Multiplayer online game anti-hacking detection method and system based on neural network

Abstract

The application discloses a multi-player online game anti-hacking detection method and system based on a neural network, which comprises the following steps: real-time capturing of game picture data after rendering at a player end, removal of noise and standardization of pixel value distribution by using an image preprocessing technology, obtaining of the processed game picture for subsequent feature extraction, identification of occlusion boundary areas by using an edge detection algorithm according to the processed game picture, determination of the distribution features of brightness contrast and texture details in these areas as basic input, and multi-layer convolution operation on the brightness contrast and texture details by using a convolutional neural network after obtaining the distribution features, so as to obtain a high-dimensional visual feature vector representing the possibility of abnormal change. The application aims to solve the problem of how to accurately identify the abnormal change mode of visual features such as brightness contrast, texture details and depth implication caused by the destruction of the occlusion relationship by perspective hacking in the game picture finally seen by the player in the prior art.

Description

Technical Field

[0001] This invention relates to the technical field of information technology, specifically to a method and system for detecting cheats in multiplayer online games based on neural networks. Background Technology

[0002] In the current multiplayer online shooting game genre, anti-cheat technology has become a core element in maintaining a fair competitive environment and ensuring a positive player experience. As game graphics become increasingly realistic and scene complexity increases, cheating behaviors are becoming more sophisticated and sophisticated. X-ray vision cheats, in particular, severely undermine the fairness of the game, forcing anti-cheat systems to possess stronger visual anomaly detection capabilities.

[0003] Most existing anti-cheat methods rely on behavioral trajectory analysis, memory data comparison, or simple image statistical features. These methods are increasingly showing significant shortcomings when dealing with screen-level wallhacks. Since game graphics are essentially rendered two-dimensional images from the player's perspective, cheaters can directly obtain complete scene information by modifying the rendering pipeline. Traditional detection methods struggle to determine whether there is any illegal information leakage from the final displayed image, allowing many wallhack behaviors to bypass conventional monitoring.

[0004] Crucially, normal players' visual perception is strictly limited by occlusions in the scene, while wallhacks disrupt this occlusion relationship, causing information hidden behind walls and objects to be abnormally revealed. In real game visuals, the pixel brightness, texture detail, and depth information distribution at the edges of occluded objects follow strict physical occlusion rules. Once wallhacks occur, the brightness contrast, texture complexity difference, and depth indication between the visible and occluded parts of the wall will change significantly, violating natural laws. This abnormality in the underlying visual features of the image caused by the disruption of occlusion relationships has become the most difficult technical challenge to effectively capture. Summary of the Invention

[0005] This invention provides a method and system for detecting anti-cheat features in multiplayer online games based on neural networks. The purpose is to solve the problem in the prior art of how to accurately identify abnormal change patterns in visual features such as brightness contrast, texture details, and depth hints caused by the disruption of occlusion relationships due to perspective cheats in the game screen that players ultimately see.

[0006] To solve the above-mentioned technical problems, the technical solution adopted by the present invention is as follows: A neural network-based anti-cheat detection method for multiplayer online games includes: capturing game screen data rendered on the player's end in real time; using image preprocessing techniques to remove noise and standardize pixel value distribution to obtain processed game screens for subsequent feature extraction; based on the processed game screens, using edge detection algorithms to identify occlusion boundary regions and determining the distribution features of brightness contrast and texture details within these regions as basic inputs; after obtaining the distribution features, performing multi-layer convolution operations on brightness contrast and texture details using a convolutional neural network to obtain high-dimensional visual feature vectors representing the possibility of abnormal changes; for the high-dimensional visual feature vectors, fusing depth cues, if the depth gradient in the vector exceeds a preset threshold, marking it as a potential abnormal region and determining the initial abnormal change pattern; extracting sub-region samples from the initial abnormal change pattern, and using a support vector machine classifier to perform binary classification on these samples to determine whether they conform to the occlusion and damage features caused by perspective cheats; after obtaining the classifier output results, comparing them with the statistical model of the normal game screen dataset, if the result deviation is greater than a preset threshold, confirming visual feature abnormalities and obtaining the final abnormal detection signal; based on the final abnormal detection signal, updating the real-time log database of the anti-cheat detection system, judging the signal strength to trigger an alarm mechanism to complete the detection cycle.

[0007] In one aspect of the invention, the step of capturing game screen data rendered on the player's end in real time, and using image preprocessing techniques to remove noise and standardize pixel value distribution to obtain a processed game screen for subsequent feature extraction includes: The original game footage is captured in real time from the player's client via a video capture interface; The median filtering method is used to remove scattered noise points from the acquired original game screen to obtain the first denoised screen; Histogram equalization is performed on the first denoised image to adjust the pixel value distribution, resulting in the second standardized image; Based on the pixel value range of the second standardized image, if there are any parts that exceed the preset range, a linear stretching mapping is performed to obtain the third standardized image; The fourth cropped screen is obtained by cropping a fixed core area of ​​the game from the third standard screen. Calculate the grayscale gradient magnitudes in the horizontal and vertical directions for the fourth cropped image to obtain the fifth gradient image; The fifth gradient image and the fourth cropped image are then superimposed with pixel-weighted summaries to obtain the sixth enhanced image; The sixth enhanced image is input into a convolutional neural network model for multi-layer feature map extraction to obtain the seventh deep feature image.

[0008] In one aspect of the invention, the step of identifying occlusion boundary regions using an edge detection algorithm based on the processed game screen, and determining the distribution characteristics of brightness contrast and texture details within these regions as basic input, includes: Obtain real-time game screenshot data from player clients; Gaussian filtering is used to process the real-time image to obtain the first smooth image; Perform adaptive threshold segmentation on the first smooth image to obtain the second segmented image; The third contrast parameter is obtained by calculating the average brightness and local contrast of each independent region from the second segmented image. The fourth region weight value is obtained by calculating the weighted value based on the third comparison parameter and the number of pixels in the region. The fifth weighted region is obtained by weighting the corresponding regions in the original image using the weight value of the fourth region. The distribution in the sixth direction is obtained by calculating the horizontal and vertical gradient direction histograms for the fifth weighted region. The sixth direction distribution is input into a support vector machine classifier for processing to obtain the seventh occlusion category judgment result; The range of subsequent game interaction response areas is determined based on the results of the seventh occlusion category assessment.

[0009] In one aspect of the invention, after acquiring the distribution features, performing multi-layer convolution operations on brightness contrast and texture details using a convolutional neural network to obtain a high-dimensional visual feature vector representing the possibility of abnormal changes includes: Obtain real-time game screenshot data from player clients; Gaussian filtering is used to process the real-time game screen data to obtain the first smooth image; Perform Otsu thresholding on the first smoothed image to obtain the second segmented image; Extract all connected regions from the second segmented image to obtain the third set of connected regions; The average brightness value and grayscale standard deviation of each region in the third connected region set are calculated to obtain the parameter set of the fourth region. The fifth set of significance coefficients is obtained by calculating the significance coefficients based on the fourth region parameter set and the total number of pixels in each region; The sixth mask region image is obtained by weighting the corresponding positions of the original game screen using the fifth set of significance coefficients; The seventh high-dimensional feature vector is obtained by performing multi-layer convolution operations on the image of the sixth mask region using a convolutional neural network. The seventh high-dimensional feature vector is input into the support vector machine classifier to determine the category and obtain the eighth abnormal occlusion category result. The final responsive area of ​​the game interaction is determined based on the results of the eighth abnormal occlusion category.

[0010] In one aspect of the invention, the step of fusing depth cue information onto a high-dimensional visual feature vector and marking it as a potential anomalous region if the depth gradient in the vector exceeds a preset threshold, and determining a preliminary anomalous change pattern, includes: By processing high-dimensional features and visual vectors, the initial vector data content is obtained. The key depth cue information is separated by a hierarchical extraction method, resulting in a preliminary information set. Based on the information set after initial separation, a comparison is made between depth cues and gradient analysis. If the gradient analysis result exceeds a preset threshold, it is marked as a potential anomaly region, and the distribution range of potential anomalies is determined. Based on the distribution range of potential anomalies, and combining information and change patterns, the specific location information of the anomaly area is obtained. The location information is then processed into a grid by a region division method to obtain gridded anomaly units. By using gridded abnormal units, combined with potential labels and preliminary judgments, the vector processing results within each unit are analyzed. If the high-dimensional feature fluctuations within a unit exceed a preset range, it is marked as a key focus object, and key abnormal units are identified. Based on key abnormal units, combined with abnormal regions and change patterns, deep implications information within each unit is extracted. Abnormal units are then grouped using clustering to obtain the grouped abnormal categories. For the anomaly categories after grouping, the distribution characteristics of each category are obtained by combining regional division and information. Statistical tools are used to summarize the distribution characteristics and determine the final anomaly change pattern.

[0011] In one aspect of the invention, the step of extracting sub-region samples from the initial abnormal change pattern and performing binary classification on these samples using a support vector machine classifier to determine whether they conform to the occlusion and damage characteristics caused by the perspective cheat includes: Extract sub-region samples from preliminary abnormal change patterns; The sub-region samples are classified into two categories by a support vector machine classifier to obtain the classification label results belonging to the occlusion and damage type. Based on the category label results, a set of suspected cheating sub-regions was selected; For the suspected cheating sub-region set, perform coordinate mapping and restoration to obtain the spatial location information of each sub-region in the original image; Based on spatial location information, a neighborhood connection relationship is constructed and suspected cheating sub-regions with neighborhood connection relationships are merged to obtain a connected set of cheating occlusion blocks; The area percentage of connected cheating occlusion blocks is statistically analyzed, and the distance between each block and the center of the screen is calculated. If the area is concentrated and the center of the screen is close together, the corresponding screen frame is marked as a high-risk cheating frame, and the high-risk cheating frame sequence and the spatial positioning information of each cheating occlusion block are output.

[0012] In one aspect of the invention, after obtaining the classifier output result, by comparing it with the statistical model of a normal game screen dataset, if the result deviation is greater than a preset threshold, visual feature abnormality is confirmed, and a final abnormality detection signal is obtained, including: Obtain the set of all frame classification labels output by the classifier; To analyze the frequency distribution of each category in the classification label set, the baseline distribution of category frequency for multiple frames in the normal game screen dataset was extracted. The deviation value is obtained by comparing the difference between the current frame category frequency distribution and the baseline distribution; If the deviation value is greater than the preset threshold, the corresponding frame is marked as an abnormal frame. Continuity is determined based on the position information of the frame sequence marked as abnormal. If the number of consecutive abnormal frames reaches a set length, a final visual anomaly detection signal is generated.

[0013] In one aspect of the present invention, the step of updating the real-time log database of the anti-cheat detection system based on the final anomaly detection signal, and determining the signal strength to trigger an alarm mechanism to complete the detection cycle includes: Obtain the sequence of abnormal signal records from the real-time log database; The time interval distribution of adjacent signals is statistically analyzed for abnormal signal recording sequences, and a baseline time interval distribution is obtained from historical normal player datasets; The signal strength value is obtained by comparing the current time interval distribution with the reference time interval distribution; If the signal strength value is greater than the preset threshold, it is determined that the current alarm level is high. Update the status markers of the corresponding players based on the advanced alert level; The updated player status markers, along with the processing time point, will be stored in the real-time log database.

[0014] In another aspect, the present invention also relates to a neural network-based anti-cheat detection system for multiplayer online games, the system comprising: The image preprocessing module is used to capture the game screen data rendered by the player in real time, and use image preprocessing technology to remove noise and standardize the pixel value distribution to obtain the processed game screen for subsequent feature extraction. The edge detection module is used to identify the boundary regions of occlusions based on the processed game screen using edge detection algorithms, and to determine the distribution characteristics of brightness contrast and texture details in these regions as basic inputs; The convolution operation module is used to obtain distribution features and then perform multi-layer convolution operations on brightness contrast and texture details through a convolutional neural network to obtain a high-dimensional visual feature vector representing the possibility of abnormal changes. The abnormal pattern judgment module is used to fuse depth hint information for high-dimensional visual feature vectors. If the depth gradient in the vector exceeds a preset threshold, it is marked as a potential abnormal region and the initial abnormal change pattern is determined. The sample classification module is used to extract sub-region samples from the initial abnormal change pattern. A support vector machine classifier is used to perform binary classification on these samples to determine whether they conform to the occlusion and damage characteristics caused by the perspective cheat. The anomaly confirmation module is used to obtain the classifier output results and compare them with the statistical model of the normal game screen dataset. If the result deviation is greater than a preset threshold, the visual feature is confirmed to be abnormal, and the final anomaly detection signal is obtained. The detection loop module is used to update the real-time log database of the anti-cheat detection system based on the final abnormal detection signal, and to determine the signal strength to trigger the alarm mechanism to complete the detection loop.

[0015] Compared with the prior art, the present invention has the following beneficial effects: This invention captures the rendered game screen from the player's end and performs image preprocessing to remove noise and standardize pixel value distribution, resulting in a clean and stable input image. Then, an edge detection algorithm is used to accurately identify the boundary regions of occlusions, and the distribution features of brightness contrast and texture details within these regions are extracted as core inputs. A convolutional neural network is then used to perform multi-layer depth extraction on these features, generating a high-dimensional visual feature vector to characterize the possibility of abnormal changes. Based on this, depth cue information is fused; when the depth gradient exceeds a threshold, potential abnormal regions are marked to form a preliminary abnormal pattern. Sub-region samples are then extracted from this pattern, and a support vector machine is used for binary classification to determine whether they conform to the occlusion and destruction characteristics unique to wallhacks. Finally, a deviation comparison is performed using a statistical model of normal game screens. If the deviation exceeds a threshold, a visual anomaly is confirmed, a final detection signal is generated, an alarm is triggered, and the real-time log database is updated. This invention effectively solves the core business problem of abnormal penetration of occlusions caused by wallhacks, achieving high-precision and robust real-time detection, significantly improving game fairness and anti-cheating capabilities. Attached Figure Description

[0016] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained from these drawings without creative effort.

[0017] Figure 1 This is one of the flowcharts for the neural network-based anti-cheat detection method for multiplayer online games according to the present invention.

[0018] Figure 2 This is the second flowchart of the neural network-based anti-cheat detection method for multiplayer online games according to the present invention.

[0019] Figure 3 This is the third flowchart of the neural network-based anti-cheat detection method for multiplayer online games according to the present invention. Detailed Implementation

[0020] The present invention will be further described below with reference to embodiments. These embodiments are merely some, not all, of the embodiments of the present invention. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are all within the protection scope of the present invention.

[0021] Please see Figures 1-3 As shown in the figure, this embodiment discloses a method and system for anti-cheat detection in multiplayer online games based on neural networks, wherein the method may specifically include: Step 101: By capturing the game screen data rendered on the player's end in real time, image preprocessing techniques are used to remove noise and standardize pixel value distribution to obtain the processed game screen for subsequent feature extraction.

[0022] The original game footage is captured in real-time from the player's client via a video capture interface. Median filtering is applied to the acquired original game footage to remove scattered noise points, resulting in a first denoised image. Histogram equalization is then performed on the first denoised image to adjust the pixel value distribution, resulting in a second standardized image. Based on the pixel value range of the second standardized image, if any pixels exceed a preset range, linear stretching is performed, resulting in a third standardized image. A fixed core game region is cropped from the third standardized image, resulting in a fourth cropped image. The horizontal and vertical grayscale gradient magnitudes are calculated for the fourth cropped image, resulting in a fifth gradient image. The fifth gradient image and the fourth cropped image are then pixel-weightedly superimposed, resulting in a sixth enhanced image. The sixth enhanced image is input into a convolutional neural network model for multi-layer feature map extraction, resulting in a seventh depth feature image.

[0023] Specifically, in implementing real-time capture and processing of game screen data rendered on the player's end, the process begins with capturing the screen data. This is achieved through the game engine's built-in rendering pipeline interface, acquiring each frame's data. Assuming a capture resolution of 1920x1080, a frame rate of 60 frames per second, and a data format of RGB three channels with 8-bit depth per channel, approximately 6.2MB of raw data per frame is generated. A real-time buffer stores the most recent 5 seconds of data for subsequent processing. Next, image preprocessing is performed to remove noise. A Gaussian blur algorithm is used, with a filter kernel size of 5x5 and a standard deviation of 1.5. By weighted averaging of the area surrounding each pixel, noise points are effectively smoothed. For example, pixel value abrupt changes from RGB(200,150,100) due to rendering jitter in the original image are smoothed to (195,148,102), reducing noise impact by approximately 20%. The pixel value distribution is then standardized using linear normalization, mapping the original pixel value range of 0 to 255 to the interval of 0.0 to 1.0. The calculation formula is: new value = (original value minus mean) divided by standard deviation. Assuming a frame has a mean of 128 and a standard deviation of 50, a pixel value of 200 will be standardized to 1.44. Further truncation ensures the value remains within the target range, improving the stability of subsequent feature extraction. The processed image data can be used for quality verification before feature extraction. For example, by calculating the overall contrast of the image, it is ensured that the standardization improves the contrast by approximately 15%. If it falls below a threshold, feedback is sent to the rendering module to adjust parameters, forming a closed-loop optimization logic. This ensures that the data quality matches the training requirements of subsequent deep learning models, such as the dependence of object detection models on image sharpness. Through this process, from capture to preprocessing to quality verification, a complete data processing chain is formed, providing reliable input for subsequent feature extraction.

[0024] Step 102: Based on the processed game screen, use an edge detection algorithm to identify the boundary regions of occlusions and determine the distribution characteristics of brightness contrast and texture details in these regions as basic input.

[0025] Real-time game screen data is obtained from the player's client. Gaussian filtering is applied to the real-time screen to obtain a first smoothed image. Adaptive threshold segmentation is performed on the first smoothed image to obtain a second segmented image. The average brightness and local contrast of each independent region in the second segmented image are calculated to obtain a third contrast parameter. A weighted value is calculated based on the third contrast parameter and the number of pixels in each region to obtain a fourth region weight value. The fourth region weight value is used to extract the corresponding region in the original image, resulting in a fifth weighted region. Histograms of horizontal and vertical gradient directions are calculated for the fifth weighted region to obtain a sixth directional distribution. The sixth directional distribution is input into a support vector machine classifier to obtain a seventh occlusion category judgment result. The subsequent game interaction response area range is determined based on the seventh occlusion category judgment result.

[0026] Specifically, based on the processed game screen data, the Canny edge detection algorithm is further used to identify possible occlusion boundary regions in the screen. First, a low threshold of 50 and a high threshold of 150 are set. By calculating the image gradient magnitude and combining it with non-maximum suppression, a preliminary edge contour is obtained. Then, a dual threshold connection mechanism is used to associate weak edges with strong edges, and finally, the occlusion boundary lines with good continuity are extracted. For example, in a certain frame, the boundary of the foreground tree occluding the building is successfully detected, generating a total of about 420 edge point coordinates. Subsequently, for the 5-pixel-wide neighborhood within these boundary areas, brightness contrast features and texture detail distribution features were calculated. The brightness contrast feature was characterized by the difference between the maximum and minimum brightness values ​​within the area. Assuming that the maximum brightness of a certain occluded boundary area is 235 and the minimum brightness is 62, the contrast difference is 173, which serves as the basis for judging strong occlusion. The texture detail distribution was calculated using the gray-level co-occurrence matrix method, with a distance of 1 and an angle of 0°. Three statistical parameters, energy, contrast, and correlation, were calculated. For example, the energy value was 0.042, the contrast value was 12.8, and the correlation value was 0.67. By comparing the average energy of the normal area (0.085) and the contrast value (4.2), it was found that the energy of the occluded area decreased by about 50.6% and the contrast increased by about 204.8%, indicating that the texture complexity was significantly reduced and the brightness abrupt change was obvious. The two types of feature vectors mentioned above together form a 12-dimensional feature descriptor, which is used for subsequent occlusion classification and position regression analysis. The entire process is completed on the GPU in about 8.2 milliseconds per frame, ensuring that real-time requirements are met, thus providing a reliable quantitative basis for dynamic occlusion judgment and rendering optimization in the game.

[0027] Step 103: After obtaining the distribution features, perform multi-layer convolution operations on brightness contrast and texture details through a convolutional neural network to obtain a high-dimensional visual feature vector representing the possibility of abnormal changes.

[0028] Real-time game screen data is obtained from the player's client. Gaussian filtering is applied to the real-time game screen data to obtain a first smoothed image. Otsu thresholding is performed on the first smoothed image to obtain a second segmented image. All connected regions are extracted from the second segmented image to obtain a third connected region set. The average brightness value and grayscale standard deviation of each region in the third connected region set are calculated to obtain a fourth region parameter set. Based on the fourth region parameter set and the total number of pixels in each region, a significance coefficient is calculated to obtain a fifth significance coefficient set. The fifth significance coefficient set is used to perform weighted masking on the corresponding positions in the original game screen to obtain a sixth masked region image. A convolutional neural network is used to perform multi-layer convolution operations on the sixth masked region image to obtain a seventh high-dimensional feature vector. The seventh high-dimensional feature vector is input into a support vector machine classifier for category determination to obtain an eighth anomalous occlusion category result. The final responsive area range for game interaction is determined based on the eighth anomalous occlusion category result.

[0029] Specifically, based on the aforementioned distribution characteristics, a lightweight convolutional neural network model is further constructed to extract deep features of brightness contrast and texture detail changes. First, the network is designed to contain three convolutional modules. The first layer uses 32 3×3 convolutional kernels with a stride of 1 and padding of "same". The input is a normalized 12-dimensional feature slice (size adjusted to 32×32). After ReLU activation, a preliminary response map is obtained. The second layer uses 64 convolutional kernels and adds batch normalization. After convolution, the feature map size is reduced to 16×16. At the same time, max pooling operation (2×2 window) is introduced to enhance the sensitivity to local anomalies. The third layer uses 128 convolutional kernels and combines 1×1 dimensionality reduction convolution to finally output a 512-dimensional high-dimensional visual feature vector. This vector condenses the deep pattern information of brightness abrupt changes and texture degradation in the occluded area. During the training phase, a labeled game frame dataset (approximately 85,000 frames) was used. Positive samples were frames where the occluded area accounted for more than 35%, and negative samples were normal areas without obvious occlusion. A cross-entropy loss function was employed, combined with a learning rate of 0.001 and the Adam optimizer. After approximately 28 epochs of training, the model achieved an anomaly region recognition accuracy of 0.927 on the validation set. This 512-dimensional feature vector was input into a fully connected layer (two layers with 256 and 64 hidden nodes respectively). Finally, a single-frame occlusion anomaly probability score was obtained through sigmoid function mapping. For example, a typical occluded frame scored 0.89, while the average score for normal areas was only 0.07, a difference of approximately 12.7 times. This score can be directly used as the basis for branch decisions in subsequent dynamic rendering strategies. The entire forward inference process on RTX series graphics cards averaged approximately 4.7 milliseconds per frame, meeting the strict latency constraints of real-time game processing, thus providing efficient high-order visual representation support for intelligent occlusion recognition and image optimization.

[0030] Step 104: For high-dimensional visual feature vectors, depth hint information is fused. If the depth gradient in the vector exceeds a preset threshold, it is marked as a potential abnormal region, and a preliminary abnormal change pattern is determined.

[0031] By processing high-dimensional features and visual vectors, initial vector data is obtained. A hierarchical extraction method is used to separate key depth cue information, resulting in a preliminary information set. Based on this information set, depth cue information and gradient analysis are compared. If the gradient analysis result exceeds a preset threshold, it is marked as a potential anomaly region, determining the distribution range of potential anomalies. For the distribution range of potential anomalies, combining information and change patterns, the specific location information of the anomaly regions is obtained. The location information is then gridded using a region division method, resulting in gridded anomaly units. Using these gridded anomaly units, combined with potential markings and preliminary judgment, the vector processing results within each unit are analyzed. If the high-dimensional feature fluctuations within a unit exceed a preset range, it is marked as a key focus object, identifying key anomaly units. Based on these key anomaly units, combining anomaly regions and change patterns, depth cue information within each unit is extracted. Clustering is used to group the anomaly units, resulting in grouped anomaly categories. For these grouped anomaly categories, combining region division and information, the distribution characteristics of each category are obtained. Statistical tools are used to summarize the distribution characteristics, determining the final anomaly change pattern.

[0032] Specifically, based on the extracted high-dimensional visual feature vectors, depth cue information is further incorporated to enhance the sensitivity to potential abnormal regions in the game scene. First, depth gradients are calculated for each channel in the feature vectors. The Sobel operator is used to extract gradient components in the horizontal and vertical directions and synthesize gradient magnitude maps. Pixels with gradient magnitudes exceeding 0.42 are marked as candidate points for depth mutations. Then, the spatial clustering density of candidate points in the feature space is calculated. When the proportion of depth mutation points in any 8×8 local region is greater than 0.31, the region is determined to have a potential abnormal change pattern. Next, a depth consistency verification mechanism is introduced to analyze the cosine similarity of adjacent feature vectors within the marked region. If the similarity between three consecutive frames is less than 0.76 and the depth gradient direction shows a significant divergence trend, the region is further confirmed as a suspected abnormal region. On this basis, the k-means clustering algorithm (k=5) is used to group the depth gradient features of all suspected abnormal regions. The cluster with the cluster center furthest from the global mean is selected as the most suspicious abnormal pattern, and its center vector is recorded as a subsequent matching template. After the above process, the false negative rate of depth-related occlusion anomalies was successfully reduced from 14.3% to 5.9% in a typical game test sequence. At the same time, the average time for depth anomaly judgment per frame was controlled within 1.2 milliseconds, providing a reliable depth-assisted decision-making basis for real-time intelligent processing of screen occlusion.

[0033] Step 105: Extract sub-region samples from the initial abnormal change pattern, and use a support vector machine classifier to perform binary classification on these samples to determine whether they conform to the occlusion and damage characteristics caused by the perspective cheat.

[0034] Sub-region samples are extracted from the initial abnormal change pattern; the sub-region samples are binary classified using a support vector machine classifier to obtain classification labels for occlusion / damage types; a set of suspected cheating sub-regions is selected based on the classification labels; coordinate mapping is performed on the set of suspected cheating sub-regions to obtain the spatial location information of each sub-region in the original image; neighborhood connections are constructed based on the spatial location information, and suspected cheating sub-regions with neighborhood connections are merged to obtain a set of connected cheating occlusion blocks; the area ratio of the connected cheating occlusion blocks is statistically analyzed, and the distance between each block and the center of the image is calculated; if the area ratio is concentrated and the distance to the center of the image is close, the corresponding image frame is marked as a high-risk cheating frame, and a high-risk cheating frame sequence and the spatial location information of each cheating occlusion block are output.

[0035] Specifically, from the sub-region samples segmented in the initial abnormal change pattern, 30% of the samples are randomly selected as the training set, and the remainder as the validation set. A support vector machine classifier combined with a radial basis function kernel (RBF kernel, with gamma set to 0.035 and penalty coefficient C set to 12.8) is used for binary classification training to distinguish between normal game occlusion and abnormal perspective damage features caused by perspective cheats. In the feature extraction stage, the gray-level co-occurrence matrix in eight directions is calculated for each sub-region. Four texture statistics—energy, contrast, correlation, and inverse moment—are extracted and combined with the depth variance, boundary sharpness (calculated using the Laplacian operator and the absolute mean is taken) within the region, and the standard deviation of the color channels to form a ten-dimensional feature descriptor vector. After training, the validation set samples are predicted. When the classification confidence is greater than 0.82 and the number of support vectors is less than 17% of the total samples, the sub-region is determined to be highly consistent with the occlusion destruction mode caused by the perspective cheat. If the confidence is between 0.61 and 0.82, it is marked as an observation area, and the feature vector of the area is added to the incremental learning queue. An online update is automatically triggered every 50 frames to adapt to the lighting and texture changes of different game scenes, thereby effectively improving the recognition accuracy and robustness of perspective cheating behavior.

[0036] Step 106: After obtaining the classifier output, compare the result with the statistical model of the normal game screen dataset. If the result deviation is greater than the preset threshold, the visual feature is confirmed to be abnormal, and the final anomaly detection signal is obtained.

[0037] Obtain the set of all frame classification labels output by the classifier; calculate the frequency distribution of each category for the set of classification labels; extract the baseline distribution of category frequency for multiple frames from the normal game screen dataset; obtain the deviation value by comparing the difference between the current frame's category frequency distribution and the baseline distribution; if the deviation value is greater than a preset threshold, mark the corresponding frame as an abnormal frame; determine the continuity based on the position information of the frame sequence marked as abnormal frames; if the number of consecutive abnormal frames reaches a set length, generate the final visual anomaly detection signal.

[0038] Specifically, after obtaining the classifier's output, the system first compares the classifier's predicted probability values ​​with the statistical model of a pre-constructed normal game screen dataset. The specific method involves calculating the Kullback-Leibler divergence between the abnormal probability distribution output by the classifier and the probability distribution of the normal dataset, setting a threshold of 2.5. If the calculated Kullback-Leibler divergence value exceeds 2.5, it is preliminarily determined that the visual features deviate from the normal range. Next, the system performs multi-dimensional analysis on the features of each frame output by the classifier, extracting the average brightness (set as a baseline of 120, with an allowable fluctuation range of ±15), edge density (calculated using the Canny algorithm, with a normal range of 0.05 to 0.12), and color saturation distribution (average S-channel value in HSV space, with a normal range of 0.3 to 0.7). If any two of these indicators exceed the set range, for example, an average brightness of 140 and an edge density of 0.15, then the feature abnormality is further confirmed. Finally, the system logically integrates the results of the two analysis steps above, employing a weighted scoring mechanism (KL divergence accounting for 60%, multi-dimensional indicators accounting for 40%) to calculate a comprehensive anomaly score. If the score exceeds a preset value of 75 points (out of 100), a final anomaly detection signal is generated. To ensure the continuity of detection, the system correlates the anomaly signal with historical frame data, using a sliding window method (window size of 30 frames) to calculate the frequency of anomaly signal occurrence. If the frequency exceeds 0.6, the subsequent anomaly tracking module is triggered, automatically recording relevant screen features and storing them in the anomaly database for subsequent data sharing with other business modules such as the real-time monitoring system, forming a complete anomaly detection closed loop.

[0039] Step 107: Based on the final anomaly detection signal, update the real-time log database of the anti-cheat detection system, determine the signal strength to trigger the alarm mechanism to complete the detection cycle.

[0040] The system retrieves abnormal signal record sequences from the real-time log database. It then statistically analyzes the time interval distribution of adjacent signals within these sequences. A baseline time interval distribution is obtained from the historical normal player dataset. The current time interval distribution is compared to the baseline distribution to obtain the signal strength value. If the signal strength value exceeds a preset threshold, a high alert level is determined. Based on the high alert level, the corresponding player's status flag is updated. The updated player status flag, along with the current processing time point, is stored in the real-time log database. Specifically, upon receiving the final anomaly detection signal, the system automatically writes the signal data into the real-time log database of the anti-cheat detection system, recording it using a timestamp and signal identifier. For example, the signal generation time is 2023-10-10 14:30:25, the signal strength value is 82.5 (out of 100), and the game scene ID is appended as G12345 for subsequent traceability. Simultaneously, the system categorizes signal strength into three levels using a preset strength range algorithm: 0-50 is low-level, 51-80 is medium-level, and 81-100 is high-level. The current signal strength of 82.5 is classified as high-level. Subsequently, the system triggers an alarm mechanism based on the high-level signal, automatically invoking preset alarm rules. For example, it calculates the correlation between signal strength and historical anomaly data using the Pearson correlation coefficient algorithm. If the correlation coefficient exceeds 0.75, the current anomaly is confirmed to be highly correlated with historical patterns and requires priority processing. The current calculation result is 0.82, meeting the condition. Next, the system pushes the alarm information to the core anti-cheat module, automatically generating an anomaly summary report containing key fields such as signal strength, timestamp, and correlation coefficient. It then interfaces with the game operation monitoring platform via an internal message queue to ensure real-time synchronization of anomaly information, forming a closed-loop management system for detection. To further enhance logical correlation, the system also cross-analyzes signal strength data with player behavior logs. If an anomaly signal is found to be related to a sudden increase in player operation frequency (e.g., more than 100 operations per minute), it is automatically marked as a high-risk event and stored in the risk assessment database, providing data support for subsequent adjustments to anti-cheat strategies.

[0041] In some different embodiments, the present invention also provides a neural network-based anti-cheat detection system for multiplayer online games, mainly comprising: The image preprocessing module is used to capture the game screen data rendered by the player in real time, and use image preprocessing technology to remove noise and standardize the pixel value distribution to obtain the processed game screen for subsequent feature extraction. The edge detection module is used to identify the boundary regions of occlusions based on the processed game screen using edge detection algorithms, and to determine the distribution characteristics of brightness contrast and texture details in these regions as basic inputs; The convolution operation module is used to obtain distribution features and then perform multi-layer convolution operations on brightness contrast and texture details through a convolutional neural network to obtain a high-dimensional visual feature vector representing the possibility of abnormal changes. The abnormal pattern judgment module is used to fuse depth hint information for high-dimensional visual feature vectors. If the depth gradient in the vector exceeds a preset threshold, it is marked as a potential abnormal region and the initial abnormal change pattern is determined. The sample classification module is used to extract sub-region samples from the initial abnormal change pattern. A support vector machine classifier is used to perform binary classification on these samples to determine whether they conform to the occlusion and damage characteristics caused by the perspective cheat. The anomaly confirmation module is used to obtain the classifier output results and compare them with the statistical model of the normal game screen dataset. If the result deviation is greater than a preset threshold, the visual feature is confirmed to be abnormal, and the final anomaly detection signal is obtained. The detection loop module is used to update the real-time log database of the anti-cheat detection system based on the final abnormal detection signal, and to determine the signal strength to trigger the alarm mechanism to complete the detection loop.

[0042] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for anti-cheat detection in multiplayer online games based on neural networks, characterized in that, include: The game screen data rendered on the player's end is captured in real time, and image preprocessing technology is used to remove noise and standardize pixel value distribution to obtain the processed game screen. Based on the processed game screen, an edge detection algorithm is used to identify the boundary region of the occlusion, determine the distribution characteristics of brightness contrast and texture details within the boundary region of the occlusion, and input the distribution characteristics into a convolutional neural network; The distribution features are subjected to multi-layer convolution operations by the convolutional neural network to obtain a high-dimensional visual feature vector that represents the possibility of abnormal changes. The high-dimensional visual feature vector is processed, and depth cue information is separated using a hierarchical extraction method to obtain a pre-separated information set. Depth cue and gradient analysis are performed on the pre-separated information set. When the gradient analysis result exceeds a preset threshold, potential anomaly regions are marked and the distribution range of potential anomalies is determined. The distribution range of potential anomalies is then gridded to obtain anomaly units. Key anomaly units are identified based on the high-dimensional feature fluctuations within each anomaly unit. Depth cue information within the key anomaly units is extracted and clustered. Preliminary anomaly change patterns are determined based on the distribution characteristics of the anomaly categories obtained from the clustering. Sub-region samples are extracted from the preliminary abnormal change pattern, and a support vector machine classifier is used to perform binary classification on the sub-region samples to determine whether they conform to the occlusion and damage characteristics caused by the perspective cheat. The output of the support vector machine classifier is compared with the statistical model of the normal game screen dataset. If the deviation is greater than a preset threshold, the visual feature is confirmed to be abnormal and the final abnormality detection signal is obtained. The real-time log database of the anti-cheat detection system is updated based on the final anomaly detection signal, and an alarm mechanism is triggered according to the signal strength to complete the detection cycle.

2. The anti-cheat detection method for multiplayer online games based on neural networks according to claim 1, characterized in that, The real-time capture of the game screen data rendered on the player's end employs image preprocessing techniques to remove noise and standardize pixel value distribution, resulting in a processed game screen, including: The original game footage is captured in real time from the player's client via a video capture interface; The median filtering method is used to remove scattered noise points from the original game screen to obtain the first denoised screen. Histogram equalization is performed on the first denoised image to adjust the pixel value distribution, resulting in a second standardized image. If there are any parts that exceed the preset range based on the pixel value range of the second standardized image, then a linear stretching mapping is performed to obtain the third standardized image. A fixed core game area is extracted from the third standard image to obtain the fourth cropped image; The grayscale gradient magnitudes in the horizontal and vertical directions of the fourth cropped image are calculated respectively to obtain the fifth gradient image; The fifth gradient image and the fourth cropped image are then superimposed with pixel-level weighted summaries to obtain the sixth enhanced image; The sixth enhanced image is input into a convolutional neural network model for multi-layer feature map extraction to obtain the seventh deep feature image.

3. The anti-cheat detection method for multiplayer online games based on neural networks according to claim 1, characterized in that, Based on the processed game screen, an edge detection algorithm is used to identify the boundary regions of occlusions, and the distribution characteristics of brightness contrast and texture details within the boundary regions of the occlusions are determined, including: Obtain real-time game screenshot data from player clients; Gaussian filtering is used to process the real-time game screen data to obtain a first smooth screen. An adaptive threshold segmentation operation is performed on the first smoothed image to obtain the second segmented image; The average brightness and local contrast of each independent region in the second segmented image are calculated to obtain the third contrast parameter. The weighted value of the fourth region is obtained by calculating the weighted value based on the third comparison parameter and the number of pixels in the corresponding independent region; The corresponding regions in the original image are extracted using the weighted values ​​of the fourth region to obtain the fifth weighted region. For the fifth weighted region, calculate the horizontal and vertical gradient direction histograms to obtain the sixth direction distribution; The sixth directional distribution is input into a support vector machine classifier for processing to obtain the seventh occlusion category judgment result; The range of subsequent game interaction response areas is determined based on the seventh occlusion category judgment result.

4. The anti-cheat detection method for multiplayer online games based on neural networks according to claim 1, characterized in that, The step of inputting the distribution features into a convolutional neural network and performing multi-layer convolution operations on the distribution features through the convolutional neural network to obtain a high-dimensional visual feature vector representing the probability of abnormal changes includes: Obtain real-time game screenshot data from player clients; Gaussian filtering is used to process the real-time game screen data to obtain a first smooth image; Perform Otsu thresholding on the first smoothed image to obtain the second segmented image; Extract all connected regions from the second segmented image to obtain a third set of connected regions; For the third set of connected regions, the average brightness value and grayscale standard deviation of each connected region are calculated to obtain the fourth set of region parameters; The significance coefficients are calculated based on the fourth region parameter set and the total number of pixels in each connected region to obtain the fifth significance coefficient set; The corresponding positions of the original game screen are weighted and masked using the fifth set of saliency coefficients to obtain the sixth masked region image; The convolutional neural network is used to perform multi-layer convolution operations on the image of the sixth mask region to obtain the seventh high-dimensional feature vector. The seventh high-dimensional feature vector is input into the support vector machine classifier for category determination to obtain the eighth abnormal occlusion category result. The final responsive area of ​​the game interaction is determined based on the results of the eighth abnormal occlusion category.

5. The anti-cheat detection method for multiplayer online games based on neural networks according to claim 1, characterized in that, The high-dimensional visual feature vector is processed by using a hierarchical extraction method to separate depth cue information, resulting in a pre-separated information set. Depth cue and gradient analysis are performed on the pre-separated information set. When the gradient analysis result exceeds a preset threshold, potential anomaly regions are marked and the distribution range of potential anomalies is determined. The distribution range of potential anomalies is then gridded to obtain anomaly units. Key anomaly units are identified based on the high-dimensional feature fluctuations within each anomaly unit. Depth cue information within the key anomaly units is extracted and clustered. Preliminary anomaly change patterns are determined based on the distribution characteristics of the clustered anomaly categories, including: The high-dimensional visual feature vector is processed to obtain initial vector data. Depth cue information is extracted from the initial vector data using a hierarchical extraction method. The depth cue information is then fused with the high-dimensional visual feature vector to obtain the fused feature vector. Gradient analysis is performed on the depth implications in the fused feature vector. If the gradient analysis result exceeds a preset threshold, the region corresponding to the gradient analysis result is marked as a potential anomaly region to determine the distribution range of the potential anomaly. The location information of each abnormal region within the distribution range of the potential anomaly is obtained, and the location information is processed into a grid by a region division method to obtain a gridded anomaly unit. Analyze the vector processing results within each anomalous unit. If the high-dimensional feature fluctuations within the anomalous unit exceed a preset range, then mark the corresponding anomalous unit as a key anomalous unit. Extract the deep cue information within each key anomaly unit, and group the key anomaly units using clustering to obtain the anomaly categories after grouping; The distribution characteristics of each anomaly category are obtained, and the distribution characteristics are summarized using statistical methods to determine the final preliminary anomaly change pattern.

6. The anti-cheat detection method for multiplayer online games based on neural networks according to claim 1, characterized in that, The step of extracting sub-region samples from the initial abnormal change pattern and performing binary classification on the sub-region samples using a support vector machine classifier to determine whether they conform to the occlusion and damage characteristics caused by the perspective cheat includes: Extract sub-region samples from the initial abnormal change pattern; The sub-region samples are subjected to binary classification by the support vector machine classifier to obtain the classification label result belonging to the occlusion and damage type. Based on the classification label results, a set of suspected cheating sub-regions was selected; Perform coordinate mapping restoration on the set of suspected cheating sub-regions to obtain the spatial location information of each suspected cheating sub-region in the original image; Based on the spatial location information, a neighborhood connection relationship is constructed, and suspected cheating sub-regions with neighborhood connection relationships are merged to obtain a set of connected cheating occlusion blocks. The area ratio of the cheating occlusion block set is statistically analyzed, and the distance between each cheating occlusion block and the center of the screen is calculated. If the area is concentrated and the distance from the center of the screen meets the preset distance condition, the corresponding screen frame is marked as a high-risk cheating frame, and the high-risk cheating frame sequence and the spatial positioning information of each cheating occlusion block are output.

7. The anti-cheat detection method for multiplayer online games based on neural networks according to claim 1, characterized in that, The step of comparing the output of the support vector machine classifier with the statistical model of the normal game screen dataset, and confirming visual feature abnormality and obtaining the final anomaly detection signal if the deviation is greater than a preset threshold, includes: Obtain the set of image frame classification labels output by the support vector machine classifier; The frequency distribution of each category in the frame classification label set is statistically analyzed, and the baseline frequency distribution of multiple frames is extracted from the normal game screen dataset. The difference between the category frequency distribution of the current frame and the category frequency baseline distribution is used to obtain the deviation value; If the deviation value is greater than a preset threshold, the corresponding frame will be marked as an abnormal frame. Continuity is determined based on the position information of the frame sequence marked as abnormal. If the number of consecutive abnormal frames reaches the set length, a final abnormality detection signal is generated.

8. The anti-cheat detection method for multiplayer online games based on neural networks according to claim 1, characterized in that, The step of updating the real-time log database of the anti-cheat detection system based on the final anomaly detection signal and triggering an alarm mechanism according to the signal strength includes: Obtain the abnormal signal record sequence from the real-time log database; The time interval distribution of adjacent abnormal signals in the abnormal signal recording sequence is statistically analyzed, and a baseline time interval distribution is obtained from the historical normal player dataset; The signal strength value is obtained by comparing the current time interval distribution with the reference time interval distribution; If the signal strength value is greater than a preset threshold, the current alarm level is determined to be a high alarm level; Update the corresponding player's status flag based on the advanced alert level; The updated player status markers, along with the processing time point, are stored in the real-time log database.

9. A neural network-based anti-cheat detection system for multiplayer online games, characterized in that, include: The image preprocessing module is used to capture the game screen data rendered on the player's end in real time. It uses image preprocessing technology to remove noise and standardize the pixel value distribution to obtain the processed game screen. The edge detection module is used to receive the processed game screen, use an edge detection algorithm to identify the boundary region of the occlusion, and determine the distribution characteristics of brightness contrast and texture details within the boundary region of the occlusion. The convolution operation module is used to receive the distribution features, input the distribution features into the convolutional neural network, and perform multi-layer convolution operations on the distribution features through the convolutional neural network to obtain a high-dimensional visual feature vector representing the possibility of abnormal changes. An abnormal pattern judgment module is used to receive the high-dimensional visual feature vector, fuse the depth hint information with the high-dimensional visual feature vector to obtain a fused feature vector, and mark the corresponding region as a potential abnormal region when the depth gradient in the fused feature vector exceeds a preset threshold to obtain a preliminary abnormal change pattern. The sample classification module is used to extract sub-region samples from the preliminary abnormal change pattern, and use a support vector machine classifier to perform binary classification on the sub-region samples to determine whether they conform to the occlusion and damage characteristics caused by the perspective cheat. The anomaly confirmation module is used to compare the output of the support vector machine classifier with the statistical model of the normal game screen dataset, and confirm the visual feature anomaly when the result deviation is greater than a preset threshold, and obtain the final anomaly detection signal. The detection loop module is used to update the real-time log database of the anti-cheat detection system based on the final abnormal detection signal, and trigger the alarm mechanism according to the signal strength to complete the detection loop.

Images