Game cheat detection methods, devices, servers, and computer-readable storage media

Abstract

This invention relates to computer game technology, and provides a method, device, server, and computer-readable storage medium for detecting game cheating. The method includes: acquiring every touch operation of a game player within a preset detection period; generating a behavior heatmap of the game player based on all touch operations, wherein the heat distribution of the behavior heatmap reflects the game player's operating habits within the preset detection period; extracting the game player's behavior feature vector from the behavior heatmap; and detecting whether the game player is a cheater based on the behavior feature vector. This invention utilizes a behavior heatmap that reflects the game player's operating habits, enabling more accurate detection of whether a game player is a cheater.

Description

Technical Field

[0001] This invention relates to the field of computer game technology, and more specifically, to a method, apparatus, server, and computer-readable storage medium for detecting game cheating. Background Technology

[0002] In massively multiplayer online mobile games, some cheaters use automated scripts to simulate human touchscreen operations to complete repetitive tasks such as monster hunting, resource gathering, and troop movement, severely undermining game fairness and ecological balance. Existing methods for detecting cheaters primarily rely on rule systems developed by security analysts based on experience, such as continuous online time thresholds, detection of patterns in operation time intervals, and fixed path matching. However, this approach to rule development covers a very limited range of player habits, affecting the accuracy of cheater detection. Summary of the Invention

[0003] The purpose of this invention is to provide a method, device, server, and computer-readable storage medium for detecting game cheating.

[0004] The embodiments of the present invention can be implemented as follows: In a first aspect, the present invention provides a method for detecting game cheating, the method comprising: Acquire every touch operation of the game player within a preset detection period; Based on all the game touch operations, a behavior heatmap of the game player is generated, and the heat distribution of the behavior heatmap reflects the game player's game operation habits during the preset detection period. Extract the behavioral feature vectors of the game players from the game players' behavior heatmap; The game player is detected as a cheater based on the behavioral feature vector of the player.

[0005] In an optional implementation, the step of generating a heatmap of the game player's behavior based on all the game touch operations includes: Obtain the original coordinates of the operation position corresponding to each game touch operation; Based on the game resolution used by the player and the preset resolution, the original coordinates of each game touch operation are normalized to obtain the normalized coordinates of each game touch operation. A heatmap of the game player's behavior is generated based on all the normalized coordinates. The heatmap includes multiple grids, and the heat of each grid is related to the number of normalized coordinates falling into each grid.

[0006] In an optional implementation, the step of detecting whether a player is a cheater based on the player's behavioral feature vector includes: Obtain a preset knowledge base, which pre-stores at least one script pattern, each script pattern representing a type of group game cheating; If a target script pattern matching the behavior feature vector exists in the preset knowledge base, the behavior feature vector is input into the pre-trained detection model to obtain the detection result. If the detection result is of a preset type, the player is determined to be a cheater; otherwise, the player is determined to be a normal player.

[0007] In an optional implementation, before the step of obtaining the preset knowledge base, the method further includes: Obtain the sample feature vectors of all sample players within a preset sampling period. The sample feature vectors are generated based on the behavior heatmaps of the corresponding sample players. From all the sample feature vectors, determine the sample feature vector pairs that are neighbors with a similarity greater than a first preset threshold; A behavioral similarity graph is generated based on all the sample feature vector pairs. In the behavioral similarity graph, the two vertices of any edge represent the two sample feature vectors of the corresponding sample feature vector pair, and the edge weight of any edge represents the similarity between the two sample feature vectors of the corresponding sample feature vector pair. Perform connected component analysis on the behavioral similarity graph to obtain at least one connected component; Update each of the connected components to the preset knowledge base.

[0008] In an optional implementation, the step of updating each of the connected components to the preset knowledge base includes: For each of the connected components, the center vector of the connected component is calculated based on the sample feature vector of the connected component. If there is no matching script pattern in the preset knowledge base that has a similarity greater than a second preset threshold with the center vector of the connected component, then a corresponding script pattern is generated based on the connected component and the generated script pattern is added to the preset knowledge base to update the connected component to the preset knowledge base. If the matching script pattern exists in the preset knowledge base, the matching script pattern is updated according to the connected components to update the connected components in the preset knowledge base.

[0009] In an optional implementation, the step of generating a corresponding script pattern based on the connected components and adding the generated script pattern to the preset knowledge base includes: The sample feature vectors whose similarity to the center vector of the connected component is greater than a third preset threshold are used as archived feature vectors. The script pattern corresponding to the connected component is generated based on the center vector of the connected component and the archive feature vector, and the generated script pattern is added to the preset knowledge base.

[0010] In an optional implementation, the preset knowledge base further includes archived feature vectors of the script patterns. Before the step of inputting the behavior feature vector into a pre-trained detection model to obtain a detection result if a target script pattern matching the behavior feature vector exists in the preset knowledge base, the method further includes: For each script pattern, positive training samples are selected from the archived feature vector of the script pattern; Remove the sample feature vectors belonging to any of the connected components from the sample feature vectors of all the sample players to obtain normal sample feature vectors; Select negative training samples from the feature vector of the normal samples; Based on the positive training samples and the negative training samples, the detection of the pre-constructed script pattern is trained to obtain the trained detection model of the script pattern, and finally the trained detection model of each script pattern is obtained.

[0011] Secondly, the present invention provides a game cheating detection device, the device comprising: The acquisition module is used to acquire every touch operation of the game player within a preset detection period; The generation module is used to generate a heatmap of the game player's behavior based on all the game touch operations, and the heat distribution of the behavior heatmap reflects the game player's game operation habits during the preset detection period. The extraction module is used to extract the behavioral feature vectors of the game players from the game players' behavior heatmap; The detection module is used to detect whether a player is cheating based on the player's behavioral feature vector.

[0012] Thirdly, the present invention provides a server including a processor and a memory, the memory being used to store a program, and the processor being used to implement the game cheat detection method as described in the first aspect when executing the program.

[0013] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the game cheat detection method as described in the first aspect.

[0014] Compared with the prior art, the present invention has the following beneficial effects: This invention generates a heatmap reflecting the player's behavior based on all touch operations during a preset detection period. Then, it extracts the player's behavioral feature vector from this heatmap and finally detects whether the player is cheating based on this vector. Since the heatmap is generated from all touch operations during the preset detection period, it accurately reflects the player's gaming habits. By fully utilizing the two-dimensional spatial distribution characteristics of the player's touch operations, the generated behavioral feature vector more accurately reflects the player's gaming habits, thus enabling more accurate detection of cheating. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is an example diagram illustrating an application scenario provided in this embodiment.

[0017] Figure 2 This is a block diagram of the server provided in this embodiment.

[0018] Figure 3 This is a flowchart illustrating the game cheating detection method provided in this embodiment.

[0019] Figure 4 This is a block diagram illustrating the game cheat detection device provided in this embodiment.

[0020] Figure 5 This is a specific architecture example diagram of the daily and hourly pipelines provided in this embodiment.

[0021] Icons: 10-Server; 20-Client; 11-Processor; 12-Memory; 13-Bus; 100-Game cheat detection device; 110-Acquisition module; 120-Generation module; 130-Extraction module; 140-Detection module. Detailed Implementation

[0022] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0023] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0024] It should be noted that similar labels and letters in the following figures indicate similar items. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0025] In the description of this invention, it should be noted that if terms such as "upper," "lower," "inner," or "outer" are used to indicate the orientation or positional relationship based on the orientation or positional relationship shown in the accompanying drawings, or the orientation or positional relationship in which the product of this invention is usually placed, they are only for the convenience of describing this invention and simplifying the description, and do not indicate or imply that the device or element referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as a limitation of this invention.

[0026] Furthermore, the terms "first" and "second" are used only to distinguish descriptions and should not be interpreted as indicating or implying relative importance.

[0027] It should be noted that, where there is no conflict, the features in the embodiments of the present invention can be combined with each other.

[0028] In rule-based detection methods, in addition to the extremely limited rule coverage and the inability to automatically discover unknown new script behavior patterns, resulting in serious detection blind spots, there are at least the following drawbacks: the detection of each new script behavior pattern requires security technicians to reverse-engineer its behavioral characteristics and manually write detection rules. Script creators can easily bypass fixed rules by adding random delays, path jitter, operation noise, etc. The rule maintenance cost increases linearly with the number of script pattern variants, making it difficult to maintain continuous coverage.

[0029] Besides the detection methods mentioned above, another common method is supervision-based detection. Supervision-based methods train the detection model using both normal and cheating samples. However, this approach has the following limitations: extremely high annotation costs: it requires a large amount of high-quality labeled data, and the annotation of game behavior data requires professional security personnel to review each sample, resulting in low annotation efficiency and difficulty in guaranteeing quality; insufficient generalization ability: the model can only recognize cheating patterns seen in the training data, and the detection rate for new script behaviors drops sharply; severely imbalanced samples: the number of normal players far exceeds that of cheaters (usually more than 100:1), making model training difficult; and the need for frequent iterations: cheating behaviors continue to evolve, requiring the model to be constantly re-annotated and retrained, resulting in high operational costs.

[0030] In addition, there is another detection method based on statistical features, which detects cheating players by statistically analyzing operation frequency, click interval distribution, and operation area. This method also has the following drawbacks: Limited feature dimensions: Manually designed statistical features cannot fully express the spatial distribution patterns of touch behavior, discarding a large amount of crucial two-dimensional spatial structural information; High false alarm rate: Anomaly detection algorithms tend to mark all "non-mainstream" behaviors as abnormal, including those of normal, high-frequency players; Inability to distinguish script types: Different script families (such as monster-hunting scripts, resource-gathering scripts, and marching scripts) have significantly different behavioral characteristics, but statistical features struggle to capture these differences, resulting in a lack of refined detection capabilities; Missed detection of group scripts: When a certain type of script has many users, this type of behavior becomes a statistically common pattern, thus evading anomaly detection.

[0031] In view of this, this embodiment provides a method, apparatus, server, and computer-readable storage medium for detecting game cheating, which will be described in detail below.

[0032] Please refer to Figure 1 , Figure 1 This is an example diagram illustrating an application scenario provided in this embodiment. Figure 1 In this system, server 10 and client 20 are connected. Server 10 can be a standalone server, a server cluster consisting of multiple servers, or a cloud server, etc. Client 20 can be a mobile phone, laptop, console, gaming wearable device, etc. Client 20 is responsible for collecting game touch operations from players within a preset time period. The preset time period can be a collection cycle, which can be pre-set. Client 20 collects game touch operations once per cycle, and the collection cycle can be set to one day or one hour. Client 20 can send the collected game touch operations to server 10 according to the sending cycle, and server 10 can also periodically obtain game touch operations from client 20 according to the acquisition cycle. Server 10 is responsible for analyzing the game touch operations collected by client 20 to detect cheating players.

[0033] based on Figure 1 This embodiment also provides Figure 1 Example diagram of the box for server 10. Please refer to it. Figure 2 , Figure 2 This is a block diagram of the server 10 provided in this embodiment. The server 10 includes a processor 11, a memory 12 and a bus 13. The processor 11 and the memory 12 are connected through the bus 13.

[0034] The processor 11 can be an integrated circuit chip with signal processing capabilities. In implementation, each step of the game cheat detection method described above can be completed by the integrated logic circuitry in the hardware of the processor 11 or by software instructions. The processor 11 can be a general-purpose processor, including a CPU (Central Processing Unit), an NP (Network Processor), a GPU (Graphics Processing Unit), etc.; it can also be a DSP (Digital Signal Processor), an ASIC (Application Specific Integrated Circuit), an FPGA (Field Programmable Logic Gate Array), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0035] The memory 12 is used to store the program that implements the game cheat detection method. The program can be a software function module stored in the memory 12 in the form of software or firmware or embedded in the OS (Operating System) of the server 10.

[0036] After receiving the execution instruction, the processor 11 executes the program to implement the game cheat detection method of the aforementioned embodiment.

[0037] based on Figure 1 and Figure 2 This embodiment also provides applications for Figure 1 and Figure 2 For cheat detection methods on server 10, please refer to [link / reference]. Figure 3 , Figure 3 This is a flowchart illustrating the game cheat detection method provided in this embodiment. The method includes the following steps: Step S101: Obtain each game touch operation performed by the player within a preset detection period.

[0038] In this embodiment, the preset detection period can be set as needed, for example, it can be one hour, one day, or even one week. Game touch operations refer to the clicks, swipes, drags, and other operations triggered by gamers using a mouse, keyboard, or gamepad while playing games. The client records operation information for each game touch operation, including but not limited to operation location, operation action, and operation time.

[0039] Step S102: Based on all game touch operations, generate a heatmap of the game player's behavior. The heat distribution of the behavior heatmap reflects the game player's game operation habits during the preset detection period.

[0040] In this embodiment, different game touch operations can operate on the same location at different times, or produce the same swipe path at different times. Behavioral heatmaps are used to quantify the game operation habits of players within a preset detection period. Since the behavioral heatmaps of normal players typically exhibit randomness and diversity, while the behavioral heatmaps of players using scripts to cheat typically exhibit highly regular spatial patterns, the features of behavioral heatmaps can be used to distinguish between normal players and cheaters.

[0041] Step S103: Extract the behavioral feature vector of the game player from the game player's behavior heatmap.

[0042] In this embodiment, behavioral feature vectors can be obtained by inputting a behavioral heatmap into a deep neural network model or a convolutional neural network model and performing forward propagation. As one implementation approach, the behavioral heatmap can first undergo image preprocessing. For example, a high-quality resampling algorithm (such as Lanczos interpolation) can be used to uniformly scale the behavioral heatmap to a standardized resolution, preserving its spatial structural features while controlling computational complexity. Then, feature extraction is performed. For instance, a deep feature extraction network (which can use a pre-trained residual network ResNet or a visual Transformer backbone network) can be used to map the preprocessed standardized image to a high-dimensional feature space, obtaining feature vectors containing rich spatial semantic information. Next, the obtained feature vectors are normalized, for example, using L2 normalization to map the feature vectors obtained in the previous step onto a unit hypersphere. The inner product between the normalized feature vectors is equivalent to cosine similarity, facilitating efficient similarity retrieval later.

[0043] It should be noted that, in addition to using deep feature extraction networks to extract features as mentioned above, pre-trained Vision Transformer (ViT), perceptual hashing (pHash), autoencoder, and other methods can also be used to extract features and finally obtain behavioral feature vectors.

[0044] It should also be noted that, in order to efficiently store the behavioral feature vectors, they can be stored in batches in an efficient binary format (such as HDF5). Each record is associated with the unique identifier of the corresponding game player or the game character selected by the corresponding game player and the corresponding behavioral feature vector.

[0045] Step S104: Detect whether a player is cheating based on the player's behavioral feature vector.

[0046] In this embodiment, as one approach, the behavioral feature vector can be compared with the center vectors of various script patterns archived in a preset knowledge base. If a target script pattern with a similarity exceeding a set threshold exists, the player is considered to have a cheating risk. Alternatively, a behavioral heatmap can be input into a pre-trained detection model to output whether the player has a cheating risk. These two approaches can also be combined to reduce the false detection rate. For example, first, the behavioral feature vector is detected using a preset knowledge base. If a target script pattern with a similarity exceeding a set threshold exists, its corresponding behavioral heatmap is input into a pre-trained detection model, ultimately outputting whether the player has a cheating risk. In applications requiring high accuracy, when the detection model outputs a result indicating a cheating player, cross-validation can be performed using multiple dimensions of the player's game behavior data, such as PvE combat frequency, resource collection volume, and online behavior intensity, to verify whether the player is indeed a cheater.

[0047] The method provided in this embodiment, by using a behavioral heatmap that accurately reflects the gamer's game operation habits during a preset detection period, fully utilizes the two-dimensional spatial distribution characteristics of the gamer's touch operations, so that the generated behavioral feature vector can more accurately reflect the gamer's game operation habits, thereby enabling more accurate detection of whether the gamer is a cheater.

[0048] In an optional implementation, different game players may use different game resolutions, or the same game player may use different game resolutions at different times. To avoid different game resolutions affecting the accuracy of the final detection results, this embodiment provides a method for generating a heatmap of game player behavior: First, obtain the original coordinates of the operation position corresponding to each game touch operation; In this embodiment, the original coordinates can be the horizontal and vertical pixel positions on the screen of the current device, which are recorded in real time by the client when the game player performs a click or swipe operation on the screen. The original coordinates can be in pixels, and their value range depends on the actual screen resolution of the terminal used by the game player.

[0049] Secondly, based on the game resolution used by the player and the preset resolution, the original coordinates of each game touch operation are normalized to obtain the normalized coordinates of each game touch operation. In this embodiment, the game resolution used by the game player refers to the actual display resolution adopted by the game player's terminal when running the game, such as 1080×2340 pixels; the preset resolution is a pre-set unified reference resolution, such as 720×1280 pixels; the normalization process can be to divide the horizontal and vertical coordinates of the original coordinates by the game resolution in the corresponding direction, and then multiply by the value of the preset resolution in that direction, so as to map the operation position on all devices to the same dimensionless relative coordinate system, so that the same operation area under different screen sizes and ratios has the same coordinate value after normalization.

[0050] Finally, a heatmap of player behavior is generated based on all normalized coordinates. The heatmap consists of multiple grids, and the heat of each grid is related to the number of normalized coordinates falling into each grid.

[0051] In this embodiment, the two-dimensional plane containing the normalized coordinates can be divided into several equally spaced rectangular cells to form a grid array of a fixed size, such as a 64×64 grid. For each normalized coordinate, the specific grid it falls into is determined. Then, the total number of normalized coordinates falling into each grid is counted, and this number is mapped to the gray value of the corresponding grid. Thus, the more coordinates falling into a grid, the darker its gray value, i.e., the higher its heat map. The resulting behavioral heat map intuitively presents the distribution of the screen areas that the player clicks or swipes most frequently during the preset detection period, thereby truly reflecting the spatial regularity of their game operation habits.

[0052] In an optional implementation, in large-scale online game application scenarios, the preset detection period typically acquires a large number of game players' touch operations. To improve batch processing efficiency while ensuring detection accuracy and avoiding the problem of high false detection rates caused by single detection, this embodiment provides a two-level detection mechanism of first coarse screening and then fine judgment. One implementation method is as follows: First, a preset knowledge base is obtained, which pre-stores at least one script pattern. Each script pattern represents a type of group game cheating. In this embodiment, the preset knowledge base can be a structured dataset that is automatically constructed and continuously updated through offline analysis, in which at least one script pattern is pre-stored. The script pattern can be a data model representing the common behavioral characteristics of a certain type of automated script users, expressed in mathematical vector form. It mainly includes the central vector of the behavioral feature vector of this type of player, and several high-confidence archived feature vectors retained after clustering refinement.

[0053] Secondly, if a target script pattern that matches the behavioral feature vector exists in the preset knowledge base, the behavioral feature vector is input into the pre-trained detection model to obtain the detection result. In this embodiment, matching the target script pattern with the behavior feature vector means that the cosine similarity between the behavior feature vector and the center vector of the target script pattern is greater than a set matching threshold. The matching threshold can be set as needed. For example, the matching threshold is between 0.8 and 0.9, which is used to ensure that subsequent judgment is triggered only when the spatial distributions of the two are highly consistent.

[0054] Third, if the detection result is the preset type, the player is determined to be a cheater; otherwise, the player is determined to be a normal player.

[0055] In this embodiment, the pre-trained detection model can be a deep neural network classifier trained separately for the target script pattern. This classifier can be a binary classifier, whose input is the behavior heatmap image of the corresponding player, and whose output is the type value of the cheating behavior represented by the script pattern. The type value can have two values, 0 and 1. For example, a type value of 1 indicates that the input behavior heatmap and the script pattern corresponding to the classifier are relatively well matched, indicating that the player is a cheater; otherwise, it indicates that the player is a normal player. The preset type can be the type that best matches the behavior heatmap and the script pattern corresponding to the classifier.

[0056] In an optional implementation, in order to automatically identify groups of gamers whose touch operation behaviors are most similar based on real behavioral data from millions of players—that is, groups of gamers using the same automated script—this embodiment provides a method for updating a preset knowledge base: First, obtain the sample feature vectors of all sample players within the preset sampling period. The sample feature vectors are generated based on the behavior heatmaps of the corresponding sample players. In this embodiment, the preset sampling period is a predefined, periodically selected historical time window, such as the past 24 hours or the past 7 days, used for centralized analysis of game player behavior. Sample players refer to those active within the preset sampling period whose game touch operations were relatively complete. The generation method of the sample player behavior heatmap is similar to that of the aforementioned game player behavior heatmap, and will not be repeated here. The sample feature vector is obtained by extracting features from the sample player behavior heatmap.

[0057] Secondly, from all sample feature vectors, determine the sample feature vector pairs that are neighbors with a similarity greater than a first preset threshold. In this embodiment, similarity refers to the cosine similarity between two sample feature vectors. Assuming the sample feature vectors have been pre-normalized using L2, the cosine similarity is equal to the inner product of the two vectors, and its value ranges from -1 to 1. A first preset threshold is typically set to around 0.85. Only when the similarity exceeds this first preset threshold are the two sample feature vectors considered as a pair of neighboring vectors.

[0058] Third, a behavioral similarity graph is generated based on all sample feature vector pairs. The two vertices of any edge in the behavioral similarity graph represent the two sample feature vectors of the corresponding sample feature vector pair, and the edge weight of any edge represents the similarity between the two sample feature vectors of the corresponding sample feature vector pair. In this embodiment, a vertex in the behavior similarity graph corresponds to a sample feature vector, representing the corresponding game player. Two vertices connected by the same edge belong to the same sample feature vector pair. The edge weight represents the similarity between the two sample feature vectors in the sample feature vector pair. The higher the similarity, the closer their behavior patterns are.

[0059] Fourth, perform connected component analysis on the behavioral similarity graph to obtain at least one connected component; In this embodiment, a connected component refers to the largest subset of vertices in a behavioral similarity graph that can be directly or indirectly connected to each other through edges. Within this subset, any two players can form behaviorally similar paths through several edges. Since this analysis process does not pre-set the number of groups or assume the shape of the groups, it is completely determined by the inherent structure of the data. Therefore, it can most reasonably reflect the similarity of game touch operations between multiple game players.

[0060] Fifth, update each connected component to the preset knowledge base.

[0061] In this embodiment, the update operation means identifying the player group covered by the connected component as a new or known script usage behavior pattern, and structuring its core features (such as center vector, archive vector, etc.) into the knowledge base to provide a basis for subsequent detection.

[0062] It should be noted that the above-mentioned connected component analysis based on behavioral similarity graphs is only one way of implementing clustering. In fact, other clustering methods such as DBSCAN (Density-Based Spatial Clustering of Applications with Noise), hierarchical clustering, K-means, and spectral clustering can also be used to obtain a pre-defined knowledge base including script patterns.

[0063] In an optional implementation, in order to automatically update the preset knowledge base when a new script pattern is discovered, and to automatically merge and update it when a fine-tuned variant of an existing script is identified, this embodiment provides an implementation method for updating the preset knowledge base in different ways according to different situations: First, for each connected component, the center vector of the connected component is calculated based on the sample feature vector of the connected component. In this embodiment, the center vector of a connected component can represent the overall behavioral characteristics of the connected component. The center vector can be calculated by using median estimation to reduce the interference of abnormal samples on the center position.

[0064] Secondly, if there is no matching script pattern in the preset knowledge base that has a similarity greater than the second preset threshold with the center vector of the connected component, then the corresponding script pattern is generated according to the connected component and added to the preset knowledge base to update the connected component to the preset knowledge base. In this embodiment, the second preset threshold can be set as needed. If the preset knowledge base does not have a matching script pattern, it means that the script pattern corresponding to the connected component is a completely new script pattern. In this case, a new script pattern needs to be generated and updated to the preset knowledge base.

[0065] Third, if a matching script pattern exists in the preset knowledge base, the matching script pattern is updated according to the connected components to update the connected components to the preset knowledge base.

[0066] In this embodiment, if there is no matching script pattern in the preset knowledge base, it means that the script pattern corresponding to the connected component is a fine-tuned variant or evolution of the matching script pattern. At this time, the matching script pattern is updated according to the connected component. The update method includes, but is not limited to: recalculating the center vector of the script pattern by weighted average, wherein the weights are respectively taken from the number of samples of the connected component and the historical cumulative number of samples of the original script pattern, so as to ensure that the script pattern in the knowledge base can dynamically reflect its true behavior distribution over time.

[0067] In this embodiment, when the number of sample players within a preset sampling period is small, the sample feature vectors of the sample players and script patterns can be matched one by one to determine whether a matching script pattern exists. However, when the number of sample players within a preset sampling period is large, in order to more efficiently determine whether a script pattern matching each sample player exists in the preset knowledge base, this embodiment uses an approximate nearest neighbor retrieval technique based on an inverted file structure to achieve efficient judgment through efficient retrieval. Specifically, the inverted file and FAISS IVF indexing technique are used to divide the vector space of the sample feature vectors of the sample players within the preset sampling period into multiple Voronoi units. Each unit has a cluster center, generating a FAISS library. Then, the center vector corresponding to each script pattern is used to retrieve each cluster center in this FAISS library. If a matching cluster center exists, it is further retrieved whether each script pattern matches the sample feature vector in the Voronoi unit corresponding to that cluster center. Based on the matching results, it can be determined whether a script pattern matching each sample player exists in the preset knowledge base.

[0068] In an optional implementation, in order to automatically extract the most representative and stable behavioral feature vectors from the original samples contained in each connected component, as the core basis for subsequent script pattern generation, thereby ensuring the data quality and detection robustness of each script pattern in the knowledge base, this embodiment provides an implementation method for generating script patterns and adding them to a preset knowledge base for the new footstep pattern: First, the sample feature vectors whose similarity to the center vector of the connected component is greater than a third preset threshold are used as archived feature vectors. In this embodiment, the third preset threshold can be set as needed. When high accuracy is required, a higher third preset threshold can be set; conversely, a lower third preset threshold can be set.

[0069] Secondly, script patterns corresponding to the connected components are generated based on the center vectors and archived feature vectors of the connected components, and the generated script patterns are added to the preset knowledge base.

[0070] In this embodiment, the script pattern optionally includes a center vector, a set of archived feature vectors, and a unique identifier associated with the script pattern. The center vector is used to quickly recall suspected matching players during the online detection phase, while the archived feature vectors are used to subsequently train a detection model specific to this script pattern. Together, they constitute the complete data representation of the script pattern. Furthermore, the script pattern may also include information such as a creation timestamp and the number of archived feature vectors to facilitate later maintenance of the script pattern.

[0071] In an optional implementation, to avoid increasing the workload of manually labeling training samples when training the detection model, and to make the detection model more targeted, this embodiment provides a method for training the detection model: First, for each script pattern, positive training samples are selected from the archived feature vectors of the script pattern; In this embodiment, the archived feature vectors are high-confidence samples previously selected based on the connected component center vectors. They already possess good behavioral consistency and representativeness, so the positive training samples selected from them naturally have high purity. The selection can be completed by random sampling or by sorting by similarity and then selecting the top few.

[0072] Secondly, the sample feature vectors belonging to any connected component are deleted from the sample feature vectors of all sample players to obtain normal sample feature vectors. In this embodiment, from the sample feature vectors of all sample players, all sample feature vectors that have been assigned to any connected component are removed, and the remaining part constitutes the normal sample feature vector; this operation ensures that the negative sample set does not contain any known cheating behavior samples, thereby avoiding training data pollution.

[0073] Third, select negative training samples from the feature vectors of normal samples; In this embodiment, the negative training samples may optionally include randomly selected regular player samples. In order to ensure the accuracy of the trained detection model, the negative training samples may also include typical normal player samples that are easily misjudged, such as those that are high-frequency, long-term online, and multi-task, and have been manually labeled and confirmed, so as to enhance the model's ability to distinguish boundary cases.

[0074] Fourth, based on positive and negative training samples, the detection of the pre-built script patterns is trained to obtain the trained detection model of the script patterns, and finally the trained detection model of each script pattern is obtained.

[0075] In this embodiment, positive training samples belong to the risk class, and negative training samples belong to the normal class. The combined set of positive and negative training samples is the training sample set. As one implementation, the training sample set can be divided into a training set and a validation set in a 4:1 ratio. The selected positive and negative training samples are input together into a pre-built detection model structure for supervised training. The detection model structure can optionally be a lightweight convolutional neural network, whose input is the behavior heatmap of the corresponding game player. The network contains multiple layers of convolution-normalization-pooling units, extracting multi-scale features from local texture to global structure layer by layer. Then, the fully connected layer outputs a binary classification probability (normal / risk), and the output determines whether the game player belongs to the cheating type represented by the script mode. The training process can use a cross-entropy loss function with class weights. By adjusting the weights, the balance between false positives and false negatives can be controlled to alleviate the bias caused by the severe imbalance in the number of positive and negative samples. After training, the accuracy and recall of the model on the independent validation set can be automatically evaluated. Only when both training accuracy and validation accuracy reach the preset thresholds will the model be recognized as the trained detection model of this script mode and included in online detection.

[0076] It should be noted that, in addition to binary classifiers, the detection model can also use Vision Transformer classifiers or other classifiers such as ensemble learning (Random Forest + Gradient Boosting). Besides training a corresponding detection model for each script mode, a globally unified detection model can also be trained for all script modes to reduce the maintenance complexity and cost caused by maintaining multiple detection models.

[0077] To perform the corresponding steps in the above embodiments and various possible implementations, an implementation method of the game cheat detection device 100 is given below. Please refer to... Figure 4 , Figure 4 This is a block diagram of the game cheat detection device provided in this embodiment. It should be noted that the basic principle and technical effects of the game cheat detection device 100 provided by the present invention are the same as those of the corresponding embodiments described above. For the sake of brevity, some parts of this embodiment are not mentioned.

[0078] The game cheating detection device 100 includes an acquisition module 110, a generation module 120, an extraction module 130, and a detection module 140.

[0079] The acquisition module 110 is used to acquire every game touch operation performed by the game player within a preset detection period. The generation module 120 is used to generate a heatmap of the game player's behavior based on all game touch operations. The heat distribution of the behavior heatmap reflects the game player's game operation habits during the preset detection period. Extraction module 130 is used to extract behavioral feature vectors of game players from the game player behavior heatmap; The detection module 140 is used to detect whether a player is cheating based on the player's behavioral feature vector.

[0080] In an optional implementation, the detection module 140 is specifically used for: Obtain a preset knowledge base, which pre-stores at least one script pattern, each script pattern representing a type of group game cheating; If a target script pattern that matches the behavior feature vector exists in the preset knowledge base, the behavior feature vector is input into the pre-trained detection model to obtain the detection result. If the detection result is the preset type, the player is determined to be a cheater; otherwise, the player is determined to be a normal player.

[0081] In an optional implementation, the acquisition module 110 is further configured to: Obtain the sample feature vectors of all sample players within the preset sampling period. The sample feature vectors are generated based on the behavior heatmaps of the corresponding sample players. From all sample feature vectors, identify sample feature vector pairs that are neighbors with a similarity greater than a first preset threshold. A behavioral similarity graph is generated based on all sample feature vector pairs. The two vertices of any edge in the behavioral similarity graph represent the two sample feature vectors of the corresponding sample feature vector pair, and the edge weight of any edge represents the similarity between the two sample feature vectors of the corresponding sample feature vector pair. Perform connected component analysis on the behavioral similarity graph to obtain at least one connected component; Update each connected component to the preset knowledge base.

[0082] In an optional implementation, the acquisition module 110 is specifically used to update each connected component to a preset knowledge base for: For each connected component, calculate the center vector of the connected component based on the sample feature vector of the connected component; If there is no matching script pattern in the preset knowledge base that has a similarity greater than the second preset threshold with the center vector of the connected component, then the corresponding script pattern is generated based on the connected component and added to the preset knowledge base to update the connected component to the preset knowledge base. If a matching script pattern exists in the preset knowledge base, the matching script pattern is updated according to the connected components to update the connected components in the preset knowledge base.

[0083] In an optional implementation, the acquisition module 110, when generating a corresponding script pattern based on the connected components and adding the generated script pattern to a preset knowledge base, is further configured to: The sample feature vectors whose similarity to the center vector of the connected component is greater than a third preset threshold are used as archived feature vectors. Generate script patterns corresponding to connected components based on the center vector and archive feature vector of the connected components, and add the generated script patterns to the preset knowledge base.

[0084] In an optional implementation, the preset knowledge base further includes archived feature vectors for script mode, and the acquisition module 110 is further configured to include: For each script pattern, positive training samples are selected from the archived feature vectors of the script pattern. Remove the sample feature vectors belonging to any connected component from the sample feature vectors of all sample players to obtain normal sample feature vectors; Select negative training samples from the feature vectors of normal samples; Based on positive and negative training samples, the detection of pre-built script patterns is trained to obtain the trained detection model of the script patterns, and finally the trained detection model of each script pattern is obtained.

[0085] In this embodiment, to address the issue of game cheating detection by a massive number of players, this embodiment provides a specific implementation method for an architecture that utilizes daily-level game touch operations to update a preset knowledge base and train a detection model, and utilizes hourly-level game touch operations, the updated preset knowledge base, and the trained detection model for online detection. Please refer to [the relevant documentation / reference]. Figure 5 , Figure 5 This is a specific architecture example diagram of the daily and hourly pipelines provided in this embodiment. Figure 5 In this process, the game client collects touch behavior data, which serves as input for both the daily offline analysis pipeline and the hourly near real-time detection pipeline. The daily offline analysis pipeline is a daily process used to update the preset knowledge base and the detection model corresponding to each script mode. The hourly near real-time detection pipeline is an hourly process used to detect game cheating using the updated preset knowledge base and detection model from the daily offline analysis pipeline. It should be noted that, to compensate for potential over-the-counter cheating by the hourly near real-time detection pipeline, the daily offline analysis pipeline, in addition to updating the preset knowledge base and detection model, can also perform game cheating detection based on the player data collected that day. Detailed architecture examples of the daily offline analysis pipeline and the hourly near real-time detection pipeline are described below.

[0086] The daily offline analysis pipeline includes a behavior heatmap generation module, a deep feature extraction and vectorization module, an unsupervised clustering group discovery module, a cluster refinement and incremental archiving module, and an automatic training module for the group classifier.

[0087] The behavior heatmap generation module includes the following processing: acquiring daily click event sequences or swipe event sequences of game players' touch behavior operations collected from the client; mapping the touch behavior operations to coordinate space to obtain normalized coordinates; and then mapping the normalized coordinates to a discrete grid space. For click event sequences, the number of clicks is accumulated to generate a click heatmap; for swipe event sequences, the line segments corresponding to the swipe trajectory are rasterized and accumulated to obtain a movement trajectory map. The subsequent processing methods for click heatmaps and movement trajectory maps are the same, except that they reflect different player habits. Therefore, cheating methods matching their respective characteristics can be detected based on their respective features. In this embodiment, for the sake of simplicity, click heatmaps and movement trajectory maps are collectively referred to as behavior heatmaps. In descriptions that do not distinguish between the two, it means that the processing of click heatmaps and movement trajectory maps is applicable to both. After obtaining the behavior heatmap, it is normalized and converted into a standard grayscale image to prepare for subsequent feature extraction.

[0088] The deep feature extraction and vectorization module includes the following processing: using a high-quality resampling algorithm (e.g., Lanczos interpolation) to pre-normalize the scaling values ​​of the behavior heatmap to a fixed resolution; extracting high-dimensional spatial semantic feature vectors from the scaled behavior heatmap using a deep feature extraction network; then performing L2 normalization on the feature vectors, mapping them to a unit hypersphere, and efficiently storing the feature vectors in batches in HDF5 format to obtain a normalized behavior feature vector library for all players.

[0089] The unsupervised clustering group discovery module includes the following processing: an efficient Guinness nearest neighbor vector retrieval index based on inverted file structure components is used to perform range search on each feature vector to obtain a set of neighbors with cosine similarity exceeding a threshold. Using game players as nodes and similarity as edge weights, an undirected weighted graph of behavioral similarity (i.e., the behavioral similarity graph mentioned above) is constructed. Connectivity component analysis is performed on the behavioral similarity graph, and each connected component is a script behavior group, corresponding to a script pattern.

[0090] The clustering refinement and incremental archiving module includes the following processing: calculating the robust center vector of each group using median estimation and performing L2 normalization; calculating the cosine similarity between each sample in the group and the center vector, and retaining high-confidence samples; if the maximum similarity between the center vector of a new group and the existing script patterns in the preset knowledge base exceeds the archiving threshold, then it is assigned to the most similar existing script pattern, and the center vector of the group is updated by weighted average; otherwise, new script pattern entries are created, each uniquely identified, to obtain the updated preset knowledge base.

[0091] The automatic training module for the group classifier includes the following processing: automatically sampling to construct a positive sample set from the archived samples of each script mode in the preset knowledge base, extracting a negative sample set from the behavior heatmap of normal players, automatically dividing the training set and validation set at a ratio of 4:1, training a lightweight deep convolutional classification network, automatically evaluating the classifier accuracy, including only qualified classifiers (corresponding to the detection model mentioned above) into the online detection system, and outputting a deep classifier specific to each script mode.

[0092] The hourly near real-time detection pipeline includes an incremental heatmap generation module, an incremental feature extraction and index construction module, a two-stage recall detection module, a multi-dimensional comprehensive decision-making module, and a processing execution module.

[0093] The incremental heatmap generation module processes data in a similar way to the behavior heatmap generation module in the daily offline analysis pipeline. The difference is that the input data for the incremental heatmap generation module is the touch behavior of game players collected every hour.

[0094] The incremental feature extraction and index building module processes features similarly to the deep feature extraction and vectorization module in the daily offline analysis pipeline. The difference is that this module extracts features from the behavioral heatmap output by the incremental heatmap generation module and builds an index from the obtained incremental features.

[0095] The two-stage recall and detection module includes the following processing: In the first stage, a range search is performed on the collected game player index using the center vector of the script pattern from the preset knowledge base for coarse recall. In the second stage, a dedicated classifier for the retrieved script pattern is used to precisely score each matching candidate game player. The first stage leverages the efficiency of vector indexing to quickly filter out the vast majority of normal players (typically >99%), while the second stage performs computationally intensive classifier inference only on a small number of candidates to ensure accurate detection. This achieves an optimal balance between efficiency and accuracy.

[0096] The multi-dimensional comprehensive decision-making module includes the following processing: It combines the behavioral characteristics of candidate game players (e.g., PvE frequency, data collection volume, and online intensity) for multi-dimensional cross-validation. This cross-validation verifies whether the character truly exhibits automated gameplay behavior. Specifically, it determines whether the classifier's output and the game player's behavioral characteristics simultaneously meet preset handling conditions. If so, subsequent handling procedures are executed; otherwise, the character is marked as an observation target for continuous monitoring. Furthermore, to prevent large-scale false positives, a maximum number of actions can be set per instance, handling only a subset of game players meeting the preset conditions at a time.

[0097] The action execution module submits the results of the multi-dimensional comprehensive decision-making module to a human review panel. The human review panel then determines the appropriate action. For example, after the human review, different penalties can be imposed on different game players based on their game level.

[0098] It should be noted that the two-stage recall detection module in the hourly near real-time detection pipeline can also be reused in the daily offline analysis pipeline, thereby enabling the identification of cheating players from the daily player pool.

[0099] It should also be noted that, Figure 5 The division of modules is just one specific implementation method. In fact, those skilled in the art can make other divisions based on the above examples without creative effort, according to actual needs.

[0100] This embodiment provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the game cheat detection method as described in this embodiment.

[0101] In summary, embodiments of the present invention provide a game cheating detection method, device, server, and computer-readable storage medium. The method includes: acquiring each game touch operation of a game player within a preset detection period; generating a behavior heatmap of the game player based on all game touch operations, wherein the heat distribution of the behavior heatmap reflects the game player's game operation habits within the preset detection period; extracting the game player's behavior feature vector from the game player's behavior heatmap; and detecting whether the game player is a cheater based on the game player's behavior feature vector. Compared with the prior art, this embodiment has at least the following advantages: (1) By generating a behavior heatmap based on all game touch operations of the game player within a preset detection period, the generated behavior feature vector can more accurately reflect the game player's game operation habits, thus making full use of the two-dimensional spatial distribution features of the game player's game touch operations, thereby enabling more accurate detection of whether the game player is a cheater; (2) By automatically generating script patterns that represent the group game cheating type, the dependence on manually labeled data when training the detection model is eliminated. When a new group game cheating type appears, the corresponding script pattern can be automatically discovered and generated without manual intervention, thereby using the generated footstep pattern to train the corresponding detection model; (3) By converting touch events into two-dimensional heatmaps, the spatial distribution information of touch operation behavior is completely preserved; (4) A dedicated detection model is trained for the footstep pattern of each script family, avoiding feature interference between different script patterns. Each detection model only needs to distinguish between "script behavior of this script family" and "normal behavior", which greatly reduces the complexity of the task and significantly improves the detection accuracy; (5) The incremental archiving mechanism enhances the continuous evolution capability. The fine-tuning variants of known script patterns are automatically merged and tracked, and new script patterns are automatically archived and identified. The detection coverage automatically expands with the operation time, without the need for frequent manual rule updates or model retraining; (6) Vector coarse filtering is performed through the knowledge base, and then the behavioral feature vectors selected by the knowledge base are further accurately detected by the detection model. Finally, the output results of the detection model are cross-validated with multi-dimensional behavioral features. This three-level progressive filtering mechanism ensures a high detection rate while keeping the false judgment rate at an extremely low level; (7) The daily + hourly dual pipeline architecture realizes minute-level granularity polling detection. Compared with the traditional daily offline analysis, the time window for detection and disposal is shortened by more than an order of magnitude; (8) The same detection scheme can be adapted to different games and regions by modifying the configuration file, realizing cross-project reuse of technical solutions.

[0102] The above descriptions are merely various embodiments of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting cheating in games, characterized in that, The method includes: Acquire every touch operation of the game player within a preset detection period; Based on all the game touch operations, a behavior heatmap of the game player is generated, and the heat distribution of the behavior heatmap reflects the game player's game operation habits during the preset detection period. Extract the behavioral feature vectors of the game players from the game players' behavior heatmap; The game player is detected as a cheater based on the player's behavioral feature vector.

2. The method according to claim 1, characterized in that, The step of generating a heatmap of the player's behavior based on all the game touch operations includes: Obtain the original coordinates of the operation position corresponding to each game touch operation; Based on the game resolution used by the player and the preset resolution, the original coordinates of each game touch operation are normalized to obtain the normalized coordinates of each game touch operation. A heatmap of the game player's behavior is generated based on all the normalized coordinates. The heatmap includes multiple grids, and the heat of each grid is related to the number of normalized coordinates falling into each grid.

3. The method according to claim 1, characterized in that, The step of detecting whether a player is a cheater based on the player's behavioral feature vector includes: Obtain a preset knowledge base, which pre-stores at least one script pattern, each script pattern representing a type of group game cheating; If a target script pattern matching the behavior feature vector exists in the preset knowledge base, the behavior feature vector is input into the pre-trained detection model to obtain the detection result. If the detection result is of a preset type, the player is determined to be a cheater; otherwise, the player is determined to be a normal player.

4. The method according to claim 3, characterized in that, Before the step of obtaining the preset knowledge base, the method further includes: Obtain the sample feature vectors of all sample players within a preset sampling period. The sample feature vectors are generated based on the behavior heatmaps of the corresponding sample players. From all the sample feature vectors, determine the sample feature vector pairs that are neighbors with a similarity greater than a first preset threshold; A behavioral similarity graph is generated based on all the sample feature vector pairs. In the behavioral similarity graph, the two vertices of any edge represent the two sample feature vectors of the corresponding sample feature vector pair, and the edge weight of any edge represents the similarity between the two sample feature vectors of the corresponding sample feature vector pair. Perform connected component analysis on the behavioral similarity graph to obtain at least one connected component; Update each of the connected components to the preset knowledge base.

5. The method according to claim 4, characterized in that, The step of updating each of the connected components to the preset knowledge base includes: For each of the connected components, the center vector of the connected component is calculated based on the sample feature vector of the connected component. If there is no matching script pattern in the preset knowledge base that has a similarity greater than a second preset threshold with the center vector of the connected component, then a corresponding script pattern is generated based on the connected component and the generated script pattern is added to the preset knowledge base to update the connected component to the preset knowledge base. If the matching script pattern exists in the preset knowledge base, the matching script pattern is updated according to the connected components to update the connected components in the preset knowledge base.

6. The method according to claim 5, characterized in that, The step of generating a corresponding script pattern based on the connected components and adding the generated script pattern to the preset knowledge base includes: The sample feature vectors whose similarity to the center vector of the connected component is greater than a third preset threshold are used as archived feature vectors. The script pattern corresponding to the connected component is generated based on the center vector of the connected component and the archive feature vector, and the generated script pattern is added to the preset knowledge base.

7. The method according to claim 4, characterized in that, The preset knowledge base also includes archived feature vectors of the script patterns. Before the step of inputting the behavior feature vector into a pre-trained detection model to obtain the detection result if a target script pattern matching the behavior feature vector exists in the preset knowledge base, the method further includes: For each script pattern, positive training samples are selected from the archived feature vector of the script pattern; Remove the sample feature vectors belonging to any of the connected components from the sample feature vectors of all the sample players to obtain normal sample feature vectors; Select negative training samples from the feature vector of the normal samples; Based on the positive training samples and the negative training samples, the detection of the pre-constructed script pattern is trained to obtain the trained detection model of the script pattern, and finally the trained detection model of each script pattern is obtained.

8. A game cheating detection device, characterized in that, The device includes: The acquisition module is used to acquire every game touch operation performed by the player within a preset detection period; The generation module is used to generate a heatmap of the game player's behavior based on all the game touch operations, and the heat distribution of the behavior heatmap reflects the game player's game operation habits during the preset detection period. The extraction module is used to extract the behavioral feature vectors of the game players from the game players' behavior heatmap; The detection module is used to detect whether a player is cheating based on the player's behavioral feature vector.

9. A server, characterized in that, It includes a processor and a memory, the memory being used to store a program, and the processor being used to implement the game cheat detection method as described in any one of claims 1-7 when executing the program.

10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the game cheat detection method as described in any one of claims 1-7.

Images