Multi-dimensional evaluation system for game account abnormal login risk

Abstract

The application provides a multi-dimensional evaluation system for abnormal login risk of a game account, relates to the technical field of network security, and comprises a feature analysis module, which is used for extracting multi-dimensional features from access logs of the game account, including device behavior features, space-time features and access preference features, and performing category division on the device behavior features to generate probability distribution of normal devices and potential risk devices and output device risk probability.The application cooperates with a feature analysis module, an evaluation module, a risk index calculation module and a risk response module to accurately identify abnormal login risk from multiple dimensions, dynamically generate an account risk index, and then output a detailed report and trigger a hierarchical response strategy, so that the game account security is effectively ensured, the game fairness is maintained and the player experience is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a multi-dimensional assessment system for the risk of abnormal logins to game accounts. Background Technology

[0002] Traditional game account protection solutions mainly rely on static rule engines and single-dimensional detection, such as password strength, IP address blacklists, or fixed-frequency two-factor authentication mechanisms. However, they have shortcomings in dealing with new attack methods (such as credential stuffing attacks, distributed proxy logins, and device fingerprint forgery), specifically manifested in the following technical deficiencies:

[0003] Existing technologies often rely on independent indicators (such as login frequency and geographical jump distance) for risk assessment, lacking collaborative analysis of multi-dimensional data including device behavior patterns, user operating habits, and network environment. For example, abnormal devices logging in via proxy IPs may evade detection because they do not trigger a single frequency threshold.

[0004] Defense systems based on manually predefined rules (such as "block if the same IP logs in more than 5 times in a short period of time") are ill-suited to the rapidly evolving strategies of attackers. Attackers can exploit rule vulnerabilities (such as low-frequency distributed credential stuffing) to bypass detection, while frequent rule adjustments lead to a surge in operational costs.

[0005] Traditional solutions separate risk assessment from response measures. For example, they may only generate risk scores but not bind dynamic response logic, or they may use fixed actions (such as freezing all accounts). They lack the ability to make refined control that adapts to risk levels and scenario characteristics.

[0006] Risk data from a single gaming platform is isolated, making it impossible to identify coordinated attacks launched by the same attacker using accounts on multiple platforms (such as using leaked account information from platform A to attack platform B). Existing technologies lack cross-platform risk tag synchronization and joint handling mechanisms. Summary of the Invention

[0007] The technical problem this invention aims to solve is to provide a multi-dimensional assessment system for the risk of abnormal logins to game accounts, so as to achieve a balance between precise defense and user experience.

[0008] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows:

[0009] Firstly, a multi-dimensional assessment system for the risk of abnormal logins to game accounts includes:

[0010] The feature analysis module is used to extract multi-dimensional features from the access logs of game accounts, including device behavior features, spatiotemporal features, and access preference features. It also classifies the device behavior features, generates the probability distribution of normal devices and potentially risky devices, and outputs the device risk probability.

[0011] The evaluation module is used to construct a historical resource distribution vector by statistically analyzing the access frequency of each resource type in the user's historical access behavior, and to calculate a consistency score based on the current device's requested resource distribution vector in order to identify abnormal devices that deviate from the user's behavior pattern.

[0012] The risk index calculation module is used to dynamically fuse the device risk probability and consistency score using sensitive control factors to generate an account risk index;

[0013] The risk response module is used to generate a risk assessment report based on the account risk index, including risk level labels, a list of abnormal behavior characteristics and corresponding handling suggestions, and to trigger multi-level response strategies based on the risk assessment report.

[0014] Furthermore, multi-dimensional features are extracted from the game account access logs, including device behavior features, spatiotemporal features, and access preference features. Device behavior features are then categorized to generate probability distributions for normal devices and potentially risky devices, outputting the device risk probability, including:

[0015] Calculate the distance between all device feature vectors and divide the feature vectors into different groups according to a preset distance threshold;

[0016] The feature vectors within each group are analyzed to determine the central feature vector of each group, thus obtaining the pattern grouping results;

[0017] Based on the pattern grouping results, the correlation between the feature vector of each device and each pattern center is measured one by one to obtain a correlation list;

[0018] Based on the correlation list, determine the probability that the device belongs to the potential risk device;

[0019] The risk probability of all devices is statistically analyzed to generate a probability distribution model, and a risk probability value is assigned to each device based on the probability distribution model.

[0020] Furthermore, by statistically analyzing the access frequency of each resource type in users' historical access behavior, a historical resource distribution vector is constructed. Based on the current device's resource request distribution vector, a consistency score is calculated to identify abnormal devices that deviate from user behavior patterns, including:

[0021] For the resource requests initiated by the current device, the distribution of resource types in the requests is statistically analyzed, and a current resource distribution vector is generated;

[0022] A consistency score is derived by calculating the directional consistency between the historical distribution and the current distribution;

[0023] Set a consistency score threshold. If the consistency score of the current device is less than the threshold, the corresponding behavior is determined to deviate from the user's historical pattern.

[0024] The consistency score is dynamically adjusted based on the device risk probability to identify abnormal devices that deviate from user behavior patterns.

[0025] Furthermore, by calculating the directional consistency between the historical distribution and the current distribution, a consistency score is obtained, including:

[0026] By combining the historical distribution vector with the current distribution vector, and taking into account the difference between the historical frequency and the current frequency, a combined value for a single resource type is obtained.

[0027] The combined values ​​of each individual resource type are merged to determine the directional baseline value;

[0028] Determine the normalized value of the historical distribution based on the historical distribution vector; determine the normalized value of the current distribution based on the current distribution vector.

[0029] The final directional consistency score is obtained based on the directional baseline value, the historical distribution normalized value, and the current distribution normalized value.

[0030] Furthermore, by dynamically fusing the device risk probability and consistency score using sensitive adjustment factors, an account risk index is generated, including:

[0031] When the sensitive state control factor > 1, the fusion ratio of equipment risk probability and consistency score is dynamically adjusted to enhance the impact of risk probability and generate an enhanced risk index.

[0032] When the sensitive state control factor is <1, the fusion ratio of equipment risk probability and consistency score is dynamically adjusted to enhance the influence of consistency score and generate a conservative risk index.

[0033] When the sensitive state control factor = 1, the equipment risk probability and the consistency score are fused in equal proportions to generate a linear fused risk index.

[0034] The enhanced risk index, conservative risk index, and linear fusion risk index are mapped to the interval [0, 100] to obtain the standardized account risk index.

[0035] Furthermore, based on the account risk index, a risk assessment report is generated, including risk level labels, a list of abnormal behavior characteristics, and corresponding handling suggestions. A multi-level response strategy is triggered based on the risk assessment report, including:

[0036] Based on the risk level labels in the risk assessment report, formulate corresponding handling recommendations and determine the priority of the response strategy to be implemented for the current account;

[0037] According to the priority of the response strategy, the corresponding response strategy is executed. If the secondary verification fails or the risk continues to escalate during the execution process, the upgraded response strategy is automatically triggered.

[0038] Further, corresponding handling recommendations include:

[0039] Low risk, meaning the standardized account risk index is <0.4, a dynamic verification code is pushed to the user's bound device and the account is marked as low risk;

[0040] Medium risk, i.e., 0.4 ≤ Standardized account risk index < 0.7, restrict virtual asset trading permissions, generate alarm logs and notify the administrator;

[0041] High risk, i.e., standardized account risk index ≥ 0.7, will result in frozen account login privileges and the risk label being synchronized to associated social media platforms and risk control database.

[0042] Furthermore, the access logs of the game account include access time, device identifier, geographical location, network type, and accessed page tags.

[0043] In a second aspect, a computing device includes:

[0044] One or more processors;

[0045] A storage device for storing one or more programs that, when executed by one or more processors, enable the one or more processors to implement the system.

[0046] Thirdly, a computer-readable storage medium storing a program that, when executed by a processor, implements the system.

[0047] The above-described solution of the present invention has at least the following beneficial effects:

[0048] The feature analysis module extracts multi-dimensional features from game account access logs, covering device behavior, spatiotemporal factors, and access preferences, providing a comprehensive and detailed characterization of device and user behavior. By categorizing device behavior features and generating probability distributions, it can accurately identify potentially risky devices. The evaluation module calculates a consistency score by comparing historical and current resource access vectors, keenly detecting abnormal devices that deviate from user behavior patterns, improving the accuracy of abnormal login detection, and reducing false positives and false negatives. For example, it can promptly detect account logins or access to abnormal resources at abnormal times or using abnormal devices.

[0049] The risk index calculation module dynamically fuses device risk probability and consistency score using a sensitive adjustment factor to generate an account risk index. The fusion ratio can be flexibly adjusted based on different values ​​of the sensitive adjustment factor to adapt to different risk scenarios and business needs. During periods of high risk, the weight of risk probability is increased, focusing on potentially risky devices; during relatively safe periods, the focus is on consistency score to avoid over-misjudging normal behavior, making risk assessment more flexible and adaptable. The risk response module generates a detailed risk assessment report based on the account risk index, clearly defining the risk level, listing abnormal behavior characteristics, and providing corresponding handling suggestions. Simultaneously, it triggers multi-level response strategies, taking measures of varying intensities for different risk levels, such as secondary verification, temporary account freezing, and administrator alerts. This tiered response mechanism can effectively and promptly address account risks, reduce losses caused by risks, and protect game account security and player rights.

[0050] By promptly detecting and addressing abnormal login risks, we can effectively prevent game account theft, malicious resource farming, and other such behaviors, maintaining the fairness and normal operation of the game. This ensures a positive gaming experience for legitimate players, prevents player churn due to account security issues, and promotes the healthy development of the game. For example, it prevents cheaters from using stolen accounts to gain unfair advantages in the game, protecting the gaming experience of other players. Attached Figure Description

[0051] Figure 1 This is a schematic diagram of a multi-dimensional assessment system for the risk of abnormal login of game accounts provided in an embodiment of the present invention.

[0052] Figure 2 This is a flowchart illustrating the process of a multi-dimensional assessment system for abnormal login risks of game accounts provided by an embodiment of the present invention. The system constructs a historical resource distribution vector by statistically analyzing the access frequency of each resource type in the user's historical access behavior, and calculates a consistency score based on the current device request resource distribution vector, in order to identify abnormal devices that deviate from the user's behavior pattern. Detailed Implementation

[0053] Exemplary embodiments of the present disclosure will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0054] like Figure 1 As shown, embodiments of the present invention propose a multi-dimensional assessment system for the risk of abnormal logins to game accounts, including:

[0055] Feature analysis module 1 is used to extract multi-dimensional features from the access logs of game accounts, including device behavior features, spatiotemporal features, and access preference features. It also classifies the device behavior features, generates the probability distribution of normal devices and potentially risky devices, and outputs the device risk probability.

[0056] Evaluation module 2 is used to construct a historical resource distribution vector by statistically analyzing the access frequency of each resource type in the user's historical access behavior, and to calculate a consistency score based on the current device request resource distribution vector in order to identify abnormal devices that deviate from the user's behavior pattern.

[0057] Risk index calculation module 3 is used to dynamically fuse equipment risk probability and consistency score using sensitive control factors to generate account risk index;

[0058] Risk Response Module 4 is used to generate a risk assessment report based on the account risk index, including risk level labels, a list of abnormal behavior characteristics and corresponding handling suggestions, and to trigger multi-level response strategies based on the risk assessment report.

[0059] In this embodiment of the invention, comprehensive multi-dimensional feature extraction can comprehensively consider factors such as device behavior, spatiotemporal information, and access preferences, providing a rich data foundation for risk assessment and avoiding the one-sidedness of single-feature assessment. The generated probability distribution of normal and potentially risky devices helps to accurately identify risky devices, prevent abnormal login risks in advance, ensure the login security of game accounts, and improve players' sense of security and gaming experience.

[0060] Constructing vectors based on historical user access behavior and calculating consistency scores to identify anomalous devices is crucial for account security. Vectors built from historical behavior fully reflect user habits, and comparing them with the current device's resource request distribution vector allows for the detection of deviations in behavioral patterns. This method effectively identifies anomalous devices, promptly detects potential account theft or abnormal operations, reduces the risk of account misuse, and maintains the normal operation of the gaming platform and protects user rights.

[0061] By leveraging sensitive dynamic control factors to fuse device risk probability and consistency scores to generate an account risk index, flexibility and accuracy are enhanced in risk assessment. The fusion ratio is dynamically adjusted based on the sensitive dynamic control factors, allowing for flexible adjustments to the emphasis on risk probability and consistency scores in different scenarios, thus more accurately reflecting the actual risk status of the account.

[0062] Based on the account risk index, an assessment report is generated and a response strategy is triggered, providing comprehensive and effective measures to address account risks. Risk level labels allow players and administrators to quickly and intuitively understand the degree of risk; a detailed list of abnormal behavior characteristics displays risk details, facilitating the analysis of risk sources; and corresponding handling suggestions provide clear direction for resolving risks. The multi-level response strategy takes different measures according to the degree of risk, from secondary verification to temporary account freezing and administrator alerts, forming a complete risk response mechanism to minimize losses caused by account risks and protect game account security and player rights.

[0063] In a preferred embodiment of the present invention, multi-dimensional features, including device behavior features, spatiotemporal features, and access preference features, are extracted from the access logs of the game account. The device behavior features are then categorized to generate a probability distribution of normal devices and potentially risky devices, and the device risk probability is output. This can include:

[0064] Calculate the distance between all device feature vectors and divide the feature vectors into different groups according to a preset distance threshold;

[0065] The feature vectors within each group are analyzed to determine the central feature vector of each group, thus obtaining the pattern grouping results;

[0066] Based on the pattern grouping results, the correlation between the feature vector of each device and each pattern center is measured one by one to obtain a correlation list;

[0067] Based on the correlation list, determine the probability that the device belongs to the potential risk device;

[0068] The risk probability of all devices is statistically analyzed to generate a probability distribution model, and a risk probability value is assigned to each device based on the probability distribution model.

[0069] In this embodiment of the invention, device behavior characteristics (such as device operation frequency and operation sequence), spatiotemporal characteristics (such as login date, time, and location), and access preference characteristics (such as frequently played game modes and preferred item types) are obtained from the access logs of game accounts. These characteristics are combined to form a feature vector corresponding to each device. A method is used to measure the degree of difference between any two device feature vectors. For example, the numerical differences of the same feature items in two feature vectors are compared, and these differences are combined to obtain a value representing the distance between them. A distance threshold is pre-set. If the distance between two device feature vectors is less than or equal to this threshold, they are grouped into the same group. According to this rule, all device feature vectors are processed, and they are ultimately divided into different groups.

[0070] To measure the degree of difference between feature vectors of different devices, a method is used to calculate the "distance" between them. For each pair of device feature vectors, the feature values ​​in corresponding dimensions are compared, and a numerical value is obtained by combining the differences in each dimension. This numerical value represents the "distance" between the two device feature vectors. A "distance" threshold is preset. When the "distance" between two device feature vectors is less than or equal to this threshold, they are grouped into the same group. This process is repeated to compare all device feature vectors, eventually classifying them into different groups.

[0071] For all feature vectors within each group, calculate their average to obtain the central feature vector of that group. For example, for a group containing... indivual 3D feature vector The formula for calculating the central eigenvector c of a group is: The central feature vector of each group is used as the representative of that group to obtain the pattern grouping results. Each central feature vector represents a device behavior pattern. For each device's feature vector, it is compared with the feature vector of each pattern center. By comparing their feature values ​​in various dimensions, a value reflecting the degree of correlation between them is obtained; this value is the correlation degree. For each device, its correlation degree values ​​with all pattern centers are collected to form a list; this list is the correlation degree list.

[0072] A large amount of feature vector data from normal devices and known risky devices was collected. Data for normal devices was obtained from user devices that were stable and exhibited no abnormal behavior over a long period, while data for known risky devices came from devices that had previously been involved in account theft, malicious resource exploitation, or other violations. This data was analyzed, and different correlation thresholds were tested. The proportion of normal devices misclassified as risky devices (false positive rate) and the proportion of risky devices correctly identified (correct identification rate) were calculated at each threshold. A suitable threshold was chosen to minimize the false positive rate while maximizing the correct identification rate. For example, after multiple experiments, it was found that when the correlation threshold was set to 0.3, the false positive rate was 5% and the correct identification rate was 80%. This threshold performed well in balancing false positives and correct identification, and was therefore used as the final correlation threshold. For each device, a correlation list with each pattern center was obtained. Each correlation value in the list was compared with the set correlation threshold. The number of correlation values ​​below the threshold was counted. For example, if device A's correlation list is [0.1, 0.4, 0.2] and the correlation threshold is 0.3, then the number of correlation values ​​below the threshold is 2.

[0073] The probability that a device is a potential risk device is calculated based on the proportion of devices with low correlation to the total number of devices with low correlation. Assume there are a total of... There are 1 pattern center, and the number of low-associations is 1. The probability that the equipment is a potential risk equipment is... Formulas can be used Calculation. For device A, =3, =2, so = ≈0.67.

[0074] For all devices involved in the analysis, calculate the probability that they belong to potential risk devices using the method described above.

[0075] Suppose feature vectors for four devices are extracted from the game account access logs:

[0076] Device A: (3 logins, 8 PM login, frequently played level 3);

[0077] Device B: (4 logins, logged in at 9 PM, frequently played level 3);

[0078] Device C: (15 logins, logged in at 2 AM, 7 frequently played levels);

[0079] Device D: (16 logins, logged in at 3 AM, 7 frequently played levels);

[0080] The preset "distance" threshold is 5. After "distance" calculation, it was found that the "distance" between device A and device B is small, the "distance" between device C and device D is small, while the "distance" between device A (or B) and device C (or D) is large. Therefore, device A and device B are grouped into one group, and device C and device D are grouped into another group.

[0081] For a group containing device A and device B, the central feature vector is The central feature vector for the group containing devices C and D is ((15 + 16) ÷ 2 logins, (2 AM + 3 AM) ÷ 2 logins, frequently played level 3), which is (3.5 logins, 8:30 PM login, frequently played level 3).

[0082] Assume the correlation threshold is 3. Device A has a high correlation with the first group's central feature vector and a low correlation with the second group's central feature vector; Device C has a high correlation with the second group's central feature vector and a low correlation with the first group's central feature vector. The resulting correlation list for Device A is [high correlation value, low correlation value], and for Device C, it's [low correlation value, high correlation value]. Because Device A has a high correlation with the first group's central feature vector and a low correlation with the second group's central feature vector, but its overall correlation is good, it has a low probability of being a potentially risky device. Device C has a low correlation with the first group's central feature vector and a high correlation with the second group's central feature vector, and its overall behavior pattern differs significantly from devices A and B, so it has a high probability of being a potentially risky device.

[0083] By using multi-dimensional feature analysis and probability assessment, we can more accurately identify potentially risky devices associated with game accounts. For example, we can promptly detect devices whose operational behavior, login time, and preferences differ significantly from normal patterns, thus preventing account theft, cheating, and other problems caused by abnormal logins or operations.

[0084] After assigning specific risk probability values ​​to different devices, game operators can rationally allocate security resources based on the risk level. For devices with high risk probabilities, monitoring and verification measures can be strengthened, while for devices with low risk probabilities, monitoring resource investment can be appropriately reduced to improve resource utilization efficiency. Continuously updating and adjusting the probability distribution model as game operation and device behavior change enables dynamic prevention and control of game account risks. Timely detection of emerging risk patterns and trends allows for proactive preventative measures, ensuring the fairness and stability of the game. While ensuring game security, it avoids causing excessive and unnecessary interference to normal users. A smoother experience is provided for normal operation on low-risk devices, while necessary restrictions are imposed on high-risk devices, finding a balance between security and user experience.

[0085] In a preferred embodiment of the present invention, a historical resource distribution vector is constructed by statistically analyzing the access frequency of each resource type in the user's historical access behavior, and a consistency score is calculated based on the current device's requested resource distribution vector to identify abnormal devices that deviate from the user's behavior pattern. This may include:

[0086] For the resource requests initiated by the current device, the distribution of resource types in the requests is statistically analyzed, and a current resource distribution vector is generated;

[0087] A consistency score is derived by calculating the directional consistency between the historical distribution and the current distribution, and may include:

[0088] By combining the historical distribution vector with the current distribution vector, and taking into account the difference between the historical frequency and the current frequency, a combined value for a single resource type is obtained.

[0089] The combined values ​​of each individual resource type are merged to determine the directional baseline value;

[0090] Determine the normalized value of the historical distribution based on the historical distribution vector; determine the normalized value of the current distribution based on the current distribution vector.

[0091] The final directional consistency score is obtained based on the directional baseline value, the historical distribution normalized value, and the current distribution normalized value.

[0092] Set a consistency score threshold. If the consistency score of the current device is less than the threshold, the corresponding behavior is determined to deviate from the user's historical pattern.

[0093] The consistency score is dynamically adjusted based on the device risk probability to identify abnormal devices that deviate from user behavior patterns.

[0094] In this embodiment of the invention, all possible resource types in the game are clearly defined, such as game items (weapons, armor, magic potions, etc.), level scenarios (normal levels, elite levels, event levels), and virtual currency (gold coins, diamonds, etc.). Within a specific time period (e.g., the process from logging into the game to logging out), each resource request initiated by the current device is recorded, and the number of requests for each resource type is counted. Following a predefined order of resource types, the request counts for each resource type are combined into a vector, which is the current resource distribution vector. ,in Representing the The number of requests for each resource type This represents the total number of resource types. Data on user access to various resource types over a relatively long period (e.g., the past month) is collected, and the access frequency for each resource type is calculated to form a historical resource distribution vector. , here It is the first Historical access frequency for each resource type. Combining historical frequencies Current frequency And taking into account the differences between the two, while using weight parameters and attenuation parameters Calculate the combined value of a single resource type. in, Used to adjust the importance of different resource types in computation. This is used to control the degree of influence of the difference between historical and current frequencies. Assume the weighting coefficients and attenuation coefficients for different resource types are set as follows:

[0095] Regarding weapons resources, =0.8, =0.2;

[0096] Regarding armor resources =0.7, =0.3;

[0097] Regarding gold coin resources =0.9, =0.1;

[0098] Regarding diamond resources, =0.6, =0.4.

[0099] The directional baseline value is obtained by summing the combined values ​​of all single resource types. ,in, It is the base of the natural logarithm.

[0100] Through parameters and To adjust for the impact of historical distribution on the normalization process. Understood as the first The scaling factor of the squared historical frequency of a resource type determines the basic weight of that resource type in the historical distribution normalization. This is a coefficient used to make non-linear adjustments to the historical frequency, taking into account that the growth of historical frequency may have different effects on different resource types.

[0101] Set up different resource types and Values, for example:

[0102] Character Resources: =0.7, =0.1;

[0103] Item Resources: =0.6, =0.2;

[0104] Scene resources: =0.5, =0.3.

[0105] The formula for calculating the normalized value of the historical distribution is: .

[0106] Through parameters and (here) In the normalization of historical distribution (meaning is consistent) Used to adjust the weight of the square of the frequency of the th resource type in the current distribution. Specific values are set for different resource types, for example:

[0107] Character resources: = 0.8;

[0108] Prop resources: = 0.7;

[0109] Scene resources: = 0.6.

[0110] The calculation formula for the normalization value of the current distribution is .

[0111] Divide the direction reference value by the product of the normalization value of the historical distribution and the normalization value of the current distribution to obtain the final direction consistency score .

[0112] Based on a large amount of user behavior data and security requirements, set a suitable consistency score threshold . This threshold is an empirical value and can be determined by analyzing the behaviors of normal users and abnormal users.

[0113] Compare the consistency score calculated by the current device with the set threshold . If S < , it is determined that the current behavior of the device deviates from the user's historical pattern. Through methods such as the device feature analysis mentioned above, obtain the risk probability of the current device. According to the device risk probability <00003,02>dynamically adjust the consistency score threshold . If the device risk probability is high, appropriately lower the threshold , making it easier for the system to determine that the behavior of the device is abnormal; if the device risk probability is low, appropriately raise the threshold <00,00307>. Compare the adjusted threshold ′ with the consistency score of the current device again. If S < T′, it is determined that the device is an abnormal device deviating from the user behavior pattern.

[0114] Suppose a role-playing game includes various resource types, such as weapons, armor, magic scrolls, and gold. During a game login, a player initiates a series of resource requests using their current device. After analyzing these requests, a current resource distribution vector is obtained, reflecting the request frequency for various resources during this login. For example, the current resource distribution vector shows the frequency of requests for weapons, armor, magic scrolls, and gold. By reviewing the player's resource access data over a past period, a historical resource distribution vector is constructed. For each resource, such as weapons, the combined value for a single resource type is calculated by considering the historical access frequency and the current request frequency, taking into account their differences, and incorporating the resource's weight and attenuation parameter. Similarly, the same calculation is performed for armor, magic scrolls, gold, and other resources.

[0115] The directional baseline value is obtained by summing the combined values ​​of all resource types, which comprehensively reflects the combination of historical and current distributions across various resources. The historical and current distribution vectors are processed separately, and corresponding parameters are introduced to calculate the normalized values ​​of the historical and current distributions.

[0116] The final consistency score is obtained by dividing the directional baseline value by the product of the historical distribution normalization value and the current distribution normalization value. This score reflects the directional consistency between the current resource request distribution and the historical distribution. A pre-set consistency score threshold is used. The calculated consistency score is compared with this threshold. If the consistency score is lower than the threshold, it indicates that the current device's resource request behavior differs significantly from the player's historical behavior pattern. Given a certain probability of risk associated with the device, the consistency score threshold is dynamically adjusted based on this probability. If the adjusted threshold is higher than the current consistency score, the device is determined to be an abnormal device deviating from the user's behavior pattern.

[0117] By comprehensively considering both historical and current resource distributions and introducing multiple parameters (such as weights and decay parameters) to measure the differences between them, the consistency score calculation becomes more detailed and accurate. It can more precisely capture changes in user behavior patterns, thereby improving the accuracy of abnormal device identification. By dynamically adjusting the consistency score threshold and combining it with the device's risk probability, the sensitivity to abnormal behavior is further enhanced, reducing false positives and false negatives. It can dynamically adjust the criteria for judging abnormal behavior based on real-time comparisons of historical and current user behavior. As user gaming habits change, the historical resource distribution vector is constantly updated, yet it can still accurately determine whether current behavior is abnormal, demonstrating good adaptability.

[0118] Timely and accurate identification of abnormal devices can effectively prevent security risks such as game account theft and malicious resource exploitation. Taking appropriate security measures against abnormal devices, such as restricting resource access and requiring additional identity verification, ensures the fairness of the game and the security of user accounts. The system can accurately identify the normal behavior of legitimate users, avoiding unnecessary interference and guaranteeing their gaming experience. At the same time, it creates a safer and fairer gaming environment for other legitimate users.

[0119] In a preferred embodiment of the present invention, the dynamic fusion of device risk probability and consistency score using a sensitive state control factor to generate an account risk index may include:

[0120] When the sensitive state control factor > 1, the fusion ratio of equipment risk probability and consistency score is dynamically adjusted to enhance the impact of risk probability and generate an enhanced risk index.

[0121] When the sensitive state control factor is <1, the fusion ratio of equipment risk probability and consistency score is dynamically adjusted to enhance the influence of consistency score and generate a conservative risk index.

[0122] When the sensitive state control factor = 1, the equipment risk probability and the consistency score are fused in equal proportions to generate a linear fused risk index.

[0123] The enhanced risk index, conservative risk index, and linear fusion risk index are mapped to the interval [0, 100] to obtain the standardized account risk index.

[0124] In this embodiment of the invention, when the sensitivity adjustment factor > 1, it means that the current environment is more sensitive to risks, and more emphasis needs to be placed on considering the probability of device risks. Taking a certain game platform as an example, if the current network security situation is severe, the sensitivity adjustment factor is set to 2. At this time, to enhance the impact of risk probability, according to the formula... , Adjusting the fusion ratio yields the calculated risk probability weights. Consistency score weight Assuming an account has a device risk probability of 0.6 and a consistency score of 0.4, according to the formula... An enhanced risk index can be calculated. This reflects the dominant role of equipment risk probability in the risk index under high-risk environments.

[0125] When the sensitivity factor is less than 1, it indicates a relatively stable environment, and consistency scores are more important for risk assessment. For example, if a gaming platform is in a period of safe and stable operation, the sensitivity factor is set to 0.5. The weights are adjusted according to the formula. , If an account's device risk probability is 0.3 and its consistency score is 0.7, according to the formula... This yields a conservative risk index. This indicates that in a stable environment, consistency scores dominate risk assessment.

[0126] When the sensitive regulatory factor 1. Device risk probability and consistency score are equally important. Assume an account has a device risk probability of 0.5 and a consistency score of 0.6. According to the formula... The linear fusion risk index is calculated. This fusion method treats both factors equally in risk assessment and is suitable for situations where the risk situation is unclear or the two factors are of equal importance.

[0127] After obtaining the enhanced, conservative, and linearly converged risk indices, they need to be mapped to the [0, 100] interval for easier comparison and management. Assume the enhanced risk index ranges from [0.3, 0.7], the conservative risk index ranges from [0.2, 0.6], and the linearly converged risk index ranges from [0.4, 0.8]. The minimum value of all risk indices... =0.2, maximum value =0.8. This refers to an enhanced risk index for a specific account. This yields a standardized risk index. Through standardization, different types of risk indices have a unified standard, allowing game operators to determine risk levels, such as 0-30 for low risk, 31-70 for medium risk, and 71-100 for high risk, and then take corresponding measures.

[0128] By using sensitive adjustment factors, the fusion ratio of device risk probability and consistency score can be dynamically adjusted according to different business scenarios and risk conditions. During high-risk periods, enhancing the influence of device risk probability allows for more sensitive detection of potentially risky accounts; during low-risk periods, enhancing the influence of consistency score avoids misjudging account risk due to occasional fluctuations in device risk probability, improving the flexibility and adaptability of risk assessment. Combining information from both device risk probability and consistency score dimensions enables a more comprehensive and accurate assessment of account risk status. Device risk probability reflects the potential risk of the device itself, while consistency score reflects the stability of user behavior patterns. Integrating the two avoids the limitations of single-indicator assessment and improves the accuracy of risk assessment.

[0129] Standardizing different types of risk indices to the range [0, 100] makes the risk indices of all accounts comparable. This helps game operators develop unified risk management strategies, classify accounts according to their risk indices, and improve the efficiency and effectiveness of risk management. Standardized account risk indices can provide game operators with real-time, intuitive risk information, supporting dynamic decision-making. For example, for accounts with high risk indices, measures such as restricting logins and strengthening identity verification can be taken; for accounts with low risk indices, certain discounts or rewards can be given to improve user experience and loyalty.

[0130] In a preferred embodiment of the present invention, a risk assessment report is generated based on the account risk index, including risk level labels, a list of abnormal behavior characteristics, and corresponding handling suggestions. A multi-level response strategy is triggered based on the risk assessment report, which may include:

[0131] Based on the risk level labels in the risk assessment report, formulate corresponding handling recommendations and determine the priority of the response strategy to be implemented for the current account; the corresponding handling recommendations may include:

[0132] Low risk, meaning the standardized account risk index is <0.4, a dynamic verification code is pushed to the user's bound device and the account is marked as low risk;

[0133] Medium risk, i.e., 0.4 ≤ Standardized account risk index < 0.7, restrict virtual asset trading permissions, generate alarm logs and notify the administrator;

[0134] High risk, i.e., standardized account risk index ≥ 0.7, account login privileges are frozen, and risk tags are synchronized to associated social media platforms and risk control database;

[0135] According to the priority of the response strategy, the corresponding response strategy is executed. If the secondary verification fails or the risk continues to escalate during the execution process, the upgraded response strategy is automatically triggered.

[0136] In this embodiment of the invention, a standardized account risk index is obtained and judged based on a set risk level threshold. If the standardized account risk index is <0.4, it is judged as low risk; if it is between 0.4 (inclusive) and 0.7 (exclusive), it is judged as medium risk; if it is ≥0.7, it is judged as high risk. For low-risk accounts, the system automatically pushes a dynamic verification code to the user's bound device and marks the account as low-risk in the system. For medium-risk accounts, their virtual asset trading permissions are restricted, a detailed alarm log recording account anomalies is generated, and a notification is sent to the administrator. For high-risk accounts, the account login permissions are directly frozen, and the risk label is synchronized to the associated social platform and risk control database for multi-platform collaborative monitoring and risk prevention. The response strategy for high-risk accounts has the highest priority, followed by medium-risk accounts, and then low-risk accounts. The priority order determines the order in which response strategies are executed and the focus of resource allocation.

[0137] Based on the determined risk level and response strategy priority, the system automatically executes corresponding operations. For low-risk accounts, the dynamic verification code sending process is triggered, sending a verification code to the user's bound device; for medium-risk accounts, the virtual asset transaction permission restriction function is activated, and alarm logs are generated and administrator notifications are sent; for high-risk accounts, the account login permission freezing function is enabled, and risk tagging operations are executed simultaneously.

[0138] During the execution of the response strategy, the system monitors the account status in real time. For low-risk accounts, if the dynamic verification code entered by the user is incorrect (secondary verification fails), the account risk is reassessed. If the risk index rises to the medium-risk range after the assessment, the medium-risk response strategy is automatically triggered; if it rises to the high-risk range, the high-risk response strategy is directly triggered. For medium-risk accounts, if the risk continues to escalate, such as detecting abnormal transaction attempts after restricting virtual asset trading permissions, the high-risk response strategy is directly triggered.

[0139] Suppose that on an online gaming platform, player Xiaoming's account risk index is calculated to be 0.5, classifying it as medium risk. Upon determining Xiaoming's account to be medium risk, his virtual asset trading privileges are immediately restricted, preventing him from trading game items, in-game currency, and other virtual assets. Simultaneously, an alert log is generated, detailing Xiaoming's account's abnormal behavior, such as logins from different locations and unusual activity frequency, and a notification is sent to the game administrator. Even after restricting trading privileges, Xiaoming's account continues to frequently attempt virtual asset transactions. The system detects this and reassesses his risk index, finding it has risen to 0.8, reaching a high-risk level. At this point, a high-risk response strategy is automatically triggered, freezing Xiaoming's account login privileges, preventing him from logging into the game. Simultaneously, the system synchronizes Xiaoming's account risk tag to associated social media platforms and a risk control database, enabling the social media platforms to monitor Xiaoming's account activities and the risk control database to record the account's risk status.

[0140] By implementing targeted handling suggestions and response strategies for accounts with different risk levels, abnormal operations and risk spread can be effectively prevented. For example, freezing the login permissions of high-risk accounts can prevent account theft, restricting the transaction permissions of medium-risk accounts can protect the security of users' virtual assets, and dynamic verification code verification for low-risk accounts can increase login security. Generating alarm logs and notifying administrators facilitates the platform's timely detection and handling of abnormal accounts, maintaining the platform's normal operational order. Synchronizing risk tags with social media platforms and risk control databases enables multi-platform joint prevention and control, effectively reducing the impact of risk events on the platform. When users see that the platform has a comprehensive risk prevention and control mechanism, their trust in the platform increases. For example, when a user discovers that their account has abnormalities, the platform can promptly restrict risky operations and notify the user, making the user feel that their account security is taken seriously and protected. Real-time monitoring of risk changes and automatic upgrading of response strategies allow for flexible adjustment of prevention and control efforts based on the actual situation of the account, continuously optimizing the platform's risk prevention and control system and improving overall risk response capabilities.

[0141] In another preferred embodiment of the present invention, the access log of the game account includes access time, device identifier, geographical location, network type and access page tag.

[0142] In this embodiment of the invention, the time of each access is automatically recorded when the game client interacts with the server. The current time information is acquired at key points such as when a player logs into the game, performs in-game operations (e.g., enters a new level, opens the shop interface), or exits the game. This time information is accurate to the second and is organized according to a unified format, such as "year-month-day hour:minute:second," and then stored in the corresponding "access time" field of a database table specifically used for recording access logs.

[0143] For the player's device, its unique identification information is obtained. If the player is using a mobile device, the system will obtain identifiers such as the International Mobile Equipment Identity (IMEI), the Advertising Identifier (IDFA) for iOS, or the Advertising ID for Android. For PC devices, the system will obtain the network card's Media Access Control Address (MAC address) or the CPU's serial number. After obtaining these device identifiers, they will be recorded in the "Device Identifier" field of the access log database table. If player privacy is a concern, these identifiers will be encrypted before being recorded.

[0144] When the game server receives an access request from a player's account, it extracts the source IP address of the request. Then, using specialized IP address location technology, it converts this IP address into specific geographic location information, such as the country, city, and region. This location technology can utilize third-party IP location services, which analyze large amounts of data on the correspondence between IP addresses and geographic locations to achieve relatively accurate IP address-to-geographical location conversion. The obtained geographic location information is stored in the "Geographic Location" field of the access log database table for subsequent analysis of player login location distribution. This allows for timely detection of accounts logging in from abnormal geographic locations; for example, if a player account typically logs in from a city within China but suddenly logs in from an unfamiliar region abroad, there is a risk of account theft.

[0145] The game client detects the device's current network connection method in real time to determine the network type. If the device is using a Wi-Fi network, it identifies this as a Wi-Fi network type; if it's using a mobile data network, it further identifies the specific type, such as 4G or 5G. The identified network type information is sent to the server and stored in the "Network Type" field of the access log database table. This is crucial for analyzing differences in player behavior under different network environments, such as the frequency of player actions and latency under different network types. It can also determine whether certain abnormal behaviors are related to the network environment based on the network type.

[0146] During game development, specific tags are assigned to each accessible page within the game. These tags are used to mark the page's function or content category, such as the game's main interface, mission / level pages, and item shop pages. When a player visits a page, the game client automatically captures the page's tag information and sends it to the server along with other access log information (access time, device identifier, geographical location, network type). Upon receiving this information, the server stores the accessed page tag in the "Accessed Page Tag" field of the access log database table. By analyzing this tag information, game operators can understand player preferences, such as which pages players tend to visit and which pages they spend the most time on, thereby optimizing game content and the recommendation system.

[0147] Embodiments of the present invention also provide a computing device, including: a processor and a memory storing a computer program, wherein the computer program, when executed by the processor, performs the system as described above. All implementations in the above system embodiments are applicable to this embodiment and can achieve the same technical effects.

[0148] Embodiments of the present invention also provide a computer-readable storage medium storing instructions that, when executed on a computer, cause the computer to perform the system as described above. All implementations in the above system embodiments are applicable to this embodiment and can achieve the same technical effects.

[0149] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A multi-dimensional assessment system for the risk of abnormal logins to game accounts, characterized in that, include: The feature analysis module is used to extract multi-dimensional features from the access logs of game accounts, including device behavior features, spatiotemporal features, and access preference features. It combines the device behavior features, spatiotemporal features, and access preference features to form a feature vector corresponding to each device. It calculates the distance between all device feature vectors and divides the feature vectors into different groups according to a preset distance threshold, generates the probability distribution of normal devices and potentially risky devices, and outputs the device risk probability. The evaluation module is used to construct a historical resource distribution vector by statistically analyzing the access frequency of each resource type in the user's historical access behavior, and to calculate a consistency score based on the current device's requested resource distribution vector, so as to identify abnormal devices that deviate from the user's behavior pattern. The risk index calculation module dynamically fuses device risk probability and consistency score using a sensitive adjustment factor to generate an account risk index. When the sensitive adjustment factor is greater than 1, it indicates a more sensitive environment; the fusion ratio of device risk probability and consistency score is dynamically adjusted to enhance the impact of risk probability, generating an enhanced risk index. When the sensitive adjustment factor is less than 1, it indicates a relatively stable environment; consistency score is more important for risk assessment. The fusion ratio of device risk probability and consistency score is dynamically adjusted to enhance the impact of consistency score, generating a conservative risk index. When the sensitive adjustment factor is equal to 1, device risk probability and consistency score are equally important; they are fused in equal proportions to generate a linearly fused risk index. The enhanced risk index, conservative risk index, and linearly fused risk index are mapped to the interval [0, 100] to obtain a standardized account risk index. The risk response module is used to generate a risk assessment report based on the account risk index, including risk level labels, a list of abnormal behavior characteristics and corresponding handling suggestions, and to trigger multi-level response strategies based on the risk assessment report.

2. The multi-dimensional assessment system for the risk of abnormal login to game accounts according to claim 1, characterized in that, The feature vectors within each group are analyzed to determine the central feature vector of each group, thus obtaining the pattern grouping results; Based on the pattern grouping results, the correlation between the feature vector of each device and each pattern center is measured one by one to obtain a correlation list; Based on the correlation list, determine the probability that the device belongs to the potential risk device; The risk probability of all devices is statistically analyzed to generate a probability distribution model, and a risk probability value is assigned to each device based on the probability distribution model.

3. The multi-dimensional assessment system for the risk of abnormal login to game accounts according to claim 2, characterized in that, By statistically analyzing the access frequency of each resource type in users' historical access behavior, a historical resource distribution vector is constructed. Based on the current device's resource request distribution vector, a consistency score is calculated to identify abnormal devices that deviate from user behavior patterns, including: For the resource requests initiated by the current device, the distribution of resource types in the requests is statistically analyzed, and a current resource distribution vector is generated; A consistency score is derived by calculating the directional consistency between the historical distribution and the current distribution; Set a consistency score threshold. If the consistency score of the current device is less than the threshold, the corresponding behavior is determined to deviate from the user's historical pattern. The consistency score is dynamically adjusted based on the device risk probability to identify abnormal devices that deviate from user behavior patterns.

4. The multi-dimensional assessment system for the risk of abnormal login to game accounts according to claim 3, characterized in that, A consistency score is derived by calculating the directional consistency between the historical distribution and the current distribution, including: By combining the historical distribution vector with the current distribution vector, and taking into account the difference between the historical frequency and the current frequency, a combined value for a single resource type is obtained. The combined values ​​of each individual resource type are merged to determine the directional baseline value; Determine the normalized value of the historical distribution based on the historical distribution vector; determine the normalized value of the current distribution based on the current distribution vector. The final directional consistency score is obtained based on the directional baseline value, the historical distribution normalized value, and the current distribution normalized value.

5. The multi-dimensional assessment system for the risk of abnormal login to game accounts according to claim 4, characterized in that, Based on the account risk index, a risk assessment report is generated, including risk level labels, a list of abnormal behavior characteristics, and corresponding handling suggestions. A multi-level response strategy is triggered based on the risk assessment report, including: Based on the risk level labels in the risk assessment report, formulate corresponding handling recommendations and determine the priority of the response strategy to be implemented for the current account; According to the priority of the response strategy, the corresponding response strategy is executed. If the secondary verification fails or the risk continues to escalate during the execution process, the upgraded response strategy is automatically triggered.

6. The multi-dimensional assessment system for the risk of abnormal login to game accounts according to claim 5, characterized in that, Corresponding recommendations include: Low risk, meaning the standardized account risk index is less than 0.4, push dynamic verification codes to the user's bound device and mark it as low risk; Medium risk, meaning the standardized account risk index is greater than or equal to 0.4 and less than 0.7, restrict virtual asset trading permissions, generate alarm logs and notify the administrator; High risk, meaning the standardized account risk index is greater than or equal to 0.7, will result in the account's login privileges being frozen and the risk tag being synchronized to the associated social media platforms and risk control database.

7. The multi-dimensional assessment system for the risk of abnormal login to game accounts according to claim 6, characterized in that, The access logs for the game account include access time, device identifier, geographical location, network type, and accessed page tags.

8. A computing device, characterized in that, include: One or more processors; A storage device for storing one or more programs, which, when executed by one or more processors, cause the one or more processors to implement the system as described in any one of claims 1 to 7.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a program that, when executed by a processor, implements the system as described in any one of claims 1 to 7.

Images