples, incremental training is performed on the large model; The updated large model is deployed silently.

6. The method according to claim 1 or 5, characterized in that The dynamic threshold determination relies only on single-account operation data and does not require associating multiple account behaviors.

7. A device for identifying cheating behaviors based on a large model, characterized in that: include: A data acquisition module configured to capture game operation timing data in real time; A feature quantification module is configured to extract physical feature indicators of the operation time series data through a pre-trained large model; Dynamic judgment module: configured to compare the physical feature indicators with the human baseline library and generate a cheating behavior marker; Adversarial training module: configured to perform variant data generation and weighted training in response to a surge in cheat samples.

8. An electronic device, characterized in that: include: processor and memory; The memory stores a computer program, and when the program is executed by the processor, the method according to any one of claims 1 to 6 is implemented.

9. A computer-readable storage medium, characterized in that Storing computer instructions, when the instructions are executed by a processor, implements the method as described in any one of claims 1 to 6.

10. A computer program product, characterized in that Contains program code, which, when run on a computing device, executes the method described in any one of claims 1 to 6.

Images