Game abnormal account detection method and device, electronic equipment and storage medium

Abstract

The invention discloses a game abnormal account detection method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining game behavior data of each target player; wherein the game behavior data comprises the number of requests of a player for each operation interface in each game stage; based on the game behavior data of each target player, generating a data vector of each target player, and generating a mask vector corresponding to each target player; calculating a standardized data vector of each target player by using the data vector of each target player and the corresponding mask vector; calculating a corresponding mahalanobis distance on the observation subspace of each target player by using the standardized data vector of each target player; according to the deviation between the request number proportion of the target player in each game stage and the corresponding global average request proportion, calculating a proportion difference score corresponding to the target player; and screening abnormal target players based on the mahalanobis distance and the proportion difference score corresponding to each target player.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of game security monitoring, and particularly relates to a game abnormal account detection method and device, an electronic device and a storage medium. BACKGROUND

[0002] With the popularity of online games, the number of players and game interaction behaviors have increased explosively. However, in order to make profits from games and the like, a large number of malicious script accounts begin to perform automated operations, thereby causing a decrease in fairness, affecting the game ecology and the like, and increasing unnecessary consumption of server resources. Therefore, it is necessary to detect malicious script accounts to perform a ban and the like.

[0003] The current detection method of malicious script accounts mainly collects a large number of data of multiple items of player accounts of a game, and uses the data of each player account as a training sample. After the training sample is labeled, a binary classification model is trained using the training sample and the label. Therefore, only the data of multiple items of the current player account needs to be collected and input into the binary classification model for processing and result, to identify whether the current player account is a normal account.

[0004] The current method is difficult to quickly migrate in different game scenarios, so a large amount of data collection, sample labeling and complex training need to be performed in advance for each game. Therefore, the entire process is relatively complex, and abnormal account detection cannot be performed in a timely manner. SUMMARY

[0005] Based on the deficiencies of the prior art, the present application provides a game abnormal account detection method and device, an electronic device and a storage medium, to solve the problem that the prior art cannot conveniently and timely detect abnormal accounts.

[0006] In order to achieve the above purpose, the present application provides the following technical solutions:

[0007] The first aspect of the present application provides a game abnormal account detection method, comprising:

[0008] Respectively acquiring game behavior data of each target player; wherein the game behavior data includes the number of requests of each target player to each operation interface in each game stage;

[0009] Based on the game behavior data of each target player, generating a dimension-aligned data vector of each target player, and generating a mask vector corresponding to each target player;

[0010] Using the data vector of each target player and the mask vector corresponding thereto, calculating a standardized data vector of each target player;

[0011] calculating a Mahalanobis distance corresponding to each target player on an observation subspace of the target player by using a standardized data vector of each target player;

[0012] calculating a proportion difference score corresponding to the target player according to a deviation of a request proportion of the target player in each game stage from a global average request proportion of each game stage;

[0013] screening an abnormal target player based on the Mahalanobis distance and the proportion difference score corresponding to each target player.

[0014] Optionally, in the game abnormal account detection method, the generating of the data vector of each target player and the generating of the mask vector corresponding to each target player based on the game behavior data of each target player comprise:

[0015] embedding the game behavior data of each target player into a unified space to obtain a data vector of each target player;

[0016] generating a mask vector corresponding to each target player for the game behavior data of each target player; wherein, if a dimension of the game behavior data of the target player exists a value, the value in the mask vector of the target player is 1, otherwise, the value is 0.

[0017] Optionally, in the game abnormal account detection method, the calculating of the standardized data vector of each target player by using the data vector of each target player and the mask vector corresponding to each target player comprises:

[0018] vectorizing the data vector of all target players and the mask vector corresponding to all target players according to a column order to obtain an overall data matrix and a mask matrix;

[0019] calculating a mean value and a variance of each dimension based on the mask matrix and the data of each dimension observed in the overall data matrix;

[0020] standardizing the data of each target player in the overall data matrix based on the mask matrix and the mean value and the variance of each dimension to obtain a standardized data vector of each target player.

[0021] Optionally, in the game abnormal account detection method, the calculating of the mean value and the variance of each dimension based on the mask matrix and the data of each dimension observed in the overall data matrix comprises:

[0022] respectively, dividing the sum of the product of each column data in the overall data matrix and the same column data in the mask matrix by the sum of the same column data in the mask matrix, to obtain the mean value of each dimension; wherein each column data in the overall data matrix is the data of one dimension;

[0023] respectively, dividing the sum of the product of each column data in the overall data matrix and the same column data in the mask matrix by the sum of the same column data in the mask matrix and 1, to obtain the variance of each dimension; wherein the deviation of each column data is the difference between each data in a column and the mean value.

[0024] Optionally, in the game abnormal account detection method described above, the calculation of the Mahalanobis distance corresponding to each target player on the observation subspace of the target player by using the standardized data vector of each target player comprises:

[0025] determining the observation subspace of each target player according to the standardized data vector of each target player;

[0026] For each target player, each target player who simultaneously observes data on each two dimensions in the observation subspace of the target player is determined, and the covariance matrix corresponding to the target player is calculated by using the data of two dimensions in the standardized data vector of each target player;

[0027] the Mahalanobis distance corresponding to the target player is calculated by using the data on the observation subspace of the target player in the standardized data vector of the target player and the inverse matrix of the covariance matrix corresponding to the target player.

[0028] Optionally, in the game abnormal account detection method described above, the calculation of the proportion difference score corresponding to the target player according to the deviation of the request number proportion of the target player in each game stage from the global average request proportion of each game stage comprises:

[0029] For each game stage, the request number of the target player to each operation interface in the game stage is calculated, and the total request number of all operation interfaces in the game stage is calculated, to obtain the proportion of each stage of the target user.

[0030] The Frobenius norm is calculated according to the deviation of the proportion of each stage of the target user from the global average request proportion of the corresponding game stage, to obtain the proportion difference score corresponding to the target player.

[0031] Optionally, in the game abnormal account detection method, the step of screening out the abnormal target player based on the Mahalanobis distance and the proportion difference score corresponding to each target player comprises:

[0032] weighting the Mahalanobis distance and the proportion difference score corresponding to each target player respectively to obtain a comprehensive score of each target player;

[0033] determining a value in a specified quantile of the comprehensive score of each target player as a quantile threshold;

[0034] determining the target player with a comprehensive score greater than the quantile threshold as an abnormal target player.

[0035] The second aspect of the application provides a game abnormal account detection device, comprising:

[0036] a data acquisition unit configured to acquire game behavior data of each target player respectively; wherein the game behavior data comprises a number of requests of a player to each operation interface in each game stage;

[0037] a preprocessing unit configured to generate a data vector of each target player in a dimension alignment based on the game behavior data of each target player, and generate a mask vector corresponding to each target player;

[0038] a standardization processing unit configured to calculate a standardized data vector of each target player by using the data vector of each target player and the mask vector corresponding thereto;

[0039] a distance calculation unit configured to calculate a Mahalanobis distance corresponding to each target player on an observation subspace of the target player by using the standardized data vector of each target player respectively;

[0040] a proportion deviation evaluation unit configured to calculate a proportion difference score corresponding to each target player according to a deviation of a request proportion of the target player in each game stage from a global average request proportion of each game stage;

[0041] a player screening unit configured to screen out an abnormal target player based on the Mahalanobis distance and the proportion difference score corresponding to each target player.

[0042] Optionally, in the game abnormal account detection device, the preprocessing unit comprises:

[0043] an embedding unit configured to embed the game behavior data of each target player in a uniform space to obtain a data vector of each target player;

[0044] A mask generation unit is configured to generate a mask vector corresponding to each target player based on the game behavior data of the target player, wherein a dimension with a value in the game behavior data of the target player has a value of 1 in the mask vector of the target player, otherwise has a value of 0.

[0045] Optionally, in the game abnormal account detection device, the standardization processing unit comprises:

[0046] A vectorization unit is configured to vectorize the data vector of each target player and the mask vector corresponding to each target player in a column-major order to obtain an overall data matrix and a mask matrix.

[0047] An index calculation unit is configured to calculate the mean and variance of each dimension based on the observed data in the overall data matrix and the mask matrix.

[0048] A standard calculation unit is configured to standardize the data of each target player in the overall data matrix based on the mean and variance of each dimension and the mask matrix to obtain a standardized data vector of each target player.

[0049] Optionally, in the game abnormal account detection device, the index calculation unit comprises:

[0050] A mean calculation unit is configured to divide the sum of the product of each column data in the overall data matrix and the same column data in the mask matrix by the sum of the same column data in the mask matrix to obtain the mean of each dimension.

[0051] A variance calculation unit is configured to divide the sum of the square of the deviation of each column data in the overall data matrix and the same column data in the mask matrix by the difference between the sum of the same column data in the mask matrix and 1 to obtain the variance of each dimension.

[0052] Optionally, in the game abnormal account detection device, the distance calculation unit comprises:

[0053] A space determination unit is configured to determine an observation subspace of each target player based on the standardized data vector of each target player.

[0054] a covariance calculation unit configured to determine, for each target player, each target player who simultaneously observes data in each two dimensions in the observation subspace of the target player, and calculate a covariance matrix corresponding to the target player by using data in two dimensions in the normalized data vector of the target player;

[0055] a Mahalanobis distance calculation unit configured to calculate a Mahalanobis distance corresponding to the target player by using data in the observation subspace of the target player in the normalized data vector of the target player and an inverse matrix of the covariance matrix corresponding to the target player.

[0056] Optionally, in the game abnormal account detection apparatus, the proportion deviation evaluation unit comprises:

[0057] a proportion calculation unit configured to calculate, for each game stage, a proportion of the target player in each game stage, by using the number of requests of the target player to each operation interface in the game stage and the total number of requests of the target player to all operation interfaces in the game stage.

[0058] a score calculation unit configured to calculate a Frobenius norm according to the deviation between the proportion of the target player in each game stage and the global average request proportion of the corresponding game stage, and obtain a proportion difference score corresponding to the target player.

[0059] Optionally, in the game abnormal account detection apparatus, the player screening unit comprises:

[0060] a weighting unit configured to weight the Mahalanobis distance and the proportion difference score corresponding to each target player, and obtain a comprehensive score of each target player.

[0061] a threshold determination unit configured to determine a value in the comprehensive score of each target player as a quantile threshold value, the value being in a specified quantile.

[0062] an abnormal player determination unit configured to determine the target player as an abnormal target player if the comprehensive score of the target player is greater than the quantile threshold value.

[0063] The third aspect of the present application provides an electronic device, comprising:

[0064] a memory and a processor;

[0065] wherein the memory is configured to store a program;

[0066] the processor is configured to execute the program, and the program, when executed, is specifically configured to implement the game abnormal account detection method.

[0067] The fourth aspect of the application provides a computer storage medium for storing a computer program, which, when executed by a processor, is used to implement the game abnormal account detection method according to any one of the preceding aspects.

[0068] The game abnormal account detection method provided by the application obtains game behavior data of each target player respectively. The game behavior data includes the number of requests of each target player to each operation interface in each game stage, so that the game behavior data of the current player can be directly obtained, and the abnormal account detection can be performed in time. Then, based on the game behavior data of each target player, a data vector of each target player in a dimension alignment is generated, and a mask vector corresponding to each target player is generated, so that the collected data is aligned in the same space to enable comparison. The mask vector can ensure that the subsequent analysis is performed by using the actually observed data, and the accuracy of the result is ensured. Therefore, the standardized data vector of each target player is calculated by using the data vector of each target player and the corresponding mask vector, and the Mahalanobis distance corresponding to each target player is calculated on the observation subspace of the target player by using the standardized data vector of each target player. The observation subspace is the space of each dimension of the actually observed data. Therefore, the distance between the game behavior data of the player and the overall data distribution is calculated on the observation subspace of the player, so that the accurate distance can be calculated for the sparse data, and the deviation of the player's behavior is reflected. At the same time, according to the deviation of the request number proportion of the target player in each game stage and the global average request proportion of each game stage, the proportion difference score corresponding to the target player is calculated, so that the difference between the game behavior of the player and the global behavior is analyzed. Finally, based on the Mahalanobis distance and the proportion difference score corresponding to each target player, the abnormal target player is screened out, so that the accurate reflection of the behavior abnormality of the player is analyzed, the abnormal player is screened out, and the game behavior based data is directly used to detect the abnormal player account. The method can be used to efficiently and conveniently detect each game. BRIEF DESCRIPTION OF DRAWINGS

[0069] In order to more clearly illustrate the technical solutions in the embodiments of the application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings in the following description are only embodiments of the application, and for those skilled in the art, other drawings can be obtained without creative labor based on the provided drawings.

[0070] Figure 1 A flowchart of a game abnormal account detection method provided by the embodiments of the application is shown in the figure.

[0071] Figure 2A flowchart of a method for standardizing player data provided by an embodiment of the present application;

[0072] Figure 3 A flowchart of a method for calculating Mahalanobis distance corresponding to a target player provided by an embodiment of the present application;

[0073] Figure 4 A flowchart of a method for calculating a proportional difference score corresponding to a target player provided by an embodiment of the present application;

[0074] Figure 5 A flowchart of a method for screening an abnormal target player provided by an embodiment of the present application;

[0075] Figure 6 An architectural schematic diagram of a game abnormal account detection device provided by an embodiment of the present application;

[0076] Figure 7 An architectural schematic diagram of an electronic device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0077] The technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, but not all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0078] In the present application, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or device including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or device. Without more limitations, the element defined by the statement "including a" does not exclude the presence of another identical element in the process, method, article or device including the element.

[0079] The embodiments of the present application provide a game abnormal account detection method, as shown in the following Figure 1 The method comprises the following steps:

[0080] S101, game behavior data of each target player is acquired respectively.

[0081] The game behavior data includes a number of requests of each operation interface by the player in each game stage.

[0082] The target player is a player to be detected, and each player is a player account. Therefore, the abnormal detection of the player is the abnormal detection of the abnormal player account. Alternatively, the player can be all players or part of the players in a game, etc. The player can be selected according to the requirement.

[0083] The game stage is each stage in a game, for example, the global game stage S of a game is {S1 preparation, S2 battle, S3 settlement}. The operation interface API is an interface to be requested in each game stage to realize the corresponding operation. For example, the set of operation interfaces A of the game is {login, attack}. Therefore, the player with abnormal operation is analyzed by analyzing the operation data of the player in each stage in the present scheme.

[0084] The number of requests of each operation interface in each game stage is collected in the present scheme. Therefore, each dimension of the collected data corresponds to a game stage and an operation interface. Therefore, the number of dimensions of the collected data is the product of the number of game stages and the number of operation interfaces, that is, the number of dimensions is: For example, for the above example, the number of dimensions is 3*2=6, and the specific dimensions include: “S1 preparation-login”, “S1 preparation-attack”, “S2 battle-login”, “S2 battle-attack”, “S3 settlement-login”, and “S3 settlement-attack”.

[0085] Therefore, for the i-th player, the number of requests of the interface requested by the player in each game stage is counted according to the behavior log, so as to count the count matrix of the player about “stage-interface”: , which represents the number of calls of the API interface a by the player i in the stage s, s∈S, a∈A.

[0086] For example, for the above example, the data of four players (P1, P2, P3, and P4) is collected, and the data shown in Table 1 is obtained as follows:

[0087] Table 1

[0088]

[0089] In the table, “-” represents that the player does not experience the corresponding stage, that is, the player does not operate in the stage, and the stage does not exist for the player.

[0090] S102, based on the game behavior data of each target player, generate the dimension-aligned data vector of each target player, and generate the mask vector corresponding to each target player.

[0091] According to the above content, it can be seen that the number of stages experienced by each target player is different, so the dimensions of the game behavior data collected for each target player are inconsistent, and therefore cannot be directly compared. Therefore, it is necessary to align and embed the game behavior data of each target player, so as to obtain the dimension-aligned data vector of each target player. Specifically, for the stages not experienced, 0 is filled as the value. Therefore, part of the values in the data vector of the target player are 0 filled for dimension alignment, which are not real observed data, and the real observed data may also be 0. Therefore, in order to be able to calculate each statistical quantity based on only the real observed data in the subsequent process and ensure the accuracy of the results, a mask vector corresponding to the game behavior data of each target player is also generated, that is, the mask vector of each target player, so as to indicate the real observed values in the data vector of the target player through the mask vector of the target player.

[0092] Optionally, in another embodiment of the present application, a specific implementation of step S102 comprises:

[0093] The game behavior data of each target player is embedded in a unified space to obtain the data vector of each target player, and the mask vector of each target player is generated for the game behavior data of each target player.

[0094] Among them, the dimension of the value in the game behavior data of the target player is 1 in the mask vector of the target player, otherwise it is 0. That is, for the real observed data, the value of this dimension in the mask vector is 1, and for other dimensions, there is no real observed data, so the value is 0.

[0095] Specifically, for player i, construct a stage selection matrix P i , and perform alignment embedding on the game behavior data matrix M i of the target player to obtain the data vector of the target player:

[0096] .

[0097] Thus, the behavior of the target player is uniformly embedded in the same size space E i , wherein the unexperienced stages are filled with 0 in the corresponding positions in the vector. At the same time, in order to distinguish between "real missing" (real observed data is 0) and "filled placeholder" values in the subsequent processing, a mask matrix of the same type is generated.

[0098] For example, for the data of player P2 in the above example, its data vector (3 stages x 2 APIs) can be obtained as follows:

[0099] .

[0100] Since player P2 has not experienced the S3 settlement stage, the 0s in the third row of E2 are all padding. Therefore, the corresponding generated mask matrix is as follows:

[0101] .

[0102] S103, using the data vector of each target player and the corresponding mask vector, calculating the standardized data vector of each target player.

[0103] After stage alignment, although the feature dimension is unified, different players are still missing in most stages. If the conventional mean and variance are directly used, the results will be severely distorted due to a large number of padding values. Therefore, based on the mask vector, the values in the data vector of each target player are statistically calculated to obtain the mean and variance, and the calculation results are used to standardize the data vector of each target player to facilitate subsequent distance calculation.

[0104] Optionally, in another embodiment of the present application, a specific implementation of step S103 includes the following steps as shown in Figure 2 .

[0105] S201, respectively vectorizing the data vector of all target players and the corresponding mask vector of all target players according to column-major order to obtain an overall data matrix and a mask matrix.

[0106] It should be noted that in order to facilitate the calculation of all data, the data of all target players are combined into an overall data matrix and a mask matrix. In order to make each column correspond to a dimension, the data vector of each target player i and the corresponding mask vector are vectorized according to column-major order:

[0107] .

[0108] Then, by combining these vectorized vectors, the overall data matrix and the mask matrix can be obtained as follows:

[0109] .

[0110] S202, based on the mask matrix, using the observed data of each dimension in the overall data matrix to calculate the mean and variance of each dimension.

[0111] Specifically, based on the mask matrix, the data of each dimension actually observed can be extracted from the overall data matrix respectively, and used to calculate the mean and variance of the dimension.

[0112] Optionally, in another embodiment of the present application, a specific implementation of step S202 includes:

[0113] The sum of the product of each column data in the overall data matrix and the same column data in the mask matrix is divided by the sum of the same column data in the mask matrix to obtain the mean of each dimension.

[0114] Wherein, each column data in the overall data matrix is the data of a dimension.

[0115] Each column data in the overall data matrix is the data of a dimension, so calculating each dimension is calculating each column data in the overall data matrix. The same column data in the mask matrix corresponds to the mask of the column data in the overall data matrix, and the mask of the actually observed data is 1 and the mask of the filled data is 0, so directly multiplying each column data in the overall data matrix and the same column data in the mask matrix can filter out the actually observed data, so the sum of the product of these data is the sum of the observed data. The unobserved data is not counted, so only the sum of the same column data in the mask matrix is divided. Therefore, for each column j, i.e. each dimension, the mean is calculated as follows:

[0116] .

[0117] The sum of the product of the square of the deviation of each column data in the overall data matrix and the same column data in the mask matrix is divided by the difference between the sum of the same column data in the mask matrix and 1 to obtain the variance of each dimension.

[0118] Wherein, the deviation of each column data is the difference between each data in the column and the mean.

[0119] Similarly, the deviation of each column data is multiplied by the same column data in the mask matrix to extract the observed data to calculate the variance, and the specific calculation method is as follows:

[0120] .

[0121] S203, based on the mask matrix, the mean and variance of each dimension are used to standardize the data of each target player in the overall data matrix to obtain the standardized data vector of each target player.

[0122] Similarly, in order to calculate the Mahalanobis distance only by using the observed data, the real observed data in the whole data matrix is normalized based on the mask matrix, so as to obtain the normalized data vector of each target player, and the specific calculation manner is as follows:

[0123] .

[0124] For example, for the data of the four players in the above example, the normalized data shown in Table 2 can be obtained as follows:

[0125] Table 2

[0126]

[0127] S104, respectively using the normalized data vector of each target player, calculating the Mahalanobis distance corresponding to the target player on the observation subspace of the target player.

[0128] Since the Mahalanobis distance corresponding to the target player is the distance between its behavior data and the whole data distribution, by calculating the Mahalanobis distance corresponding to the target player, it can also reflect whether its behavior is abnormal, so as to determine whether the target player is an abnormal player.

[0129] Wherein, the observation subspace is the space of each dimension of the real observed data, that is, the space of the dimension corresponding to the mask vector. For example, for the example shown in Table 2, the observation subspaces of each target player are respectively: J1={1, 2, 3, 4, 5, 6}, J2={1, 2, 4, 5}, J3={2, 3, 5, 6}, J4={1, 3, 4, 6}.

[0130] Since the actual observed positions of "game stage-API" of each player are different, the normalized feature vector Z i is highly sparse. Therefore, in order to calculate accurate results in the case of high coefficients, the covariance matrix is not directly constructed in the full-dimensional space, and the Mahalanobis distance is not calculated, but the covariance matrix is constructed on the real observation subspace of each player, and the Mahalanobis distance is calculated, which can be specifically represented as:

[0131] .

[0132] Wherein, is the normalized data vector of the target player i on its observation subspace, is the mean vector on the subspace, is the inverse matrix of the covariance matrix after shrinkage estimation.

[0133] Optionally, in another embodiment of the present application, a specific implementation of step S104 is as follows:Figure 3 As shown, comprising:

[0134] S301, determining the observation subspace of each target player according to the standardized data vector of each target player.

[0135] Optionally, the observation subspace of each target player i can be determined according to the mask matrix .

[0136] S302, for each target player, determining each target player who simultaneously observes data on each two dimensions in the observation subspace of the target player, and calculating the covariance matrix corresponding to the target player by using the data of two dimensions in the standardized data vector of each target player.

[0137] In order to avoid the bit disaster, the covariance matrix is calculated by using available samples and shrinkage estimation:

[0138] .

[0139] Wherein, the covariance is calculated only by using the data of each player who simultaneously observes each two dimensions p and q in the observation subspace of the target player.

[0140] For example, for the observation subspace of each target player in the above example, when calculating the covariance of dimensions j1 and j2, it is known that dimension j1 is observed by players P1, P2 and P4, and dimension j2 is observed by players P1, P2 and P4. So the main players P1 and P2 who simultaneously observe dimensions j1 and j2. So when calculating the covariance of the two dimensions, only the data of players P1 and P2 are used to calculate the covariance. i1 i2 .

[0141] S303, calculating the Mahalanobis distance corresponding to the target player by using the data of the target player in the observation subspace of the standardized data vector and the inverse matrix of the covariance matrix corresponding to the target player.

[0142] Specifically, the calculation method of the Mahalanobis distance corresponding to the target player i is:

[0143] .

[0144] Wherein, is the data of the target player i in the observation subspace of the standardized data vector; , that is, the mean value of the standardized data in the observation subspace of the target player i; is the inverse matrix of the covariance matrix corresponding to the target player.

[0145] ​S105. Calculate the ratio difference score corresponding to the target player based on the deviation between the ratio of requests made by the target player in each game stage and the global average request ratio in each game stage.

[0146] To ensure the accuracy of the analysis results, this embodiment of the application analyzes whether a player's behavior is abnormal by comparing the deviation between the proportion of a single player in each behavioral data and the proportion of all players in each behavioral data, i.e., the deviation of the global behavioral data proportion.

[0147] Specifically, by utilizing the request data of all target players for each interface at each game stage, the global average request ratio of the total number of requests for each interface in each game stage is calculated. Furthermore, for each target player, the ratio of the number of requests for each interface to the total number of requests in each game stage is calculated to obtain the target player's in-stage ratio. Then, based on the deviation between the target player's in-stage ratio and the corresponding global average request ratio for that game stage, a corresponding ratio difference score is assigned. The larger the deviation, the larger the ratio difference score for the target player, indicating a greater difference between the target player's behavioral data and that of other players.

[0148] Alternatively, the proportional difference fraction can be expressed as a squared value or an L2 norm, etc.

[0149] Optionally, in another embodiment of this application, one specific implementation of step S105 is as follows: Figure 4 As shown, it includes:

[0150] S401. For each game stage, calculate the number of requests made by the target player to each operation interface during the game stage, and the total number of requests made to all operation interfaces during the game stage, to obtain the proportion of the target user in each stage.

[0151] Specifically, the total number of requests made by target player i to each operation interface during each game stage is counted, thus obtaining the total number of requests made by the target player i to each operation interface during each game stage. Then, the number of requests made by target player i to each operation interface during each game stage is divided by the total number of requests for the corresponding game stage to obtain the proportion of the target user within each stage. Considering that the total number of requests may be zero, to avoid the denominator of the proportion being zero, a stable term can be added to the total number of requests. Therefore, the proportion of the target user within each stage is:

[0152] .

[0153] in, The number of requests made by target player i to operation interface a during game phase s. The total number of API requests made by target player i during game phase s; It is a numerically stable term.

[0154] S402. Calculate the Frobenius norm based on the deviation between the proportion of the target user in each stage and the global average request proportion of the corresponding game stage, and obtain the proportion difference score corresponding to the target player.

[0155] The global average request ratio for each game phase can be represented as the average of the intra-phase ratios of all target players experiencing that game phase, specifically as follows:

[0156] .

[0157] in, For all target players who have experienced this game phase s, therefore This is a collection of game stages that these target players have experienced.

[0158] In this embodiment, the Frobenius norm is used as the proportional difference score corresponding to the target player. Therefore, the difference between the matrix of the proportion within each stage and the matrix of the global average request proportion of each stage is substituted into the calculation formula of the Frobenius norm to calculate the proportional difference score corresponding to the target player.

[0159] S106. Based on the Mahalanobis distance and ratio difference score corresponding to each target player, filter out abnormal target players.

[0160] It's important to note that the Mahalanobis distance and proportional difference score for a target player reflect the deviation between that target player's behavioral data and the overall behavioral data, which reflects the behavior of normal players. Therefore, by comprehensively considering the Mahalanobis distance and proportional difference score for a target player, we can identify target players with abnormal data and label them as aberrant target players.

[0161] Optionally, a target player can be identified as an abnormal target player if their Mahalanobis distance or ratio difference score exceeds a certain requirement. Alternatively, a target player can be identified as an abnormal target player if the sum of their Mahalanobis distance and ratio difference score exceeds a certain requirement. Of course, other methods may be used depending on the specific needs.

[0162] Optionally, in another embodiment of this application, one specific implementation of step S106 is as follows: Figure 5 As shown, it includes:

[0163] S501. Weight the scores of the Mahalanobis distance and the ratio difference for each target player to obtain the comprehensive score for each target player.

[0164] Since the Mahalanobis distance and scale difference scores reflect different degrees of player abnormality in different scenarios, this embodiment of the application weights the Mahalanobis distance and scale difference scores of the target player to obtain a comprehensive score for the target player. Therefore, corresponding weights can be set according to specific scenario requirements. Thus, the comprehensive score of the target player is calculated as follows:

[0165] .

[0166] Where α is the weighting weight.

[0167] S502. Determine the percentile threshold as the value of each target player's overall score that is at a specified percentile.

[0168] Considering that player data will change at different stages of game development, in order to dynamically set the threshold according to the actual situation, the corresponding percentile can be specified as needed, such as 95%. Thus, the percentile threshold can be determined by the value of each target player's comprehensive score that falls within the specified percentile.

[0169] S503. Target players whose comprehensive score is greater than the percentile threshold are identified as abnormal target players.

[0170] It should be noted that if a target player's overall score is greater than the percentile threshold, it indicates that their behavioral data is abnormally normal, meaning their game behavior is anomalous, and therefore they will be identified as an anomalous target player. Therefore, the set of all anomalous target players is:

[0171] .

[0172] This application provides a method for detecting abnormal game accounts, which involves acquiring game behavior data for each target player. This game behavior data includes the number of requests made by the player to various operation interfaces during each game phase, allowing for direct acquisition of the player's current game behavior data and timely detection of abnormal accounts. Then, based on the game behavior data of each target player, dimension-aligned data vectors for each target player and corresponding mask vectors are generated, aligning the collected data to the same space for comparison. The mask vectors ensure the accuracy of subsequent analysis using truly observed data. Therefore, using the data vectors of each target player and their corresponding mask vectors, standardized data vectors for each target player are calculated. Then, using the standardized data vectors of each target player, the Mahalanobis distance for each target player is calculated in the observation subspace of the target player. The observation subspace is the space of each dimension of the truly observed data. By calculating the distance between the player's behavior data and the overall data distribution in the player's observation subspace, accurate distances can be calculated even for sparse data, reflecting deviations in player behavior. Simultaneously, based on the deviation between the proportion of requests made by the target player at each game stage and the global average request proportion at each game stage, a proportion difference score is calculated for the target player. This allows for the analysis of the differences between the player's individual game behaviors and the overall global behavior. Finally, based on the Mahalanobis distance and proportion difference score for each target player, abnormal target players are identified. By utilizing the analyzed data that accurately reflects abnormal player behavior, abnormal players can be screened out. This achieves a direct and accurate method for detecting abnormal player accounts based on player behavior data, which can be conveniently and efficiently used for various games.

[0173] Another embodiment of this application provides a device for detecting abnormal game accounts, such as... Figure 6 As shown, it includes:

[0174] The data acquisition unit 601 is used to acquire game behavior data for each target player. This game behavior data includes the number of requests made by the player to various operation interfaces during each game phase.

[0175] The preprocessing unit 602 is used to generate dimension-aligned data vectors for each target player based on the game behavior data of each target player, and to generate mask vectors corresponding to each target player.

[0176] The standardization processing unit 603 is used to calculate the standardized data vector of each target player using the data vector of each target player and its corresponding mask vector.

[0177] The distance calculation unit 604 is used to calculate the Mahalanobis distance of each target player in the observation subspace of the target player, using the standardized data vector of each target player. The observation subspace is the space of each dimension of the actually observed data.

[0178] The ratio deviation assessment unit 605 is used to calculate the ratio difference score corresponding to the target player based on the deviation between the ratio of the number of requests of the target player in each game stage and the global average request ratio in each game stage.

[0179] Player filtering unit 606 is used to filter out abnormal target players based on the Mahalanobis distance and ratio difference score corresponding to each target player.

[0180] Optionally, in another embodiment of the game abnormal account detection device provided in this application, the preprocessing unit includes:

[0181] The embedding unit is used to embed the game behavior data of each target player into a unified space to obtain the data vector of each target player.

[0182] The mask generation unit is used to generate a mask vector for each target player based on their game behavior data. The target player's game behavior data has a numerical dimension; the value in the target player's mask vector is 1 if the data is numerical, and 0 otherwise.

[0183] Optionally, in another embodiment of the game abnormal account detection device provided in this application, the standardization processing unit includes:

[0184] The vectorization unit is used to vectorize the data vectors of all target players and the mask vectors corresponding to all target players in column-major order to obtain the overall data matrix and mask matrix.

[0185] The index calculation unit is used to calculate the mean and variance of each dimension based on the mask matrix and the data of each dimension observed in the overall data matrix.

[0186] The standard calculation unit is used to standardize the data of each target player in the overall data matrix based on the mask matrix, using the mean and variance of each dimension respectively, to obtain the standardized data vector of each target player.

[0187] Optionally, in another embodiment of the game abnormal account detection device provided in this application, the indicator calculation unit includes:

[0188] The mean calculation unit is used to calculate the mean of each dimension by dividing the sum of the products of each column of data in the overall data matrix and the same column of data in the mask matrix by the sum of the same column of data in the mask matrix. Each column of data in the overall data matrix represents one dimension.

[0189] The variance calculation unit is used to calculate the variance of each dimension by dividing the sum of the squared deviations of each column of data in the overall data matrix by the sum of the products of the squared deviations of the data in the same column of the mask matrix and 1. Here, the deviation of each column of data is the difference between each data point in that column and the mean.

[0190] Optionally, in another embodiment of the game abnormal account detection device provided in this application, the distance calculation unit includes:

[0191] The spatial determination unit is used to determine the observation subspace of each target player based on the standardized data vector of each target player.

[0192] The covariance calculation unit is used to identify each target player simultaneously observing data in each two dimensions of the target player's observation subspace for each target player, and to calculate the covariance matrix corresponding to the target player using the data in the two dimensions of the standardized data vector of each target player.

[0193] The Mahalanobis distance calculation unit is used to calculate the Mahalanobis distance of the target player by using the data in its observation subspace from the target player's standardized data vector and the inverse of the target player's covariance matrix.

[0194] Optionally, in another embodiment of the game abnormal account detection device provided in this application, the proportional deviation evaluation unit includes:

[0195] The ratio calculation unit is used to calculate the number of requests made by the target player to each operation interface during each game stage, and the total number of requests made to all operation interfaces during the game stage, to obtain the ratio of the target user in each stage.

[0196] The score calculation unit is used to calculate the Frobenius norm based on the deviation between the proportion of the target user in each stage and the global average request proportion of the corresponding game stage, and obtain the proportion difference score for the target player.

[0197] Optionally, in another embodiment of the game abnormal account detection device provided in this application, the player screening unit includes:

[0198] The weighted unit is used to weight the Mahalanobis distance and ratio difference scores for each target player to obtain the comprehensive score for each target player.

[0199] The threshold determination unit is used to determine the value of each target player's comprehensive score that is at a specified percentile as the percentile threshold.

[0200] The Abnormal Player Identification Unit is used to identify target players whose overall score is greater than the percentile threshold as abnormal target players.

[0201] It should be noted that the specific working process of each unit provided in the above embodiments of this application can be referred to the implementation process of the corresponding steps in the above method embodiments, and will not be repeated here.

[0202] Another embodiment of this application provides an electronic device, such as... Figure 7 As shown, it includes:

[0203] Memory 701 and processor 702.

[0204] The memory 701 is used to store the program.

[0205] The processor 702 is used to execute the program stored in the memory 702. When the program is executed, it is specifically used to implement the game abnormal account detection method provided in any of the above embodiments.

[0206] Another embodiment of this application provides a computer storage medium for storing a computer program, which, when executed by a processor, is used to implement the game abnormal account detection method provided in any of the above embodiments.

[0207] Computer storage media, including both permanent and non-permanent, removable and non-removable media, can store information using any method or technology. Information can be computer-readable instructions, data structures, program modules, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0208] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0209] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for detecting abnormal game accounts, characterized in that, include: Acquire game behavior data for each target player; wherein, the game behavior data includes the number of requests made by the player to each operation interface during each game phase; Based on the game behavior data of each target player, a dimension-aligned data vector for each target player is generated, as well as a mask vector corresponding to each target player is generated; Using the data vectors of each target player and their corresponding mask vectors, calculate the normalized data vectors of each target player; Using the standardized data vector of each target player, calculate the Mahalanobis distance of the target player in the observation subspace of the target player; The ratio difference score corresponding to the target player is calculated based on the deviation between the ratio of the number of requests made by the target player in each game stage and the global average request ratio in each game stage. Based on the Mahalanobis distance and ratio difference scores corresponding to each target player, abnormal target players are filtered out.

2. The method according to claim 1, characterized in that, The step of generating dimension-aligned data vectors for each of the target players based on their game behavior data, and generating mask vectors corresponding to each of the target players, includes: The game behavior data of each target player is embedded into a unified space to obtain the data vector of each target player; For each target player's game behavior data, a mask vector is generated for each target player; wherein, the target player's game behavior data has a numerical dimension, and the value in the target player's mask vector is 1, otherwise it is 0.

3. The method according to claim 1, characterized in that, The step of calculating the standardized data vector of each target player using their respective data vectors and corresponding mask vectors includes: Vectorize the data vectors of all the target players and the mask vectors corresponding to all the target players in column-major order to obtain the overall data matrix and mask matrix; Based on the mask matrix, the mean and variance of each dimension are calculated using the data observed in each dimension of the overall data matrix; Based on the mask matrix, the data of each target player in the overall data matrix are standardized by using the mean and variance of each dimension, so as to obtain the standardized data vector of each target player.

4. The method according to claim 3, characterized in that, The step of calculating the mean and variance of each dimension based on the mask matrix and using the observed data of each dimension in the overall data matrix includes: The mean of each dimension is obtained by summing the products of each column of data in the overall data matrix and the same column of data in the mask matrix, and dividing the sum of the products of each column of data in the mask matrix by the sum of the products of each column of data in the mask matrix; wherein, each column of data in the overall data matrix represents the data of one dimension. The variance of each dimension is obtained by multiplying the sum of the squared deviations of each column of data in the overall data matrix with the sum of the products of the same column of data in the mask matrix, and then dividing the sum of the sums of the same column of data in the mask matrix by 1; wherein, the deviation of each column of data is the difference between each data point in the column and the mean.

5. The method according to claim 1, characterized in that, The step of calculating the Mahalanobis distance of each target player in the observation subspace of the target player using the standardized data vector of each target player includes: Based on the standardized data vector of each target player, determine the observation subspace of each target player; For each target player, the target players whose observation data are simultaneously observed in each of the two dimensions in the observation subspace of the target player are determined, and the covariance matrix corresponding to the target player is calculated using the data in the two dimensions of the standardized data vector of each target player. The Mahalanobis distance of the target player is calculated using the data in its observation subspace from the standardized data vector of the target player and the inverse of the covariance matrix corresponding to the target player.

6. The method according to claim 1, characterized in that, The step of calculating the ratio difference score corresponding to the target player based on the deviation between the ratio of requests made by the target player in each game stage and the global average request ratio in each game stage includes: For each game stage, the number of requests made by the target player to each operation interface within that game stage is calculated, along with the total number of requests made to all operation interfaces within that game stage, to obtain the proportion of the target user in each stage. The Frobenius norm is calculated based on the deviation between the proportion of the target user in each stage and the global average request proportion of the corresponding game stage, to obtain the proportion difference score corresponding to the target player.

7. The method according to claim 1, characterized in that, The process of filtering out abnormal target players based on the Mahalanobis distance and ratio difference score corresponding to each target player includes: The Mahalanobis distance and ratio difference scores for each target player are weighted separately to obtain the comprehensive score for each target player. The value of each target player's overall score that falls within a specified percentile is determined as the percentile threshold; Target players whose overall score is greater than the percentile threshold are identified as abnormal target players.

8. A device for detecting abnormal game accounts, characterized in that, include: The data acquisition unit is used to acquire game behavior data for each target player; wherein, the game behavior data includes the number of requests made by the player to each operation interface in each game phase; The preprocessing unit is used to generate dimension-aligned data vectors for each of the target players based on their game behavior data, and to generate mask vectors corresponding to each of the target players. A standardization processing unit is used to calculate the standardized data vector of each of the target players using their respective data vectors and corresponding mask vectors. The distance calculation unit is used to calculate the Mahalanobis distance of each target player in the observation subspace of the target player using the normalized data vector of each target player respectively. The ratio deviation evaluation unit is used to calculate the ratio difference score corresponding to the target player based on the deviation between the ratio of the number of requests of the target player in each game stage and the global average request ratio in each game stage. The player filtering unit is used to filter out abnormal target players based on the Mahalanobis distance and ratio difference score corresponding to each target player.

9. An electronic device, characterized in that, include: Memory and processor; The memory is used to store programs; The processor is used to execute the program, which, when executed, is specifically used to implement the game abnormal account detection method as described in any one of claims 1 to 7.

10. A computer storage medium, characterized in that, Used to store a computer program, which, when executed by a processor, is used to implement the game abnormal account detection method as described in any one of claims 1 to 7.

Images