Data processing method and device of virtual scene, electronic equipment, computer readable storage medium and computer program product

Abstract

The application provides a data processing method and device for a virtual scene, electronic equipment, a computer readable storage medium and a computer program product; the method comprises: performing first anomaly detection processing on first interaction data of a to-be-detected object to obtain a first anomaly detection result; when the first anomaly detection result is a deterministic result, performing a compliance operation corresponding to the deterministic result on the to-be-detected object; when the first anomaly detection result is a non-deterministic result, performing second anomaly detection processing on second interaction data of the to-be-detected object to obtain a second anomaly detection result; wherein the first interaction data and the second interaction data are data generated by the to-be-detected object participating in interaction in the virtual scene; and performing a compliance operation corresponding to the second anomaly detection result on the to-be-detected object. Through the application, the delay perception of the data processing process can be effectively reduced while the detection accuracy is taken into account.

Description

Technical Field

[0001] This application relates to the field of computer technology, and in particular to a data processing method, apparatus, electronic device, computer-readable storage medium, and computer program product for virtual scenes. Background Technology

[0002] In recent years, with the continuous expansion of the gaming industry, the number of game players, online time, and the increasing complexity of game programs have become increasingly important. Ensuring the legality and fairness of match data and the legality of game session data has become increasingly crucial. Related technologies employ deep learning-based anti-cheating models, but these systems each have their own problems, the most common being low detection accuracy and slow detection speed. Summary of the Invention

[0003] This application provides a data processing method, apparatus, electronic device, computer-readable storage medium, and computer program product for virtual scenes, which can effectively reduce the perceived latency of the data processing process while ensuring detection accuracy.

[0004] The technical solution of this application embodiment is implemented as follows:

[0005] This application provides a data processing method for a virtual scene, including:

[0006] Perform the first anomaly detection processing on the first interaction data of the object to be detected, and obtain the first anomaly detection result;

[0007] When the first anomaly detection result is a deterministic result, the compliant operation corresponding to the deterministic result is performed on the object to be detected;

[0008] When the first anomaly detection result is a non-deterministic result, the second interaction data of the object to be detected is subjected to a second anomaly detection process to obtain a second anomaly detection result;

[0009] Wherein, the first interaction data and the second interaction data are data generated by the object to be detected participating in the interaction in the virtual scene;

[0010] Perform compliance operations corresponding to the second anomaly detection result for the object to be detected.

[0011] This application provides a data processing device for a virtual scene, including:

[0012] The first processing module is used to perform first anomaly detection processing on the first interactive data of the object to be detected, and obtain the first anomaly detection result.

[0013] The first execution module is used to perform compliance operations corresponding to the deterministic result for the object to be detected when the first anomaly detection result is a deterministic result;

[0014] The second processing module is used to perform second anomaly detection processing on the second interaction data of the object to be detected when the first anomaly detection result is a non-deterministic result, to obtain a second anomaly detection result; wherein, the first interaction data and the second interaction data are data generated by the object to be detected participating in interactions in the virtual scene;

[0015] The second execution module is used to perform compliance operations corresponding to the second anomaly detection result for the object to be detected.

[0016] This application provides an electronic device, including:

[0017] Memory is used to store executable instructions or computer programs.

[0018] The processor, when executing computer-executable instructions or computer programs stored in the memory, implements the data processing method for the virtual scene provided in the embodiments of this application.

[0019] This application provides a computer-readable storage medium storing a computer program or computer-executable instructions, which, when executed by a processor, implements the data processing method for a virtual scene provided in this application.

[0020] This application provides a computer program product, including a computer program or computer executable instructions. When the computer program or computer executable instructions are executed by a processor, they implement the data processing method for a virtual scene provided in this application.

[0021] The embodiments of this application have the following beneficial effects:

[0022] By performing a first anomaly detection process on the first interaction data of the object to be detected, a first anomaly detection result is obtained. When the first anomaly detection result is a deterministic result, the corresponding compliant operation for the deterministic result is directly executed on the object to be detected, thereby effectively reducing the user's perception of latency in the data processing process. When the first anomaly detection result is a non-deterministic result, a second anomaly detection process is performed on the second interaction data of the object to be detected, a second anomaly detection result is obtained, and the corresponding compliant operation for the second anomaly detection result is executed on the object to be detected, thereby performing a second anomaly detection on the data with uncertain results, and thus ensuring the correctness of the anomaly detection result. Attached Figure Description

[0023] Figure 1This is a schematic diagram of the architecture of the virtual scene data processing system 100 provided in the embodiments of this application;

[0024] Figure 2 This is a schematic diagram of the structure of the electronic device 500 provided in the embodiments of this application;

[0025] Figure 3 This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0026] Figure 4A This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0027] Figure 4B This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0028] Figure 5A This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0029] Figure 5B This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0030] Figure 5C This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0031] Figure 5D This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0032] Figure 6 This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0033] Figure 7 This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application;

[0034] Figure 8 This is a schematic diagram of the interface for battle matching in the lobby server using the virtual scene data processing method provided in this application embodiment;

[0035] Figure 9 This is a schematic diagram of the interface for a game match on a battle server using the virtual scene data processing method provided in this application embodiment;

[0036] Figure 10 This is a schematic diagram of the interface for battle settlement on the lobby server using the virtual scene data processing method provided in this application embodiment;

[0037] Figure 11This is a schematic diagram of the interface for the data processing method of the virtual scene provided in this application, which is based on battle settlement data to generate a leaderboard.

[0038] Figure 12 This is a flowchart illustrating the data processing method for virtual scenes provided in this application within a game business scenario;

[0039] Figure 13A This is a schematic diagram of the settlement process of the virtual scene data processing method provided in this application embodiment in a game game scene;

[0040] Figure 13B This is a schematic diagram of the settlement process of the virtual scene data processing method provided in this application embodiment in a game game scene;

[0041] Figure 13C This is a schematic diagram of the settlement process of the virtual scene data processing method provided in this application embodiment in a game game scene;

[0042] Figure 13D This is a schematic diagram of the anomaly detection process in a game scene using the virtual scene data processing method provided in this application embodiment;

[0043] Figure 13E This is a schematic diagram of the anomaly detection process in a game scene using the virtual scene data processing method provided in this application embodiment;

[0044] Figure 13F This is a schematic diagram of the anomaly detection process in a game scene using the virtual scene data processing method provided in this application embodiment;

[0045] Figure 14 This is a schematic diagram illustrating a basic upper limit check provided in the embodiments of this application. Detailed Implementation

[0046] To make the objectives, technical solutions, and advantages of this application clearer, the application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on this application. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0047] In the following description, references are made to “some embodiments,” which describe a subset of all possible embodiments. However, it is understood that “some embodiments” may be the same subset or different subsets of all possible embodiments and may be combined with each other without conflict.

[0048] It is understood that in the embodiments of this application, data related to user information (such as the interaction data of the object to be detected) is involved. When the embodiments of this application are applied to specific products or technologies, user permission or consent is required, and the collection, use and processing of related data must comply with relevant laws, regulations and standards.

[0049] In this application embodiment, the terms "module" or "unit" refer to a computer program or part of a computer program that has a predetermined function and works with other related parts to achieve a predetermined goal, and can be implemented wholly or partially using software, hardware (such as processing circuitry or memory), or a combination thereof. Similarly, a processor (or multiple processors or memory) can be used to implement one or more modules or units. Furthermore, each module or unit can be part of an overall module or unit that includes the functionality of that module or unit.

[0050] In the following description, the terms “first, second, ...” are used merely to distinguish similar objects and do not represent a specific ordering of objects. It is understood that “first, second, ...” may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in an order other than that illustrated or described herein.

[0051] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used herein is for the purpose of describing embodiments of this application only and is not intended to limit this application.

[0052] Before providing a further detailed description of the embodiments of this application, the nouns and terms involved in the embodiments of this application will be explained, and the nouns and terms involved in the embodiments of this application shall be interpreted as follows.

[0053] 1) Game configuration file: The game configuration file refers to the modifiable data configuration provided to the game designer in the game project, which is used to modify the relevant values ​​or parameters for the game to run.

[0054] 2) Mechanical Trial Gameplay: Mechanical Trial gameplay is a gameplay example used to support this solution. The core gameplay involves one or more players who upgrade and acquire equipment and items to complete levels.

[0055] 3) Leaderboard: The leaderboard is a system that displays players' performance, combat power, and other specific values ​​after the game data is aggregated and arranged according to certain dimensional rules. Players can obtain honor incentives and actual in-game rewards through the leaderboard.

[0056] 4) Lobby Server (gamesvr): The lobby server is a type of game server process used to carry out the lobby logic for players, such as starting a game, settling accounts, distributing rewards, and ranking players.

[0057] 5) Relaysvr (Relay Server): The Relaysvr is a type of game server process that carries the core combat logic for players and supports single-player or multiplayer games.

[0058] 6) Data Interface Server (idipsvr): The data interface server is also a type of game server process, used to provide data interface services to the outside world. Other services can use idipsvr to modify certain player data.

[0059] 7) Battle replay files: Battle replay files are generated after a player finishes a battle on the battle server (relaysvr) and are uploaded and saved to a dedicated recording server (COS). Other services can obtain the replay files of a specific battle from the recording server (COS).

[0060] 8) Game revenue data (tlog): Game revenue data is used to record key data of player game behavior, such as settlement data, behavior data, etc.

[0061] 9) Security Center: The security center is used to detect and review players' game behavior. In this application, it specifically refers to the security service deployed by the security center that is independent of the game server and can interact with the game server to provide security detection data.

[0062] 10) Coloring: Coloring refers to different security monitoring results. White indicates a legitimate result, gray indicates a questionable result, and black indicates an abnormal result. By coloring at different granularities, the credibility of security detection of player behavior can be identified.

[0063] In recent years, with the continuous expansion of the virtual scene industry, the number of users, programs, and data complexity have become increasingly higher. For multiplayer online games, data anomaly detection to ensure the legality and fairness of game data is a key issue to be addressed. Especially for leaderboard gameplay, each leaderboard position represents a player's honor in the game and comes with substantial in-game rewards, which is one of the core pursuits of players' gaming experience. If a player uses illegitimate means to forge game data (such as completion time, number of monsters killed in a single game, and other key ranking indicators) and gets on the leaderboard, it will seriously damage the actual interests of other players, undermine the fairness of the game, and cause serious harm and losses to normal players and game operators.

[0064] For data anomaly detection, the following related processing solutions exist:

[0065] (1) An anti-cheat system called “EFEREE Anti-Cheat Scheme” is adopted. A small software client runs on the player’s device. This client can detect and analyze the player’s behavior and device status. It mainly includes checking the player’s memory, hard drive and other hardware, as well as analyzing the player’s input and game behavior. When the client detects any suspicious behavior or anomaly, it will report to REFEREE’s server. The server can then decide whether to take appropriate action against the player. In addition, to protect the player’s privacy, the REFEREE client will only collect and analyze game-related data and will not collect any personal information. In actual application, REFEREE will embed an analyzer in the client package and collect device data, which will generate high data transmission and performance overhead and produce a relatively obvious latency perception.

[0066] (2) Use a kernel-level anti-cheating system. Kernel-level anti-cheating systems usually have deeper system access permissions to detect and block cheating behavior more effectively. However, such deep access may also bring risks, including potential privacy violations and system security issues, and can produce more obvious delay perception.

[0067] (3) An AI-based anti-cheating model was implemented using Python and YOLOv5, which will generate high performance overhead and produce relatively obvious latency perception.

[0068] Therefore, embodiments of this application provide a data processing method, apparatus, electronic device, computer-readable storage medium, and computer program product for virtual scenes, which can effectively reduce the user's perception of latency in the data processing process. The electronic device provided in this application can be implemented as a server, or implemented collaboratively by a server and a terminal. The following description uses an example of a data processing method for virtual scenes provided in this application implemented collaboratively by a server and a terminal.

[0069] For example, see Figure 1 , Figure 1 This is a schematic diagram of the architecture of a virtual scene data processing system 100 provided in an embodiment of this application. To support a data processing application for a virtual scene, such as... Figure 1 As shown, the virtual scene data processing system 100 includes: a server 200, a network 300, and a terminal 400. The terminal 400 is connected to the server 200 through the network 300. The network 300 can be a local area network (LAN), a wide area network (WAN), or a combination of both. The terminal 400 is a terminal associated with the user. A client 410 runs on the terminal 400. The client 410 can be various types of clients, such as game clients, instant messaging clients, etc.

[0070] In some embodiments, a user logs in to their player account through client 410 on terminal 400. Terminal 400 transmits player account-related data to server 200 via network 300, and performs related interactions on server 200, generating corresponding interaction data. Next, server 200 performs a first anomaly detection process on the first interaction data generated by the target object, obtaining a first anomaly detection result. Then, when the first anomaly detection result is deterministic, server 200 performs compliance operations corresponding to the deterministic result on the target object. Next, when the first anomaly detection result is non-deterministic, server 200 performs a second anomaly detection process on the second interaction data of the target object, obtaining a second anomaly detection result. The first and second interaction data are data generated by the target object participating in interactions in a virtual scene. Subsequently, server 200 performs compliance operations corresponding to the second anomaly detection result on the target object. Finally, after performing the corresponding compliance operations on the target object, server 200 transmits the result of the completed compliance operations to client 410 on terminal 400 via network 300, and displays the result of the corresponding compliance operations on client 410.

[0071] It should be noted that the technical solutions provided in this application can be applied to various application scenarios, such as game match anomaly detection, chat data anomaly detection, and information flow anomaly detection.

[0072] In some embodiments, taking the game match anomaly detection scenario as an example, a user logs in to their player account on the client and enters the match lobby. After a player finishes a match, the current match's settlement data and match recording are generated. The current match's settlement data undergoes a first anomaly detection process to obtain a first anomaly detection result. When the first anomaly detection result indicates that the settlement data is normal, the current player account is allowed to join the leaderboard normally. When the first anomaly detection result indicates that the settlement data is abnormal, the current player account is subject to penalties such as account banning or leaderboard suspension. When the first anomaly detection result indicates that the settlement data is questionable, the player's match recording undergoes a second anomaly detection process to obtain a second anomaly detection result. When the second anomaly detection result indicates that the settlement data is normal, the current player account is allowed to join the leaderboard normally. When the second anomaly detection result indicates that the settlement data is abnormal, the current player account is subject to penalties such as account banning or leaderboard suspension. When the second anomaly detection result indicates that the settlement data is questionable, the current player account's leaderboard joining operation is canceled, and the questionable match is recorded in the log. The penalties imposed on the player account are displayed in the game client.

[0073] In some embodiments, taking chat data anomaly detection as an example, a user logs in to their account in an instant messaging client and initiates a chat session. A first anomaly detection is performed on the user's current pending chat data, yielding a first anomaly detection result. If the first anomaly detection result indicates the pending chat data is normal, it is published, and the user can continue chatting. If the first anomaly detection result indicates the pending chat data is abnormal, the user's account is banned, or the abnormal portion of the abnormal chat data is hidden or modified. If the first anomaly detection result indicates the current chat data is questionable, a second anomaly detection is performed on all of the player's current chat data (i.e., pending chat data and historical chat data), yielding a second anomaly detection result. If the second anomaly detection result indicates the pending chat data is normal, it is published, and the user can continue chatting. If the second anomaly detection result indicates the pending chat data is abnormal, the user's account is banned, or the abnormal portion of the abnormal chat data is hidden or modified. If the second anomaly detection result indicates the pending chat data is questionable, the questionable chat data for the current user is recorded in the log.

[0074] Example, Figure 1 The server 200 can be a standalone physical server, a server cluster or distributed system composed of multiple physical servers, or a cloud server providing basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, content delivery networks (CDNs), and big data and artificial intelligence platforms. The terminal 400 can be a smartphone, tablet, laptop, desktop computer, smart speaker, smartwatch, in-vehicle terminal, etc., but is not limited to these. The terminal 400 and server 200 can be directly or indirectly connected via wired or wireless communication, which is not limited in this embodiment.

[0075] The structure of the electronic device provided in the embodiments of this application will be described below. Taking the electronic device as a server as an example, see... Figure 2 , Figure 2 This is a schematic diagram of the structure of the electronic device 500 provided in the embodiments of this application. Figure 2The illustrated electronic device 500 includes at least one processor 510, a memory 540, and at least one network interface 520. The various components in the electronic device 500 are coupled together via a bus system 530. It is understood that the bus system 530 is used to implement communication between these components. In addition to a data bus, the bus system 530 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 2 The general labeled all buses as Bus System 530.

[0076] The processor 510 can be an integrated circuit chip with signal processing capabilities, such as a general-purpose processor, a digital signal processor (DSP), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc.

[0077] User interface 530 includes one or more output devices 531 that enable the presentation of media content, including one or more speakers and / or one or more visual displays. User interface 530 also includes one or more input devices 532, including user interface components that facilitate user input, such as a keyboard, mouse, microphone, touch screen display, camera, other input buttons and controls.

[0078] The memory 540 may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state storage, hard disk drives, optical disk drives, etc. The memory 540 may optionally include one or more storage devices physically located away from the processor 510.

[0079] The memory 540 may include volatile memory or non-volatile memory, or both. The non-volatile memory may be read-only memory (ROM), and the volatile memory may be random access memory (RAM). The memory 540 described in this application embodiment is intended to include any suitable type of memory.

[0080] In some embodiments, memory 540 is capable of storing data to support various operations, examples of which include programs, modules, and data structures or subsets or supersets thereof, as illustrated below.

[0081] Operating system 541 includes system programs for handling various basic system services and performing hardware-related tasks, such as the framework layer, core library layer, and driver layer, for implementing various basic business functions and handling hardware-based tasks;

[0082] The network communication module 542 is used to reach other computing devices via one or more (wired or wireless) network interfaces 520, exemplary network interfaces 520 including: Bluetooth, WiFi, and Universal Serial Bus (USB), etc.

[0083] In some embodiments, the apparatus provided in this application can be implemented in software. Figure 2 A data processing device 543 for a virtual scene stored in memory 540 is shown. This device can be software in the form of programs and plugins, and includes the following software modules: a first processing module 5431, a first execution module 5432, a second processing module 5433, a second execution module 5434, a training module 5435, an interception module 5436, and a correction module 5437. These modules are logically connected and can therefore be arbitrarily combined or further separated according to the functions they implement. It should be noted that... Figure 2 For ease of explanation, all the above modules are shown at once. However, this should not be interpreted as excluding the implementation of the data processing device 543 in the virtual scene, which may only include the first processing module 5431, the first execution module 5432, the second processing module 5433, and the second execution module 5434. The functions of each module will be described below.

[0084] The data processing method for virtual scenes provided in this application will be specifically described below with reference to the exemplary application and implementation of the terminal device provided in the embodiments of this application.

[0085] See Figure 3 , Figure 3 This is a flowchart illustrating the data processing method for a virtual scene provided in this application embodiment, which will be combined with... Figure 3 The steps shown are explained.

[0086] In step 101, the first interaction data of the object to be detected is subjected to the first anomaly detection process to obtain the first anomaly detection result.

[0087] It should be noted that the first interaction data of the object to be detected refers to the interaction data generated by the object in different application scenarios. For example, in a gaming scenario, the interaction data could be the result data of the object during a game, or it could be a recording of the game. Similarly, in a chat scenario, the interaction data could be the data of a chat session to be published, or it could be the object's historical chat data and the data of a session to be published. The first interaction data of the object to be detected can be adjusted according to actual needs and is not specifically limited here.

[0088] In some embodiments, see Figure 4A, Figure 4A This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 4A As shown, Figure 3 Step 101 shown can be achieved through Figure 4A Steps 1011A to 1012A shown are implemented by combining Figure 4A The steps shown are explained.

[0089] In step 1011A, the indicators to be detected are extracted from the first interaction data of the object to be detected.

[0090] In some embodiments, firstly, the object to be detected is determined; then, first interaction data of the object to be detected is obtained, such as match settlement data in a game or conversation data in a chat session; then, the indicator to be detected is determined based on the content of the first interaction data; finally, the indicator to be detected is extracted from the first interaction data of the object to be detected.

[0091] Here, the indicator to be detected can be a preset value or a value that is dynamically determined according to different application scenarios and different detection requirements. No specific restrictions are imposed here.

[0092] For example, assuming a game match scenario, the player object to be detected is identified, and the player's match settlement data in the current match is obtained. Assuming that the match settlement data includes single game time, single damage, player object movement speed, player object skill information, etc., the single game time, single damage, and player movement speed are determined as the indicators to be detected based on the content of the match settlement data. Finally, the single game time, single damage, and player movement speed are extracted from the player object's current match settlement data based on the indicators to be detected.

[0093] For example, in a chat session scenario, we identify the chat object to be detected, obtain the chat object's session data in the current chat session, assuming that the session data includes the number of sessions, session content, chat duration, chat time, etc., and determine the number of sessions and chat time as the indicators to be detected based on the content of the session data. Finally, we extract the number of sessions and chat time from the chat object's current chat session data based on the indicators to be detected.

[0094] In step 1012A, when the indicator to be detected meets the indicator conditions, the first interaction data of the object to be detected is subjected to the first anomaly detection process to obtain the first anomaly detection result.

[0095] In some embodiments, each indicator to be detected is judged, and when the indicator to be detected meets the indicator conditions, a suitable first anomaly detection method is selected. The first anomaly detection method can be a statistical method or a machine learning method (e.g., based on clustering, classification, neural networks, etc.). Then, the selected first anomaly detection method is used to process the first interaction data of the object to be detected to obtain the first anomaly detection result.

[0096] For example, suppose in a game scenario, the indicators to be detected for the player object include indicator 1, indicator 2, indicator 3, and indicator 4. We determine the judgment condition 1 for indicator 1, judgment condition 2 for indicator 2, judgment condition 3 for indicator 3, and judgment condition 4 for indicator 4. An indicator condition is that the number of indicators satisfying the corresponding judgment condition is greater than 2. Assuming that the judgment determines that indicator 1 satisfies judgment condition 1, indicator 2 does not satisfy judgment condition 2, indicator 3 satisfies judgment condition 3, and indicator 4 satisfies judgment condition 4, and the number of indicators satisfying the corresponding judgment condition is 3 (greater than 2), then the detected indicator satisfies the indicator condition. In this case, a pre-trained neural network model is selected to perform the first anomaly detection on the game settlement data, obtaining the first anomaly detection result (e.g., the game settlement data is normal, the game settlement data is abnormal, or the game settlement data is questionable and requires further detection).

[0097] In some embodiments, the first interaction data includes the game settlement data of the object to be detected in the virtual scene. Step 1012A above can also be implemented in the following way: when the game settlement data is within the reward range of the virtual scene, the first interaction data of the object to be detected is subjected to the first anomaly detection processing to obtain the first anomaly detection result.

[0098] In some embodiments, firstly, the game settlement data of the object to be detected is obtained, and the game settlement data is compared with the reward range of the virtual scene. When the game settlement data is within the reward range of the virtual scene, the game settlement data of the object to be detected is subjected to a first anomaly detection to obtain the corresponding first anomaly detection result.

[0099] For example, suppose the game settlement data of the object to be detected includes the object's game score, and the object needs a game score of more than 1000 points to receive a reward (i.e., it is within the reward range). The game settlement data of the object to be detected contains the object's game score of 2800 points, which means that the current game settlement data is within the reward range of the virtual scene. The first anomaly detection process is performed on the game settlement data of the object to be detected to obtain the first anomaly detection result, so as to determine whether there is an anomaly in the game settlement data of the object to be detected.

[0100] In another example, suppose the game settlement data of the object to be detected includes the object's game type information, and the object's game type information is that only special levels can get rewards (i.e., it is within the reward range). The game type of the object to be detected is a special level, that is, the current game settlement data is within the reward range of the virtual scene. The first anomaly detection process is performed on the game settlement data of the object to be detected to obtain the first anomaly detection result, so as to determine whether there is an anomaly in the game settlement data of the object to be detected.

[0101] In some embodiments, when the game settlement data is within the reward range of the virtual scene, the first interaction data of the object to be detected is subjected to first anomaly detection processing. After obtaining the first anomaly detection result, the following processing can also be performed: when the game settlement data is not within the reward range of the virtual scene, the game settlement data of the object to be detected is subjected to positive dimension compliance operation.

[0102] Continuing with the example above, assuming that an object needs a score of over 1000 to receive a reward (i.e., it is within the reward range), and the object's score in the match settlement data is 800, then the current match settlement data is not within the reward range of the virtual scene. Therefore, the match settlement data of the object to be tested can be processed normally without providing a match reward.

[0103] Continuing from the previous example, assuming the game type of the object to be tested is a normal level, that is, the current game settlement data is not within the reward range of the virtual scene, the game settlement data of the object to be tested can be directly processed as a normal level without adding it to the leaderboard or other processing.

[0104] In some embodiments, after performing step 1012A above, the following processing may also be performed: when the indicator to be detected does not meet the indicator conditions, compliance operations of the negative dimension are performed on the object to be detected.

[0105] For example, suppose in a game scenario, the indicators to be detected for the player being tested include indicator 1, indicator 2, indicator 3, and indicator 4. We determine the judgment condition 1 for indicator 1, judgment condition 2 for indicator 2, judgment condition 3 for indicator 3, and judgment condition 4 for indicator 4. An indicator condition is that the number of indicators satisfying the corresponding judgment condition is greater than 2. If, through judgment, it is determined that indicator 1 satisfies judgment condition 1, indicator 2 does not satisfy judgment condition 2, indicator 3 does not satisfy judgment condition 3, and indicator 4 does not satisfy judgment condition 4, and the number of indicators satisfying the corresponding judgment condition is 1 (less than 2), then the player being tested does not meet the indicator condition. Therefore, it is determined that the player's game data is abnormal, and compliance actions such as account banning and leaderboard suspension are performed on the player being tested.

[0106] In some embodiments, deterministic results include negative detection results and positive detection results, while uncertain results include undetermined anomaly detection results. See [link to relevant documentation]. Figure 4B , Figure 4B This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 4B As shown, Figure 3 Step 101 shown can be achieved through Figure 4B Steps 1011B to 1014B shown are implemented by combining Figure 4B The steps shown are explained.

[0107] In step 1011B, the first anomaly detection process is performed on the first interaction data of the object to be detected using the first anomaly detection model to obtain the compliance confidence level of the corresponding object to be detected.

[0108] In some embodiments, firstly, features are extracted from the first interaction data of the object to be detected to obtain the corresponding interaction data features; then, the extracted interaction data features are input into the first anomaly detection model for anomaly detection to obtain the corresponding anomaly probability; finally, the compliance confidence level of the corresponding object to be detected is calculated based on the obtained anomaly probability.

[0109] For example, taking a game match scenario, after obtaining the first interaction data of the object to be detected, the first interaction data of the object to be detected will be used to extract features to obtain the corresponding interaction data features (such as game match duration, game kills, etc.). The extracted interaction data features are then input into the first anomaly detection model for anomaly detection. The model will analyze the interaction data features and output an anomaly probability. Assuming that the output anomaly probability is 0.1, the compliance confidence of the object to be detected calculated based on the anomaly probability is 0.9, that is, the model has a 90% confidence that the interaction data of the object to be detected is compliant.

[0110] In step 1012B, when the compliance confidence level is less than the first confidence level threshold, the negative detection result is taken as the first anomaly detection result.

[0111] Here, the first confidence threshold can be a preset value or it can be dynamically set according to different anomaly detection needs; no specific limitation is made here.

[0112] For example, suppose the compliance confidence score obtained through the first anomaly detection is 0.3 and the first confidence score threshold is 0.4. That is, the compliance confidence score is less than the first confidence score threshold. Then, the negative detection result is taken as the first anomaly detection result. For example, in a game game scenario, it is determined that the game data of the player to be detected is abnormal.

[0113] In step 1013B, when the compliance confidence level is greater than the second confidence level threshold, the positive detection result is taken as the first anomaly detection result.

[0114] Here, the second confidence threshold can be a preset value or it can be dynamically set according to different anomaly detection needs. The second confidence threshold can be the same as or different from the first confidence threshold, and no specific limitation is made here.

[0115] For example, suppose the compliance confidence score obtained through the first anomaly detection is 0.7 and the second confidence score threshold is 0.5. That is, the compliance confidence score is greater than the second confidence score threshold. Then, the positive detection result is taken as the first anomaly detection result. For example, in a game game scenario, it is determined that the game data of the player object to be detected has no anomalies.

[0116] In step 1014B, when the compliance confidence level is not less than the first confidence level threshold and not greater than the second confidence level threshold, the pending anomaly detection result is taken as the first anomaly detection result.

[0117] For example, suppose the compliance confidence score obtained through the first anomaly detection is 0.5, the first confidence threshold is 0.3, and the second confidence threshold is 0.7. That is, the compliance confidence score is greater than the first confidence threshold and less than the second confidence threshold. Then, the pending anomaly detection result is taken as the first anomaly detection result. For example, in a game game scenario, the game data of the player object to be detected is determined as pending anomaly data.

[0118] In some embodiments, the first anomaly detection is implemented by calling a first anomaly detection model. Before executing step 101, the following processing may also be performed: obtaining training samples constructed based on historical first interaction data, wherein the training samples are historical first interaction data, and the sample labels corresponding to the training samples are the label compliance confidence levels corresponding to the historical first interaction data; calling the data analysis model to be trained to perform first anomaly detection processing on the historical first interaction data to obtain the predicted compliance confidence level; determining the first loss between the label compliance confidence level and the predicted compliance confidence level, and updating the first anomaly detection model based on the first loss.

[0119] In some embodiments, firstly, historical first interaction data is acquired, and a sample label is assigned to each historical first interaction data instance. The sample label is the label compliance confidence level corresponding to the historical first interaction data. This compliance confidence level can be obtained through the output of other models or manually labeled. The historical first interaction data and its corresponding sample labels are used to construct training samples. Next, a suitable data analysis model is selected. The selected model can handle the anomaly detection task and output compliance confidence levels. Then, the historical first interaction data from the training samples is input into the selected data analysis model. The data analysis model analyzes the historical first interaction data and outputs the predicted compliance confidence level of the historical first interaction data. Afterward, a first loss is calculated between the label compliance confidence level and the predicted compliance confidence level. Here, the first loss is a metric used to measure the prediction error of the first anomaly detection model and can be calculated using loss functions such as root mean square error (MSE) or cross-entropy loss. Finally, based on the first loss, gradient descent or other optimization algorithms are used to update the model parameters, resulting in the trained first anomaly detection model.

[0120] For example, suppose there is a set of historical interaction data, where each historical interaction corresponds to a compliance confidence score. The historical interaction data and its corresponding compliance confidence scores are used to construct training samples. Next, a neural network-based data analysis model is trained using these training samples. This model analyzes the historical interaction data and outputs the predicted compliance confidence score for each historical interaction. Then, the historical interaction data from the training samples is input into the data analysis model for prediction, resulting in the predicted compliance confidence score for the historical interaction (e.g., 0.85). Finally, the first loss is calculated between the labeled compliance confidence score (e.g., 0.9) and the predicted compliance confidence score (e.g., 0.85). Assuming the root mean square error is used as the loss function, the first loss might be (0.9 - 0.85). 2 =0.025; Finally, update the model parameters based on the calculated first loss. In this way, by continuously iterating the above process, the model is continuously improved, increasing the accuracy of the model's predictive confidence and thus accurately identifying anomalies in interactive data.

[0121] In practical applications, a first loss is determined between the label compliance confidence and the predicted compliance confidence. When the first loss of the first anomaly detection model reaches the parameter threshold, the corresponding predicted compliance confidence is determined based on the first loss of the first anomaly detection model. The predicted compliance confidence is backpropagated in the first anomaly detection model, and the model parameters of the first anomaly detection model are updated during the propagation process.

[0122] Here's an explanation of backpropagation: Training samples are input into the input layer of a neural network model, pass through the hidden layers, and finally reach the output layer to output the result. This is the forward propagation process of the neural network model. Since there is an error between the output result of the neural network model and the actual result, the error between the result and the actual value is calculated and propagated back from the output layer to the hidden layers until it reaches the input layer. During the backpropagation process, the values ​​of the model parameters are adjusted according to the error. This process is iterated until convergence.

[0123] Taking the first loss calculated by the first anomaly detection model in this embodiment as an example, the server determines the corresponding difference value based on the first loss, and propagates the difference value backward from the output layer of the first anomaly detection model. The difference value is propagated backward layer by layer in the first anomaly detection model. When the difference value reaches each layer, the gradient (that is, the partial derivative of the first loss with respect to the parameters of each layer) is solved by combining the propagated difference value, and the gradient value of the parameters of each layer in the first anomaly detection model is updated.

[0124] In step 102, when the first anomaly detection result is a deterministic result, the corresponding compliance operation for the deterministic result is performed on the object to be detected.

[0125] Here, the deterministic result includes whether the interaction data of the object to be detected is normal or abnormal. The deterministic result can be obtained directly from the model output, or it can be determined by comparing the compliance confidence score obtained from the model output with a set threshold (for example, if the first threshold is set to 0.5, then when the compliance confidence score obtained from the model output is greater than 0.5, it means that the interaction data of the object to be detected is normal; if the second threshold is set to 0.3, then when the compliance confidence score obtained from the model output is less than 0.3, it means that the interaction data of the object to be detected is abnormal).

[0126] In some embodiments, after obtaining the first anomaly detection result, if the first anomaly detection result indicates that the interaction data of the object to be detected is normal, then compliant operations are performed on the object to be detected that indicate normal interaction data (e.g., in a game match scenario, normal settlement processing is performed on player objects with normal game match settlement data); if the first anomaly detection result indicates that the interaction data of the object to be detected is abnormal, then compliant operations are performed on the object to be detected that indicate abnormal interaction data (e.g., in a game match scenario, account bans, leaderboard bans, and other prohibited penalty operations are performed on player objects with abnormal game match settlement data). Thus, when a deterministic result is obtained after the interaction data undergoes the first anomaly detection processing, the corresponding compliant operations can be directly performed on the object to be detected based on the obtained deterministic result, effectively reducing the user's perception of latency in the data processing process.

[0127] In step 103, when the first anomaly detection result is a non-deterministic result, the second interaction data of the object to be detected is subjected to second anomaly detection processing to obtain the second anomaly detection result.

[0128] Here, the first interaction data and the second interaction data are the data generated by the object to be detected participating in interactions in the virtual scene.

[0129] It should be noted that the first interactive data and the second interactive data can be the same or different. The first anomaly detection processing and the second anomaly detection processing can use the same anomaly detection method or different anomaly detection methods. No specific restrictions are made here.

[0130] For example, in a game match scenario, the first interactive data can refer to the current game match settlement data, and the second interactive data can refer to the game replay of the current game match; in a chat session scenario, the first interactive data can refer to the user's pending session data in the current chat session, and the second interactive data can refer to the user's historical session data and pending session data in the current chat session.

[0131] In some embodiments, see Figure 5A , Figure 5A This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 5A As shown, Figure 3 Step 103 shown can be achieved through Figure 5A Steps 1031A to 1032A shown are implemented by combining Figure 5A The steps shown are explained.

[0132] In step 1031A, the compliance confidence level of the corresponding first anomaly detection result is obtained.

[0133] Here, the compliance confidence of the first anomaly detection result is obtained by performing the first legacy management detection process on the first interaction data of the object to be detected through the first anomaly detection model in step 1011B above. The specific implementation method can be referred to step 1011B, and will not be repeated here.

[0134] In step 1032A, the second anomaly detection model that matches the compliance confidence level is invoked to perform second anomaly detection processing on the second interaction data of the object to be detected, and the second anomaly detection result is obtained.

[0135] Here, the detection granularity of the second anomaly detection model is positively correlated with the compliance confidence level of the corresponding first anomaly detection result.

[0136] In some embodiments, firstly, one or more second anomaly detection models are designed, with different detection granularities between the different second anomaly detection models. The detection granularity of each model is associated with the compliance confidence level. For example, the lower the compliance confidence level, the finer the detection granularity, so as to analyze the anomalies in the interaction data more deeply. Next, the compliance confidence level of the first anomaly detection model is obtained, and the corresponding matching second anomaly detection model is selected according to the compliance confidence level. Finally, the selected second anomaly detection model is used to perform anomaly detection on the second interaction data of the object to be detected, and the second anomaly detection result is obtained.

[0137] For example, suppose we design three second anomaly detection models, with detection granularities of detection granularity 1, 2, and 3, respectively. We obtain the compliance confidence scores from the second anomaly detection models. If the compliance confidence score is less than a first threshold, we use the second anomaly detection model corresponding to detection granularity 1 to perform anomaly detection and obtain a second anomaly detection result. If the compliance confidence score is greater than the first threshold but less than the second threshold, we use the second anomaly detection model corresponding to detection granularity 2 to perform anomaly detection and obtain a second anomaly detection result. If the compliance confidence score is greater than the second threshold, we use the second anomaly detection model corresponding to detection granularity 3 to perform anomaly detection and obtain a second anomaly detection result.

[0138] In some embodiments, the second anomaly detection is implemented by invoking a second anomaly detection model. Before executing step 1032A, the following processing may also be performed: obtaining training samples constructed based on historical second interaction data, wherein the training samples are historical second interaction data, and the sample labels corresponding to the training samples are the label compliance confidence levels corresponding to the historical second interaction data; invoking the anomaly detection model to be trained, performing second anomaly detection processing on the historical second interaction data to obtain the predicted compliance confidence level; determining the second loss between the label compliance confidence level and the predicted compliance confidence level, and updating the second anomaly detection model based on the second loss.

[0139] In some embodiments, the training process of the second anomaly detection model is similar to that of the first anomaly detection model described above. For details, please refer to the training process of the first anomaly detection model, which will not be repeated here.

[0140] In some embodiments, the second interactive data includes the recorded game of the object to be detected in the virtual scene, and the first interactive data includes the game settlement data of the object to be detected in the virtual scene. See [link to documentation]. Figure 5B , Figure 5B This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 5B As shown, Figure 3 Step 103 shown can be achieved through Figure 5BSteps 1031B to 1033B shown are implemented by combining Figure 5B The steps shown are explained.

[0141] In step 1031B, the game recording of the target game is processed to generate game settlement data, and the replay game settlement data of the corresponding game recording is obtained.

[0142] In some embodiments, firstly, relevant information about the recorded game to be tested is obtained, such as the game time, participating players, and game results; then, the recorded game is converted to obtain converted data (e.g., converting the game steps in the video file into text or structured data); subsequently, based on the converted data, the game process is simulated, and key information for each game step is recorded (e.g., player actions, resource consumption, and score changes); then, the final result of the game to be tested is statistically analyzed to obtain the replay game settlement data of the recorded game; finally, a corresponding data report can be generated based on the replay game settlement data.

[0143] For example, taking an online strategy game as an example, firstly, the game replay is acquired, recording the entire game between player A and player B. Next, each step in the replay is extracted, such as the actions of player A and player B, and an operation log is generated based on the extracted content. Then, based on the operation log, the game process is simulated, recording key information for each step, such as how many resources player A has at a given time, and when a certain building of player B is constructed. After the game ends, based on the recorded key information from each step, the final resource quantity and building quantity of player A and player B are calculated, i.e., the replay settlement result. Finally, a corresponding data report is generated based on the replay settlement result. In this way, the replay settlement result can be obtained from the replay replay, allowing for further anomaly detection of interactive data, thereby more accurately determining whether the interactive data of the object to be detected is abnormal.

[0144] In step 1032B, when the similarity between the replay game settlement data and the game settlement data is higher than the first similarity threshold, the positive detection result is taken as the second anomaly detection result.

[0145] Here, the first similarity threshold can be a preset value or it can be dynamically determined according to the specific needs of anomaly detection processing; no specific limitation is made here.

[0146] In some embodiments, firstly, game settlement data and replay game settlement data are obtained; then, the settlement similarity between the two data is calculated using a corresponding algorithm (e.g., text similarity calculation, data pattern matching, etc.). When the settlement similarity is higher than the first similarity threshold, it indicates that there is no abnormality in the game settlement data, and the normal interaction data of the object to be detected is taken as the second abnormality detection result.

[0147] For example, taking a game match scenario as an example, suppose the current game recording is reviewed through a video replay system to obtain the replay game settlement data. The first similarity threshold is 90%, and the settlement similarity between the game settlement data and the replay game settlement data is 95%. Then, the normal interaction data of the object to be detected is taken as the second anomaly detection result.

[0148] In step 1033B, when the settlement similarity is not higher than the first similarity threshold, the negative detection result is used as the second anomaly detection result.

[0149] In some embodiments, the settlement similarity between two data is calculated using a corresponding algorithm (e.g., text similarity calculation, data pattern matching, etc.). When the settlement similarity is not higher than the first similarity threshold, it indicates that there is an anomaly in the game settlement data, and the anomaly in the interaction data of the object to be detected is taken as the second anomaly detection result.

[0150] For example, taking a game match scenario as an example, suppose the current game recording is reviewed through a video replay system to obtain the replay game settlement data. The first similarity threshold is 90%, and the settlement similarity between the game settlement data and the replay game settlement data is 85%. Then, the abnormal interaction data of the object to be detected is taken as the second abnormality detection result.

[0151] In some embodiments, the second interactive data includes a video recording of a game played by the object to be detected in a virtual scene, see [link to relevant documentation]. Figure 5C , Figure 5C This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 5C As shown, Figure 3 Step 103 shown can be achieved through Figure 5C The implementation of steps 1031C to 1033C shown will be combined with Figure 5C The steps shown are explained.

[0152] In step 1031C, target detection processing is performed on the video recording of the target to be detected to obtain the video frame of the corresponding abnormal operation event.

[0153] In some embodiments, firstly, the game recording to be detected is acquired, and the game recording can be preprocessed to ensure that the video quality meets the requirements of object detection; then, visual features corresponding to abnormal operations are extracted, such as color, shape, motion trajectory, etc.; next, an appropriate object detection model is selected, such as YOLO, SSD, Faster R-CNN, etc.; then, the game recording is decomposed into individual recording frames, and for each generated recording frame, the object detection model is used to identify and label the recording frames that may contain abnormal operations; finally, the recording frames containing abnormal operations are saved separately.

[0154] For example, taking a game match scenario, firstly, the abnormal movement speed or behavior pattern of the abnormal player object may be identified; then, the YOLO algorithm is used as the object detection model to detect the position and behavior of the player object in the game match. When the detection model identifies that the player object has moved an abnormal distance or completed an impossible action in a very short period of time, these video frames will be marked as abnormal events; finally, the video frames containing abnormal events are saved separately for further detection and analysis.

[0155] In some embodiments, before performing step 1031C above, the following operations may also be performed: acquiring a complete game recording of the object to be detected in a virtual scene; performing interception processing on the complete game recording based on the target type of operation events to obtain the game recording of the object to be detected in the virtual scene; wherein, the number of operation events is negatively correlated with the compliance confidence of the corresponding first anomaly detection result.

[0156] In some embodiments, firstly, the types of operation events in the game recording to be detected are determined. The types of operation events can be preset values ​​or dynamically determined according to the specific needs of anomaly detection processing, without specific limitations. Next, video analysis and object detection technologies are used to analyze the complete game recording of the object to be detected to identify operation events. Then, for each identified operation event, a video segment containing the event is extracted, and the extracted video segment is used as the game recording of the object to be detected in the virtual scene. The number of detected operation events is negatively correlated with the compliance confidence of the first anomaly detection result. That is, the higher the compliance confidence of the first anomaly detection result, the fewer the number of detected anomaly events, and the shorter the extracted game recording.

[0157] For example, suppose in a game match scenario, the type of operation event in the match recording to be detected is determined to be a player object movement operation. Through the video analysis system, it is identified that the player object moved abnormally 100 times. The video clip containing the abnormal movement is extracted from the match recording and used as the match recording to be detected in the virtual scene.

[0158] In some embodiments, the second anomaly detection process is implemented by calling the target detection model. Before executing step 1032C, the following processes may also be performed: obtaining training samples constructed based on historical game recordings, wherein the training samples are historical game recordings and the sample labels corresponding to the training samples are the abnormal operation events marked in the historical game recordings; calling the target detection model to be trained to perform the second anomaly detection process on the historical game recordings to obtain the predicted abnormal operation events; determining the third loss between the marked abnormal operation events and the predicted abnormal operation events, and updating the target detection model based on the third loss.

[0159] In some embodiments, the training process of the target detection model is similar to that of the first anomaly detection model described above. For details, please refer to the training process of the first anomaly detection model, which will not be repeated here.

[0160] In step 1032C, when the number of video frames corresponding to the abnormal operation event is higher than the first number threshold, the negative detection result is used as the second abnormal detection result.

[0161] Here, the first threshold number can be a preset value or a dynamically set value according to different anomaly detection requirements; no specific limitation is made here.

[0162] In some embodiments, after identifying and labeling video frames that may have abnormal operations using an object detection model, the number of video frames with abnormal operations is counted. If the number of video frames with abnormal operations is higher than a first threshold, the negative detection result is used as the second abnormal detection result.

[0163] For example, suppose that after statistics, the number of video frames with abnormal operations is 30, and the first number threshold is 10. That is, the number of video frames with abnormal operations is higher than the first number threshold. Then, the negative detection result is used as the second anomaly detection result. For example, in a game game scenario, it is determined that the game data of the player to be detected is abnormal.

[0164] In step 1033C, when the number of video frames corresponding to the abnormal operation event is not higher than the first number threshold, the positive detection result is taken as the second abnormal detection result.

[0165] In some embodiments, after identifying and labeling video frames that may have abnormal operations using an object detection model, the number of video frames with abnormal operations is counted. If the number of video frames with abnormal operations is not higher than a first number threshold, the positive detection result is taken as the second abnormal detection result.

[0166] For example, suppose that after statistics, the number of video frames with abnormal operations is 5, and the first threshold is 10. That is, the number of video frames with abnormal operations is less than the first threshold. Then, the positive detection result is taken as the second abnormal detection result. For example, in a game game scenario, it is determined that the game data of the player object to be detected is normal.

[0167] In some embodiments, Figure 5D This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 5D As shown, Figure 3 Step 103 shown can be achieved through Figure 5D The implementation of steps 1031D to 1032D shown will be combined with Figure 5D The steps shown are explained.

[0168] In step 1031D, when the computational complexity of the second anomaly detection processing is greater than the first complexity threshold, the second anomaly detection processing is performed on the second interactive data of the object to be detected based on an asynchronous mechanism to obtain the second anomaly detection result.

[0169] Here, the asynchronous mechanism refers to the asynchronous execution of the interaction logic between the second anomaly detection process and the object to be detected in the virtual scene.

[0170] In some embodiments, the computational complexity of the second anomaly detection process is first determined. Here, the computational complexity can be determined by comparing the time complexity of different algorithms, by comparing the detection granularity of different algorithms, or by the degree of system resource consumption of different algorithms, without specific limitations. Next, the determined computational complexity is compared with a first complexity threshold. When the computational complexity is greater than the first complexity threshold, an asynchronous mechanism is triggered to perform the second anomaly detection process on the second interactive data of the object to be detected, and the second anomaly detection result is obtained.

[0171] For example, taking a game scenario, the computational complexity of the second anomaly detection process is determined to be 10 based on its time complexity. The first complexity threshold is 8, meaning the computational complexity of the second anomaly detection process is greater than the first complexity threshold. Therefore, an asynchronous mechanism is used to make the second anomaly detection process and the player object's interaction logic in the game execute asynchronously. For example, the second anomaly detection process can be executed after the player object goes offline.

[0172] In step 1032D, when the computational complexity of the second anomaly detection process is not greater than the first complexity threshold, the second anomaly detection process is performed on the second interactive data of the object to be detected based on the synchronization mechanism to obtain the second anomaly detection result.

[0173] Here, the synchronization mechanism refers to the linear execution of the interaction logic between the second anomaly detection process and the object to be detected in the virtual scene.

[0174] In some embodiments, the determined computational complexity is compared with a first complexity threshold. When the computational complexity is not greater than the first complexity threshold, a synchronization mechanism is triggered to perform second anomaly detection processing on the second interactive data of the object to be detected, and a second anomaly detection result is obtained.

[0175] For example, taking a game scenario, the computational complexity of the second anomaly detection process is determined to be 2 based on its time complexity, and the first complexity threshold is 8. That is, the computational complexity of the second anomaly detection process is less than the first complexity threshold. Therefore, a synchronization mechanism is adopted to ensure that the interaction logic between the second anomaly detection process and the player object in the game is executed linearly. For example, the second anomaly detection process can be executed after the player object finishes the game online.

[0176] In step 104, compliance operations corresponding to the second anomaly detection result are performed on the object to be detected.

[0177] In some embodiments, after obtaining the second anomaly detection result, if the second anomaly detection result indicates that the interaction data of the object to be detected is normal, then the object to be detected is subjected to compliant operations with normal interaction data (e.g., in a game match scenario, normal settlement processing is performed on player objects with normal game match settlement data); if the second anomaly detection result indicates that the interaction data of the object to be detected is abnormal, then the object to be detected is subjected to compliant operations with abnormal interaction data (e.g., in a game match scenario, account bans, leaderboard bans, and other prohibited penalty operations are performed on player objects with abnormal game match settlement data); if the second anomaly detection result indicates that the interaction data of the object to be detected is questionable, then compliant operations with questionable interaction data are recorded for the object to be detected (e.g., in a game match scenario, the settlement of the player object's current game match is canceled, and the player's settlement data for the current game match is recorded in the log).

[0178] In some embodiments, the first interaction data is the pending session data of the object to be detected within the virtual scene, and the second interaction data is the historical session data and pending session data of the object to be detected within the virtual scene. Figure 6 This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 6 As shown, Figure 3 Step 104 shown can be achieved through Figure 6 Steps 1041 to 1042 shown are implemented, and will be combined with Figure 6 The steps shown are explained.

[0179] In step 1041, when the second anomaly detection result is a negative detection result, anomaly correction processing is performed on the session data to be published to obtain the corrected session data to be published, and the publishing process for the corrected session data to be published is executed.

[0180] In some embodiments, a second anomaly detection is performed on the session data to be published. When the detection result is negative, that is, the session data to be published is abnormal, the session data will not be published immediately, but will enter the anomaly correction process. Then, the abnormal part in the session data is identified, the session data to be published is automatically corrected according to the type of anomaly, and the corrected session data will be published according to the normal publishing process.

[0181] For example, taking a chat session platform as an example, the system performs a second anomaly detection to check whether there are any anomalies in the session data to be published (such as inappropriate language). When there are anomalies in the session data to be published, the session data will not be published immediately. Instead, it will enter the anomaly correction process, identify the abnormal parts in the session data, and automatically repair the session data to be published according to the anomaly type in the abnormal parts. The corrected session data will then be published according to the normal publishing process.

[0182] In step 1042, when the second anomaly detection result is a positive detection result, the publishing process for the corrected session data to be published is executed.

[0183] For example, taking a chat session platform as an example, the system performs a second anomaly detection to check whether there are any anomalies in the session data to be published (such as inappropriate language); if the session data to be published is normal, it will be published directly according to the normal publishing process.

[0184] In some embodiments, Figure 7 This is a flowchart illustrating the data processing method for a virtual scene provided in an embodiment of this application, as shown below. Figure 7 As shown, during execution Figure 3 Before step 104 shown, the following steps can also be performed: Figure 7 Steps 105 to 107 shown are implemented by combining Figure 7 The steps shown are explained.

[0185] In step 105, the first weight corresponding to the first anomaly detection result and the second weight corresponding to the second anomaly detection result are obtained.

[0186] Here, the first and second weights can be determined by independently evaluating the two anomaly detection models and having experts evaluate the output results of the two anomaly detection models to obtain the reliability and weight of each model; alternatively, attention mechanisms can be used to calculate the weight ratio of the output results of the two anomaly detection models respectively. The specific method for determining the weights can be selected according to actual needs, and no specific limitation is made here.

[0187] For example, suppose there are two anomaly detection models, Model A and Model B. If Model A performs better in text analysis, and text analysis is a key part of the current task, then Model A may be given a higher weight (e.g., 0.7). If Model B performs better in behavioral pattern analysis, and behavioral analysis is also very important to the current task, then Model B may be given a lower weight (e.g., 0.3).

[0188] In step 106, based on the first weight and the second weight, the compliance confidence scores of the corresponding first anomaly detection results and the corresponding second anomaly detection results are weighted and fused to obtain the fused compliance confidence score.

[0189] In some embodiments, after determining the first weight and the second weight, the compliance confidence of the first anomaly detection result is multiplied by the first weight to obtain the first multiplication result; the compliance confidence of the second anomaly detection result is multiplied by the second weight to obtain the second multiplication result; the first multiplication result and the second multiplication result are added together, and the resulting sum is used as the fused compliance confidence.

[0190] For example, assuming model A has a compliance confidence score of 0.8, model B has a compliance confidence score of 0.7, model A has a weight of 0.6, and model B has a weight of 0.4, multiplying the compliance confidence score of model A by its weights yields a first multiplication result of 0.48. Multiplying the compliance confidence score of model B by its weights yields a second multiplication result of 0.28. Adding the first and second multiplication results together gives a final fused compliance confidence score of 0.76. This allows for a more comprehensive and accurate assessment of data compliance, providing a more reliable basis for decision-making.

[0191] In step 107, the second anomaly detection result is updated based on the fusion compliance confidence level to obtain the updated second anomaly detection result.

[0192] In some embodiments, the second anomaly detection result is updated based on the fusion compliance confidence level. This may involve adjusting the confidence level of the second anomaly detection result or reclassifying the second anomaly detection result based on the fusion compliance confidence level.

[0193] For example, after calculating the fusion compliance confidence score, assuming the fusion compliance confidence score is 0.76, the fusion compliance confidence score is compared with a confidence threshold. If the fusion compliance confidence score is greater than the first confidence threshold, the second anomaly detection result is updated to indicate that the interaction data of the object under test is normal; if the fusion compliance confidence score is less than the second confidence threshold, the second anomaly detection result is updated to indicate that the interaction data of the object under test is abnormal; if the fusion compliance confidence score is less than the first confidence threshold but greater than the second confidence threshold, the second anomaly detection result is updated to indicate that the interaction data of the object under test is questionable.

[0194] In some embodiments, step 104 above can be implemented by performing compliance operations on the corresponding updated second anomaly detection result for the object to be detected.

[0195] In some embodiments, after obtaining the updated second anomaly detection result, if the updated second anomaly detection result indicates that the interaction data of the object to be detected is normal, then the object to be detected is subjected to compliant operations for normal interaction data (e.g., in a game match scenario, normal settlement processing is performed on player objects with normal game match settlement data); if the updated second anomaly detection result indicates that the interaction data of the object to be detected is abnormal, then the object to be detected is subjected to compliant operations for abnormal interaction data (e.g., in a game match scenario, account bans, leaderboard bans, and other prohibited penalty operations are performed on player objects with abnormal game match settlement data); if the updated second anomaly detection result indicates that the interaction data of the object to be detected is questionable, then the object to be detected is subjected to compliant operations for questionable interaction data (e.g., in a game match scenario, the current match settlement of the player object is canceled, and the match record with questionable interaction data unique to the object to be detected is recorded in the log).

[0196] In some embodiments, the following operations may also be performed: obtaining object authorization data of the object to be detected within the virtual scene; performing at least one of the following processes: correcting the first anomaly detection result based on the object authorization data to obtain a corrected first anomaly detection result; and correcting the second anomaly detection result based on the object authorization data to obtain a corrected second anomaly detection result.

[0197] In some embodiments, object authorization data of the object to be detected is obtained from the data source of the virtual scene, such as the object's historical behavior information, the object's historical reputation, etc.; then, the first anomaly detection result can be corrected according to the obtained object authorization data to obtain the corrected first anomaly detection result; the second anomaly detection result can also be corrected according to the obtained object authorization data to obtain the corrected second anomaly detection result; or the first anomaly detection result and the second anomaly detection result can be corrected sequentially according to the obtained object authorization information to obtain the corrected first anomaly detection result and the corrected second anomaly detection result.

[0198] It should be noted that the anomaly detection results can be corrected by assigning weights to the object's authorization information and anomaly detection results and then performing a weighted summation. Alternatively, based on the object's authorization information, potential anomaly indicators of the object can be identified, and then anomaly detection can be performed again on potential anomaly indicators in the object's interaction data to obtain a corrected anomaly detection result.

[0199] For example, taking a game match scenario, we obtain the historical match behavior information of a player object (e.g., the player object exhibits historical abnormal game behavior). Suppose the first anomaly detection result for the player object's game match is questionable; however, the player object's historical match behavior information does contain historical abnormal game behavior. By combining the first anomaly detection result and the player object's historical match behavior information, we determine that the player object's game match settlement data is abnormal. That is, the corrected first anomaly detection result is that the player object's game match settlement data is abnormal. In this way, we can effectively utilize the object's historical match behavior information to correct the anomaly detection result, thereby reducing false positives and improving the accuracy of anomaly detection.

[0200] In some embodiments, the detection speed of the first anomaly detection process is higher than that of the second anomaly detection process, and the detection accuracy of the first anomaly detection process is lower than that of the second anomaly detection process.

[0201] For example, assuming the first anomaly detection process has high detection speed and the second anomaly detection process has high detection accuracy, the two processes together construct an anomaly detection system. In the first anomaly detection stage, leveraging its speed advantage, it quickly detects the interaction data of objects in the virtual scene. It can make a preliminary judgment on the object's interaction data in a short time. If it determines that the object's interaction data is normal or abnormal, it can directly return the anomaly detection result and perform the corresponding compliant operation on the object. If it determines that the object's interaction data is questionable, the second anomaly detection stage performs a second anomaly detection on the questionable object's interaction data. Leveraging the high accuracy of the second anomaly detection, it precisely detects the interaction data of the questionable object to determine whether the interaction data is abnormal. In this way, the advantages of both anomaly detection methods can be effectively combined, ensuring both speed and accuracy in anomaly detection.

[0202] The following will describe an exemplary application of the embodiments of this application in a real-world application scenario. For ease of understanding, the application of the data processing method for virtual scenes to a game business scenario will be used as an example.

[0203] In some embodiments, the game designer first performs game preparation and initialization operations, such as configuring data files and setting relevant threshold parameters, and initializing model parameters through data editing; then, player objects in the game can participate in the game's combat gameplay and select the corresponding gameplay mode (such as single-player mode or multiplayer mode).

[0204] Here, players can team up on the lobby server (gamesvr) and engage in core combat on the battle server (relaysvr). After the battle, a battle replay file can be generated, uploaded, and saved to a dedicated recording server (COS). The battle results are then returned to the lobby server (gamesvr). The lobby server (gamesvr) generates game log data (tlog) based on the battle results. This game log data includes the player's game results and behavioral data. Subsequently, pre-verification can be performed on the player to determine if their current game results are eligible for ranking. For results eligible for ranking, the game results are reported to the security center for anomaly detection. For results not eligible for ranking, local basic verification is performed on the player's current game results to quickly verify the data based on the upper limits of each data point, thereby reducing system performance overhead.

[0205] After the security center receives the game settlement data, it can input the data into the data analysis model for the first step of review, outputting a preliminary coloring result. The granularity of this coloring result can be adaptively configured according to specific needs. When the preliminary coloring result is above the safety threshold (i.e., the game settlement data is normal, for example, the coloring result is white), the normal data ranking logic can be executed for the current game settlement data. When the preliminary coloring result is below the safety threshold, the data ranking logic is temporarily suspended, and the security center is controlled to extract the corresponding game recording from the recording server (COS) and upload the game recording. The data is input into the video recording analysis model for a second review, and the output is local settlement data generated based on the game recording. After obtaining the local settlement data, it is compared with the game settlement data to obtain the comparison result. Based on the comparison result, a review coloring result (including white coloring, gray coloring, and black coloring) is generated. When the review coloring result is white coloring (i.e., no abnormal data), the normal data ranking logic can be executed on the current game settlement data. When the review coloring result is gray coloring (i.e., the data is questionable but the harm is low), the current game settlement data is canceled from the ranking and the player is marked. When the review coloring result is black coloring (i.e., high-risk data), the player is subject to subsequent actions such as account banning and leaderboard banning.

[0206] In some embodiments, see Figure 12 , Figure 12 This is a flowchart illustrating the data processing method for virtual scenes provided in this application within a game business scenario. The following will combine... Figure 12 The overall process in the game business scenario is explained in detail.

[0207] During the player combat process, players log in to the lobby server (gamesvr) via the client and initiate matchmaking. See details below. Figure 8 , Figure 8 This is a schematic diagram of the interface for battle matching in the lobby server using the virtual scene data processing method provided in this application embodiment. After successful matching, the battle begins, and the current match is created on the battle server (relaysvr). For details, please refer to... Figure 9 , Figure 9 This is a schematic diagram of the interface for a game match on a battle server, illustrating the data processing method for a virtual scene provided in this application embodiment. Match recording data is generated during the match, and after the match ends, see... Figure 10 , Figure 10 This is a schematic diagram of the interface for battle settlement on the lobby server using the virtual scene data processing method provided in this application embodiment. Battle settlement data (such as...) will be generated on the battle server (relaysvr). Figure 10 (Hero proficiency 201, Gold 202, Inscription Fragments 203).

[0208] In the local settlement process, after generating battle settlement data, the battle server (relaysvr) will upload the generated match replay data to the recording server (COS) for storage, and at the same time transmit the game match settlement data to the lobby server (gamesvr). The lobby server (gamesvr) performs the first layer of basic settlement data verification. Based on the first layer of verification results, the game matches not on the leaderboard are settled normally, and the game match data on the leaderboard is sent to the security center for the second layer of data model review.

[0209] In the second-level data model review process, the security center conducts a second-level data model review on the settlement data and returns the review results to the lobby server (gamesvr).

[0210] In the third-level video recording review process, the security center conducts a more detailed review of the settlement data that is questionable in the second-level data model review. It obtains the game recording data from the recording server (COS), analyzes it, generates the corresponding review results, and returns the reviewed results to the lobby server (gamesvr).

[0211] In the security monitoring result processing procedure, if the game data is normal, please refer to [link / reference needed]. Figure 11 , Figure 11 This is a schematic diagram of the interface for ranking based on battle settlement data in a virtual scene provided in this application embodiment. The lobby server (gamesvr) performs normal ranking operations (such as...). Figure 11 The leaderboard (204) is used to track game data. If there are any issues with the game data, the lobby server (gamesvr) will record and report the anomaly detection data. If the game data is abnormal, the security center will take action against the player's account, such as banning them from the leaderboard, banning them from the game, or suspending their account.

[0212] The following example, using a game match scenario, illustrates the data processing method for the virtual scene in this application.

[0213] In some embodiments, see Figure 13A , Figure 13A This is a schematic diagram of the settlement process in a game scenario using the virtual scene data processing method provided in this application embodiment. The following will be combined with... Figure 13A This section explains the settlement process in game matches.

[0214] After a game is completed, game settlement data is generated. Before obtaining the game settlement data, the current game is judged as a level. If the current game is a normal level, the game settlement data is obtained using the normal level settlement method. If the current game is an endless level, the wave data of the current game is obtained, and the game revenue data is generated based on the wave data. The generated revenue data is then checked to see if it is within the reward range. If it is within the reward range, the reward is claimed and the duplicate reward information is updated.

[0215] In some embodiments, see Figure 13B , Figure 13B This is a schematic diagram of the settlement process in a game scenario using the virtual scene data processing method provided in this application embodiment. The following will be combined with... Figure 13B The settlement process in the game match will be further explained, including... Figure 13B Nodes 1b, 2b, and 3b in the diagram are respectively connected to... Figure 13A Connect nodes 1a, 2a, and 3a in the diagram.

[0216] Following the above settlement process, after the settlement of a normal level, a new level will be unlocked. The subsequent levels of the current level will be unlocked based on the completion conditions of the normal level. Simultaneously, after the settlement of a normal level, event conditions will be triggered, and the game type of the current normal level will be determined. If the game type meets the event conditions, the corresponding event conditions will be triggered, and the event time will be refreshed accordingly. In the settlement of endless levels, new level content will be unlocked based on the player's game wave data, and the survival time of the last wave will be obtained to determine whether to update the single-hero endless level data. When the corresponding game data for a single hero is obtained, if the current game wave count and survival time are greater than those of previous games... If the game wave number and survival time are considered, and the current match is in single-player mode, then the endless level data for a single hero is updated and the leaderboard entry is executed. If the current match is in multiplayer mode, the endless level data for an offensive single hero is not entered into the leaderboard. In addition, after determining whether to update the single-hero endless level data, it is also necessary to determine whether the current game match is in local mode. If it is in local mode, the leaderboard entry logic is not executed. If it is not in local mode, a pre-validation is performed before executing the leaderboard entry logic. If the validation is successful, the game match data is security-checked through the mesh security check switch. If the game match data is not security-checked, the player object is directly reported.

[0217] In some embodiments, see Figure 13C , Figure 13C This is a schematic diagram of the settlement process in a game scenario using the virtual scene data processing method provided in this application embodiment. The following will be combined with... Figure 13C The settlement process in the game match will be further explained, including... Figure 13C The 4b, 5b, and 6b nodes are respectively with Figure 13B The 4a, 5a and 6a nodes are connected.

[0218] After the event conditions are triggered, the current game's transaction data is retrieved. If the current game is lost, a game failure message is returned directly. If the game is successful, the clearance condition is triggered. If this game is the first time the hero has cleared the game, the first-time clearance reward is obtained. If it is not the first time clearing the game, the daily limit is checked, and the corresponding reward information is obtained. In addition, after the event time is refreshed accordingly, the event conditions are updated according to the event refresh conditions, and it is determined whether the current game meets the event conditions. If it does, the event condition fulfillment instance is triggered.

[0219] In some embodiments, see Figure 13D , Figure 13D This is a schematic diagram of the anomaly detection process in a game scene using the virtual scene data processing method provided in this application embodiment. The following will be combined with... Figure 13D The anomaly detection process in the game's gameplay will be further explained, including... Figure 13D 7b node and Figure 13C The 7a node is connected.

[0220] After determining that asynchronous security checks are required on game match data, the corresponding game match data is sent to the security center for further security checks. If the player is online, the online security check returns the corresponding coloring result. If the result is not white, the game settlement data is discarded. If the result is white, the game match data is transferred for further checks. If the player is offline, offline anomaly detection is used. If the coloring result is not white, the game settlement data is discarded. If the coloring result is white, the data settlement is checked again to see if it meets the ranking requirements. If the current game settlement data does not need to be on the leaderboard and does not need to be updated, it is discarded. If the current game settlement data does not need to be on the leaderboard but needs to be updated, an offline data update transaction is used to perform corresponding operations on the database. If the current game settlement data needs to be on the leaderboard, the ranking logic is executed based on the game settlement data returned by the security check.

[0221] In some embodiments, see Figure 13E , Figure 13E This is a schematic diagram of the anomaly detection process in a game scene using the virtual scene data processing method provided in this application embodiment. The following will be combined with... Figure 13E The anomaly detection process in the game's gameplay will be further explained, including... Figure 13E The 8b and 9b nodes in the middle are respectively with Figure 13DConnect nodes 8a and 9a in the diagram.

[0222] If a player is online and the returned coloring result is white, the game data will be checked to confirm whether the current game data meets the requirements for ranking. If it meets the requirements, the ranking logic will be executed based on the safely returned game settlement data; otherwise, the game data will be discarded. In addition, after updating the offline transaction, the relevant data in the database will be retrieved to confirm whether the relevant data needs to be updated by the current game data. The database will also periodically check the data for the current period. If it belongs to the game data of the previous period, the corresponding reward will be obtained according to the ranking. If it belongs to the game data of the current period or other periods, the historical data will be updated and a message will be displayed indicating that the ranking data update is complete.

[0223] In some embodiments, see Figure 13F , Figure 13F This is a schematic diagram of the anomaly detection process in a game scene using the virtual scene data processing method provided in this application embodiment. The following will be combined with... Figure 13F The anomaly detection process in game scenarios will be further explained.

[0224] When the anomaly detection result of the game match data is grayed out, the offline review logic is executed. The security center retrieves the match recording data of the current game from the recording server, reviews the recording data, analyzes it using the recording analysis model, further detects the behavior of grayed-out high-risk player objects, generates new settlement data for the current game, and compares the new settlement data with the settlement data generated by the lobby server. Based on the difference, it is determined whether there are any anomalies in the current game settlement data, and the abnormal behavior of player objects is judged from the anomaly indicators. After the replay, the review results are synchronized to the lobby server. If the coloring result is white, the game match data is added to the leaderboard. If the coloring result is not white, the game match data is recorded in the log.

[0225] In some embodiments, after a game ends, the server performs a gameplay settlement for that game. In the first layer of anomaly detection, after the gameplay settlement, a simple upper limit check is performed at the game level for some basic data ranges (such as wave count, attack power, gold, kill count, etc.). The basic upper limit check can be calculated using a local formula; see [link to relevant documentation] for details. Figure 14 , Figure 14 This is a schematic diagram illustrating a basic upper limit check provided in the embodiments of this application.

[0226] The entire game takes place on the battle server (relaysvr). After a match ends, the battle server (relaysvr) uploads the replay to the recording server (COS) and simultaneously sends the match settlement data to the lobby server (gamesvr), where it performs a local basic limit check. If the local basic limit check passes, it determines whether to perform an interface check by the security center based on the configuration. If the check fails, the match settlement data is discarded, and the anomaly detection data is recorded and reported. For necessary matches (the necessity mainly depends on whether the match settlement data is for the leaderboard), the match settlement data is sent to the security center's interface for verification. If the verification result determines that the current match settlement data is for the leaderboard, the match settlement data is transmitted to the security center for a second-layer data model review; if the verification result determines that the current match settlement data is not for the leaderboard, the current match is directly settled to save unnecessary overhead. The first-layer local basic limit check is the fastest, has the smallest data volume, and the lowest performance overhead, requiring no additional data transmission.

[0227] After the first layer of local basic upper limit verification is completed, the security center reviews the current game settlement data by calling the data analysis model and returns a review result in real time, indicating whether the player object is white, gray, or black. White indicates that the player object's current game data is normal, black indicates that the player object's current game data is abnormal, and gray indicates that it cannot be judged based on the data of the verification interface, but belongs to a high-risk player object. The third layer of offline review logic is then used to further review the player object's current game data. For high-risk player objects represented by gray, normal settlement logic is executed except for the leaderboard. The player object is not listed on the leaderboard initially. After the security verification service obtains the anomaly detection result through the asynchronous mechanism, the result is synchronized by calling the interface provided by the game side.

[0228] Here, gray can be divided into multiple gray levels. The darker the color, the lower the confidence level. The granularity of the review and the model parameters will be adaptively adjusted according to the configuration. The second-layer data analysis model has a faster review speed, uses less data, and has less performance overhead. It can return the review results to the game side in a shorter time, reducing the player's perceived latency.

[0229] After the second-layer data analysis model review is completed, for high-risk players represented in gray, the security center obtains the current game replay data from the recording server (COS), reviews the replay data, analyzes it using the replay analysis model, further detects the behavior of gray high-risk players, generates new settlement data for the current game, compares the new settlement data with the settlement data obtained from the lobby server (gamesvr), and determines whether there are any anomalies in the current game settlement data based on the differences. It also judges the possible abnormal behavior of players based on the abnormal indicators. After the replay is reviewed, the review results are synchronized to the lobby server (gamesvr).

[0230] Here, the third-layer video analysis model has a relatively slow review speed, uses a large amount of data, and incurs significant performance overhead for data transmission and computation. It may take a long time to return the review results to the game side. To reduce performance pressure, the third-layer video analysis model review is only performed when the results of the first two layers of review are questionable, and the triggered security threshold can be dynamically adjusted. During peak periods of concurrency in certain gameplay modes, the frequency of the third-layer video analysis model review may be reduced.

[0231] After the third-layer video analysis model verifies the data, the verification result is returned to the lobby server (gamesvr). If the verification result is white, the player will proceed with the normal ranking logic, and the data will be communicated to the player through the game client. If the verification result is still gray, it indicates that the data is still questionable after verification. The data will be logged and reported for testing, and further testing can be conducted through manual intervention. If the verification result is black, it indicates that there is an anomaly in the data of this game. The data will be logged and reported for testing, and other violations such as banning from ranking, banning from matches, and banning accounts will be dealt with through the game-side data interface (idip).

[0232] Furthermore, starting from the second-layer data analysis model review, the execution of the layered detection program is asynchronous. At this time, the player object may be offline. In this case, the result will be recorded in the player object's offline data. When the player object logs in again, the calculation results of the previous battle will be processed. For operations such as data ranking, which do not depend on the player object's online status, they can be executed directly after the callback. When the player object views the ranking, it can obtain the correct data.

[0233] In some embodiments, when the second-level review result of a player object is not white, and the third-level review result is still not white, the abnormal penalty process is initiated. For player objects with lighter staining results (e.g., gray), the security detection process returns the result to the game side. The game side performs different abnormal penalty processing according to the preset configuration threshold, such as canceling the current battle results, recording logs and reporting detection data, and prohibiting them from being on the leaderboard. For player objects with darker staining results (e.g., black), it can be considered that the current player object has serious abnormal behavior, such as using third-party auxiliary software. The penalty decision can be made by combining the player object's historical operation data and other game operation data, including disabling the leaderboard, prohibiting participation in competitions, banning the account, and suspending the account. These penalty measures will call the game side's data interface (idip) to process the corresponding data and inform the player object.

[0234] In some embodiments, the anomaly detection process of this application can support multiple data models. Through more sophisticated artificial intelligence (AI) capabilities and deep learning, reinforcement learning can be used to optimize data models and improve the accuracy of layered detection. The anomaly detection process of this application can be applied to more security detection scenarios. For example, it can detect players' in-game chat messages to prevent players from spreading illegal messages (such as sensitive messages) through in-game chat channels, and maintain the game environment through security detection of game information flow. The data processing method for virtual scenes in this application can also add more refined functions, such as automated error correction and version control. By continuously improving the process, the probability of hitting multiple layered review and verification can be reduced, thereby reducing the overall process time consumption and performance overhead.

[0235] The embodiments of this application have the following beneficial effects:

[0236] (1) The game logic and the security center detection logic are separated, with low coupling. The security center detection process has no impact on the main game and combat process, and there is no delay in the execution of player and client logic, ensuring data consistency and minimizing the cost of data modification. In addition, the actual implementation of the security center's data analysis model is separated from the process, which has good maintainability and scalability. A general unified data format is defined to reduce the impact of iterative development of game logic on the security detection process.

[0237] (2) The security detection process can customize data analysis models and video analysis models. The former is used for rapid first-round screening. For results that meet the security threshold, the results are directly returned to the game side for normal settlement. The whole process has very low latency and no obvious latency perception for players. The latter is used for more granular review detection, mainly for the review of questionable data, to ensure the correctness of the review results. Both models can be iteratively expanded.

[0238] (3) The security detection process is divided into three layers. The first layer is the game side's preliminary screening, the second layer is the data analysis model review, and the third layer is the video analysis model verification. Through the layered coloring method, the questionable results are reviewed at each level to ensure the effectiveness of security monitoring while taking into account operational efficiency.

[0239] (4) It is easy to operate and has a high degree of automation integration. It can form an automated production line, shielding game designers from the underlying details and meeting the accuracy requirements without much human intervention.

[0240] The following description continues to illustrate the exemplary structure of the virtual scene data processing device 543 provided in the embodiments of this application as a software module. In some embodiments, such as... Figure 2 As shown, the software modules in the data processing device 543 storing the virtual scene in the memory 540 may include: a first processing module 5431, a first execution module 5432, a second processing module 5433, and a second execution module 5434.

[0241] The first processing module 5431 is used to perform first anomaly detection processing on the first interaction data of the object to be detected to obtain a first anomaly detection result; the first execution module 5432 is used to perform compliance operations corresponding to the deterministic result for the object to be detected when the first anomaly detection result is a deterministic result; the second processing module 5433 is used to perform second anomaly detection processing on the second interaction data of the object to be detected to obtain a second anomaly detection result when the first anomaly detection result is a non-deterministic result, wherein the first interaction data and the second interaction data are data generated by the object to be detected participating in interactions in a virtual scene; the second execution module 5434 is used to perform compliance operations corresponding to the second anomaly detection result for the object to be detected.

[0242] In some embodiments, the first processing module 5431 is further configured to extract a detection index from the first interaction data of the object to be detected; when the detection index meets the index conditions, the first interaction data of the object to be detected is subjected to a first anomaly detection process to obtain a first anomaly detection result.

[0243] In some embodiments, the first processing module 5431 is further configured to perform compliance operations on the object to be detected in a negative dimension when the indicator to be detected does not meet the indicator conditions.

[0244] In some embodiments, the first interaction data includes the game settlement data of the object to be detected in the virtual scene. The first processing module 5431 is further configured to perform a first anomaly detection process on the first interaction data of the object to be detected when the game settlement data is within the reward range of the virtual scene, and obtain a first anomaly detection result. The first processing module 5431 is further configured to perform positive-dimensional compliance operations on the game settlement data of the object to be detected when the game settlement data is not within the reward range of the virtual scene.

[0245] In some embodiments, the deterministic results include negative detection results and positive detection results, and the uncertain results include pending anomaly detection results. The first processing module 5431 is further configured to perform first anomaly detection processing on the first interaction data of the object to be detected through the first anomaly detection model to obtain the compliance confidence level of the corresponding object to be detected; when the compliance confidence level is less than the first confidence level threshold, the negative detection result is used as the first anomaly detection result; when the compliance confidence level is greater than the second confidence level threshold, the positive detection result is used as the first anomaly detection result; when the compliance confidence level is not less than the first confidence level threshold and not greater than the second confidence level threshold, the pending anomaly detection result is used as the first anomaly detection result.

[0246] In some embodiments, the data processing device 543 for the virtual scene further includes a training module 5435. The first anomaly detection processing is implemented by calling a first anomaly detection model. The training module 5435 is used to obtain training samples constructed based on historical first interaction data, wherein the training samples are historical first interaction data, and the sample labels corresponding to the training samples are the label compliance confidence levels corresponding to the historical first interaction data; call the data analysis model to be trained to perform the first anomaly detection processing on the historical first interaction data to obtain the predicted compliance confidence level; determine the first loss between the label compliance confidence level and the predicted compliance confidence level, and update the first anomaly detection model based on the first loss.

[0247] In some embodiments, the second processing module 5433 is further configured to obtain the compliance confidence level corresponding to the first anomaly detection result; call the second anomaly detection model that matches the compliance confidence level to perform second anomaly detection processing on the second interaction data of the object to be detected, and obtain the second anomaly detection result; wherein, the detection granularity of the second anomaly detection model is positively correlated with the compliance confidence level corresponding to the first anomaly detection result.

[0248] In some embodiments, the second interactive data includes the game recording of the object to be detected in the virtual scene, and the first interactive data includes the game settlement data of the object to be detected in the virtual scene. The second processing module 5433 is further configured to perform game settlement data generation processing on the game recording of the object to be detected to obtain the replay game settlement data of the corresponding game recording; when the settlement similarity between the replay game settlement data and the game settlement data is higher than the first similarity threshold, the positive detection result is taken as the second anomaly detection result; when the settlement similarity is not higher than the first similarity threshold, the negative detection result is taken as the second anomaly detection result.

[0249] In some embodiments, the second interactive data includes the game recording of the object to be detected in the virtual scene. The second processing module 5433 is further configured to perform target detection processing on the game recording of the object to be detected to obtain the recording frame corresponding to the abnormal operation event. When the number of recording frames corresponding to the abnormal operation event is higher than the first number threshold, the negative detection result is used as the second abnormal detection result. When the number of recording frames corresponding to the abnormal operation event is not higher than the first number threshold, the positive detection result is used as the second abnormal detection result.

[0250] In some embodiments, the second processing module 5433 is further configured to perform second anomaly detection processing on the second interaction data of the object to be detected based on an asynchronous mechanism when the computational complexity of the second anomaly detection processing is greater than the first complexity threshold, and obtain a second anomaly detection result; and to perform second anomaly detection processing on the second interaction data of the object to be detected based on a synchronous mechanism when the computational complexity of the second anomaly detection processing is not greater than the first complexity threshold, and obtain a second anomaly detection result; wherein, the asynchronous mechanism means that the interaction logic between the second anomaly detection processing and the object to be detected in the virtual scene is executed asynchronously, and the synchronous mechanism means that the interaction logic between the second anomaly detection processing and the object to be detected in the virtual scene is executed linearly.

[0251] In some embodiments, the data processing device 543 for the virtual scene further includes an interception module 5436. The interception module 5436 is used to acquire a complete game recording of the object to be detected in the virtual scene; to perform interception processing on the complete game recording based on the target type of operation events to obtain the game recording of the object to be detected in the virtual scene; wherein, the number of operation events is negatively correlated with the compliance confidence of the corresponding first anomaly detection result.

[0252] In some embodiments, the first interaction data is the session data to be published by the object to be detected in the virtual scene, and the second interaction data is the historical session data and the session data to be published by the object to be detected in the virtual scene. The second execution module 5434 is further configured to perform anomaly correction processing on the session data to be published when the second anomaly detection result is a negative detection result, to obtain the corrected session data to be published, and to execute the publishing process for the corrected session data to be published; and to execute the publishing process for the session data to be published when the second anomaly detection result is a positive detection result.

[0253] In some embodiments, the second processing module 5433 is further configured to obtain a first weight corresponding to the first anomaly detection result and a second weight corresponding to the second anomaly detection result; based on the first weight and the second weight, perform weighted fusion processing on the compliance confidence of the corresponding first anomaly detection result and the compliance confidence of the corresponding second anomaly detection result to obtain a fused compliance confidence; update the second anomaly detection result based on the fused compliance confidence to obtain an updated second anomaly detection result. The second execution module 5434 is further configured to perform compliance operations corresponding to the updated second anomaly detection result on the object to be detected.

[0254] In some embodiments, the data processing apparatus 543 for the virtual scene further includes a correction module 5437. The correction module 5437 is further configured to acquire object authorization data of the object to be detected in the virtual scene; and perform at least one of the following processes: correcting a first anomaly detection result based on the object authorization data to obtain a corrected first anomaly detection result; and correcting a second anomaly detection result based on the object authorization data to obtain a corrected second anomaly detection result.

[0255] In some embodiments, the detection speed of the first anomaly detection process is higher than that of the second anomaly detection process, and the detection accuracy of the first anomaly detection process is lower than that of the second anomaly detection process.

[0256] It should be noted that the description of the apparatus in this application embodiment is similar to the description of the method embodiment above, and has similar beneficial effects as the method embodiment, therefore, it will not be repeated. For any technical details not covered in the virtual scene data processing apparatus provided in this application embodiment, please refer to... Figure 3 , Figure 4A , Figure 4B , Figure 5A , Figure 5B , Figure 5C , Figure 5D , Figure 6 ,or Figure 7 The meaning is understood in accordance with the description of any of the accompanying drawings.

[0257] This application provides a computer program product, which includes a computer program or computer-executable instructions stored in a computer-readable storage medium. The processor of an electronic device reads the computer-executable instructions from the computer-readable storage medium and executes the computer-executable instructions, causing the electronic device to perform the virtual scene data processing method described above in this application.

[0258] This application provides a computer-readable storage medium storing computer-executable instructions or a computer program. When the computer-executable instructions or the computer program are executed by a processor, the processor will execute the data processing method for a virtual scene provided in this application. For example, ... Figure 3 , Figure 4A , Figure 4B , Figure 5A , Figure 5B , Figure 5C , Figure 5D , Figure 6 ,or Figure 7 The data processing method for the virtual scene is shown.

[0259] In some embodiments, the computer-readable storage medium may be a memory such as ferroelectric random access memory (FRAM), ROM, programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); or it may be a device that includes one or any combination of the above-mentioned memories.

[0260] In some embodiments, computer-executable instructions may take the form of programs, software, software modules, scripts, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as stand-alone programs or as modules, components, subroutines, or other units suitable for use in a computing environment.

[0261] As an example, computer-executable instructions may, but do not necessarily, correspond to files in a file system. They may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a Hyper Text Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files that store one or more modules, subroutines, or code sections).

[0262] As an example, computer-executable instructions can be deployed to execute on a single electronic device, or on multiple electronic devices located at one location, or on multiple electronic devices distributed across multiple locations and interconnected via a communication network.

[0263] In summary, the embodiments of this application have the following beneficial effects: by performing a first anomaly detection process on the first interactive data of the object to be detected, a first anomaly detection result is obtained. When the first anomaly detection result is a deterministic result, the corresponding compliant operation for the deterministic result is directly executed on the object to be detected, thereby effectively reducing the user's perception of latency in the data processing process. When the first anomaly detection result is a non-deterministic result, a second anomaly detection process is performed on the second interactive data of the object to be detected, a second anomaly detection result is obtained, and the corresponding compliant operation for the second anomaly detection result is executed on the object to be detected, thereby performing a second anomaly detection on the data with uncertain results, thereby ensuring the correctness of the anomaly detection result.

[0264] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, and improvements made within the spirit and scope of this application are included within the scope of protection of this application.

Claims

1. A data processing method for a virtual scene, characterized in that, The method includes: Perform the first anomaly detection processing on the first interaction data of the object to be detected, and obtain the first anomaly detection result; When the first anomaly detection result is a deterministic result, the compliant operation corresponding to the deterministic result is performed on the object to be detected; When the first anomaly detection result is a non-deterministic result, the second interaction data of the object to be detected is subjected to a second anomaly detection process to obtain a second anomaly detection result; Wherein, the first interaction data and the second interaction data are data generated by the object to be detected participating in the interaction in the virtual scene; Perform compliance operations corresponding to the second anomaly detection result for the object to be detected.

2. The method according to claim 1, characterized in that, The first anomaly detection process is performed on the first interaction data of the object to be detected to obtain the first anomaly detection result, including: Extract the indicators to be detected from the first interaction data of the object to be detected; When the indicator to be detected meets the indicator conditions, the first anomaly detection process is performed on the first interaction data of the object to be detected to obtain the first anomaly detection result. The method further includes: when the indicator to be detected does not meet the indicator conditions, performing a compliance operation on the object to be detected in a negative dimension.

3. The method according to claim 2, characterized in that, The first interaction data includes the game settlement data of the object to be detected in the virtual scene. The first anomaly detection processing of the first interaction data of the object to be detected to obtain the first anomaly detection result includes: When the game settlement data is within the reward range of the virtual scene, the first anomaly detection process is performed on the first interaction data of the object to be detected to obtain the first anomaly detection result; The method further includes: When the game settlement data is not within the reward range of the virtual scene, perform positive compliance operations on the game settlement data of the object to be detected.

4. The method according to claim 1, characterized in that, The deterministic results include negative detection results and positive detection results, and the uncertain results include undetermined anomaly detection results; The first anomaly detection process is performed on the first interaction data of the object to be detected to obtain the first anomaly detection result, including: The first anomaly detection model is used to perform first anomaly detection processing on the first interaction data of the object to be detected, thereby obtaining the compliance confidence level of the object to be detected. When the compliance confidence level is less than the first confidence threshold, the negative detection result is taken as the first anomaly detection result; When the compliance confidence level is greater than the second confidence threshold, the positive detection result is taken as the first anomaly detection result; When the compliance confidence level is not less than the first confidence level threshold and not greater than the second confidence level threshold, the pending anomaly detection result is taken as the first anomaly detection result.

5. The method according to claim 1, characterized in that, The second anomaly detection process on the second interaction data of the object to be detected, to obtain the second anomaly detection result, includes: Obtain the compliance confidence level corresponding to the first anomaly detection result; A second anomaly detection model matching the compliance confidence level is invoked to perform second anomaly detection processing on the second interaction data of the object to be detected, and a second anomaly detection result is obtained. The detection granularity of the second anomaly detection model is positively correlated with the compliance confidence level of the corresponding first anomaly detection result.

6. The method according to claim 1, characterized in that, The second interactive data includes the game recording of the object to be detected in the virtual scene, and the first interactive data includes the game settlement data of the object to be detected in the virtual scene; The second anomaly detection process on the second interaction data of the object to be detected, to obtain the second anomaly detection result, includes: The game recording of the target game is processed to generate game settlement data, and the replay game settlement data corresponding to the game recording of the target game is obtained. When the similarity between the replay game settlement data and the game settlement data is higher than the first similarity threshold, the positive detection result is taken as the second anomaly detection result; When the settlement similarity is not higher than the first similarity threshold, the negative detection result is taken as the second anomaly detection result.

7. The method according to claim 1, characterized in that, The second interaction data includes the game recording of the object to be detected in the virtual scene; the second anomaly detection processing on the second interaction data of the object to be detected to obtain the second anomaly detection result includes: The target detection processing is performed on the game recording of the target object to obtain the recording frame of the corresponding abnormal operation event; When the number of video frames corresponding to the abnormal operation event is higher than the first number threshold, the negative detection result is used as the second abnormal detection result. When the number of video frames corresponding to the abnormal operation event is not higher than the first number threshold, the positive detection result is taken as the second abnormal detection result.

8. The method according to claim 6 or 7, characterized in that, The method further includes: Obtain the complete game recording of the target object in the virtual scene; The complete game recording is processed by extracting operation events based on the target type to obtain the game recording of the object to be detected in the virtual scene; The number of operation events is negatively correlated with the compliance confidence level of the corresponding first anomaly detection result.

9. The method according to claim 1, characterized in that, The first interactive data is the session data to be published by the object to be detected in the virtual scene, and the second interactive data is the historical session data and session data to be published by the object to be detected in the virtual scene. Perform compliance operations corresponding to the second anomaly detection result on the object to be detected, including: When the second anomaly detection result is a negative detection result, the anomaly correction process is performed on the session data to be published to obtain the corrected session data to be published, and the publishing process for the corrected session data to be published is executed. When the second anomaly detection result is a positive detection result, the publishing process for the session data to be published is executed.

10. The method according to claim 1, characterized in that, The second anomaly detection process on the second interaction data of the object to be detected, to obtain the second anomaly detection result, includes: When the computational complexity of the second anomaly detection process is greater than the first complexity threshold, the second anomaly detection process is performed on the second interaction data of the object to be detected based on an asynchronous mechanism to obtain the second anomaly detection result. When the computational complexity of the second anomaly detection process is not greater than the first complexity threshold, the second anomaly detection process is performed on the second interaction data of the object to be detected based on the synchronization mechanism to obtain the second anomaly detection result. The asynchronous mechanism refers to the asynchronous execution of the interaction logic between the second anomaly detection process and the object to be detected in the virtual scene, while the synchronous mechanism refers to the linear execution of the interaction logic between the second anomaly detection process and the object to be detected in the virtual scene.

11. The method according to any one of claims 1 to 10, characterized in that, The detection speed of the first anomaly detection process is higher than that of the second anomaly detection process, but the detection accuracy of the first anomaly detection process is lower than that of the second anomaly detection process.

12. A data processing device for a virtual scene, characterized in that, The device includes: The first processing module is used to perform first anomaly detection processing on the first interactive data of the object to be detected, and obtain the first anomaly detection result. The first execution module is used to perform compliance operations corresponding to the deterministic result for the object to be detected when the first anomaly detection result is a deterministic result; The second processing module is used to perform second anomaly detection processing on the second interaction data of the object to be detected when the first anomaly detection result is a non-deterministic result, to obtain a second anomaly detection result; wherein, the first interaction data and the second interaction data are data generated by the object to be detected participating in interactions in the virtual scene; The second execution module is used to perform compliance operations corresponding to the second anomaly detection result for the object to be detected.

13. An electronic device, characterized in that, include: Memory is used to store executable instructions or computer programs. A processor, when executing computer-executable instructions or computer programs stored in the memory, implements the data processing method for the virtual scene according to any one of claims 1 to 11.

14. A computer-readable storage medium storing computer-executable instructions or a computer program, characterized in that, When the computer-executable instructions or computer program are executed by a processor, the data processing method for the virtual scene as described in any one of claims 1 to 11 is implemented.

15. A computer program product comprising computer-executable instructions or a computer program, characterized in that, When the computer-executable instructions or computer program are executed by a processor, the data processing method for the virtual scene as described in any one of claims 1 to 11 is implemented.

Images