CN112604297A

CN112604297A - Game plug-in detection method and device, server and storage medium

Info

Publication number: CN112604297A
Application number: CN202011588884.9A
Authority: CN
Inventors: 徐雨虹; 林建实; 张世泽; 冯潞潞; 陶建容; 范长杰; 胡志鹏
Original assignee: Netease Hangzhou Network Co Ltd
Current assignee: Netease Hangzhou Network Co Ltd
Priority date: 2020-12-29
Filing date: 2020-12-29
Publication date: 2021-04-06

Abstract

The application provides a method, a device, a server and a storage medium for detecting a plug-in game, wherein the method comprises the following steps: constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: the method comprises the steps that log data of virtual asset transaction of a plurality of game roles in a game are subjected to feature representation by adopting a preset structure vector algorithm according to a transaction map to obtain a feature vector of each node, the nodes are clustered according to the feature vectors of the nodes to obtain at least one node cluster, and plug-in detection is carried out on the nodes in each node cluster according to the features of the nodes in each node cluster. The plug-in node has certain regularity in the aspect of asset transaction, so that the detection of the game plug-in is realized on the basis of the transaction map, the accuracy of the game plug-in detection can be improved, and compared with the prior art, the plug-in detection has the advantages of wider coverage, higher recall rate and lower labor cost, and the game performance of a player is not influenced.

Description

Game plug-in detection method and device, server and storage medium

Technical Field

The application relates to the technical field of computers, in particular to a method and a device for detecting a plug-in game, a server and a storage medium.

Background

The game plug-in refers to a program which is designed for a certain game and is used for modifying part programs in the game. The external Game has a great variety, and for a large-scale Multiplayer Online Role Playing Game (MMORPG), the automatic hanging realizes the automatic operations of tasks, strangeness, upgrading, money buying and the like through some program scripts, and the transfer and collection of property in the Game are carried out, thereby seriously damaging the Game ecosphere.

In the prior art, a game client checks and records various features of a plug-in process and feature codes generated by memory code segments through a process, and is forbidden when processes with the same features are found in the running process of the game process.

However, the same characteristics may also change with the update of the plug-in program, and the accuracy of plug-in detection may be low by using the above scheme.

Disclosure of Invention

An object of the present application is to provide a method, an apparatus, a server and a storage medium for detecting a plug-in game, so as to solve the problem of low accuracy of plug-in detection in the prior art.

In order to achieve the above purpose, the technical solutions adopted in the embodiments of the present application are as follows:

in a first aspect, an embodiment of the present application provides a method for detecting a plug-in game, where the method includes:

constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: log data of virtual asset transactions conducted by a plurality of game characters in a game, the transaction map comprising: the plurality of nodes and the transaction relationship among the nodes, wherein each node corresponds to a game role;

performing feature representation by adopting a preset structure vector algorithm according to the transaction map to obtain a feature vector of each node;

clustering the plurality of nodes according to the feature vectors of the plurality of nodes to obtain at least one node cluster;

and carrying out plug-in detection on the nodes in each node cluster according to the characteristics of the nodes in each node cluster.

Optionally, the preset structure vector algorithm includes: a structural distance algorithm, a network construction algorithm and a vector characterization algorithm based on migration;

the obtaining of the feature vector of each node by performing feature representation by adopting a preset structure vector algorithm according to the transaction map comprises:

calculating a k-order structural distance of each two nodes by adopting the structural distance algorithm according to the degree sequence of each two nodes in the transaction graph, wherein the k-order structural distance is used for representing the structural similarity of k-order neighbor nodes of each two nodes;

according to the K-order structure distance of every two nodes, constructing a K-th layer network by adopting the network construction algorithm to obtain the K-layer fully-connected network with the K-layer network, wherein the K-layer fully-connected network comprises: the edge weight of every two nodes in each layer network and the edge weight of the same node in the adjacent layer network; k is 0 or any positive integer less than K;

and obtaining the characteristic vector of each node in the K-th network by adopting the migration-based vector characterization algorithm according to the K-layer fully-connected network.

Optionally, the calculating, according to the degree sequence of every two nodes in the transaction graph, the k-order structural distance of every two nodes by using the structural distance algorithm includes:

acquiring a first degree sequence of a first node and a second degree sequence of a second node in every two nodes;

calculating a sequence distance of the first degree sequence and the second degree sequence;

calculating the k-order structure distance of the first node and the second node according to the sequence distance and the structure distance of the previous-order neighbor node, wherein the previous-order neighbor node comprises: a first order neighbor node of the first node and a first order neighbor node of the second node in the transaction graph.

Optionally, the obtaining a first degree sequence of a first node and a second degree sequence of a second node in each two nodes includes:

arranging the degrees of k-stage neighbor nodes of the first node according to an ascending order to obtain the first degree sequence;

and arranging the degrees of the k-stage neighbor nodes of the second node according to an ascending order to obtain the second degree sequence.

Optionally, the calculating a sequence distance of the first degree sequence and the second degree sequence includes:

and calculating the sequence distance by adopting a dynamic time reduction algorithm according to the first degree sequence and the second degree sequence.

Optionally, the constructing a K-th layer network according to the K-order structure distance between every two nodes by using the network construction algorithm to obtain the K-layer fully connected network with the K-layer network includes:

calculating k-order edge weights of every two nodes in the k-th layer network according to the k-order structural distance;

calculating the k + 1-order edge weight of the same node in the k-th network and the k + 1-th network according to the number of nodes of which the edge weights pointing to the nodes in the k-th network meet preset weight conditions;

and constructing the K-layer fully-connected network according to the K-order side weight, the K + 1-order side weight and the K-1-order side weight, wherein the K-1-order side weight is a preset weight.

Optionally, the meeting the preset weight condition includes: greater than or equal to the average edge weight of the k-th network.

Optionally, the clustering the plurality of nodes according to the feature vectors of the plurality of nodes to obtain at least one node cluster includes:

calculating the node distance of every two nodes according to the feature vectors of the plurality of nodes;

clustering the plurality of nodes according to the node distance between every two nodes to obtain at least one initial cluster;

and acquiring at least one node cluster from the at least one initial cluster according to the number of nodes in each initial cluster.

Optionally, the clustering the plurality of nodes according to the node distance between every two nodes to obtain at least one initial cluster includes:

if at least one pair of target nodes exists in each two nodes, clustering nodes in a preset neighborhood range where each pair of target nodes is located to obtain at least one initial cluster, wherein the node distance of each pair of target nodes is smaller than or equal to a preset neighborhood value.

Optionally, the obtaining at least one node cluster from the at least one initial cluster according to the number of nodes in each initial cluster includes:

and if at least one cluster with the number of nodes larger than or equal to the preset number exists in the at least one initial cluster, taking the at least one cluster as the at least one node cluster.

Optionally, the performing plug-in detection on the node in each node cluster according to the characteristics of the node in each node cluster includes:

if the node cluster has a pre-marked add-on node, acquiring the proportion of the add-on node in the node cluster;

if the proportion of the plug-in nodes is smaller than the preset proportion, acquiring first characteristics of the plug-in nodes and second characteristics of other nodes except the plug-in nodes in the initial cluster;

performing similarity analysis according to the first characteristic and the second characteristic to obtain the similarity between the external hanging node and the other nodes;

and if the similarity is greater than or equal to a preset similarity, determining that the node cluster is a plug-in cluster.

Optionally, the method further comprises:

and if the proportion of the plug-in nodes is greater than or equal to the preset proportion, determining that the node cluster is the plug-in cluster.

In a second aspect, another embodiment of the present application provides a device for detecting a game plug-in, where the device includes:

the processing module is used for constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: log data of virtual asset transactions conducted by a plurality of game characters in a game, the transaction map comprising: the plurality of nodes and the transaction relationship among the nodes, wherein each node corresponds to a game role;

the acquisition module is used for performing feature representation by adopting a preset structure vector algorithm according to the transaction map to obtain a feature vector of each node; clustering the plurality of nodes according to the feature vectors of the plurality of nodes to obtain at least one node cluster;

and the detection module is used for carrying out plug-in detection on the nodes in each node cluster according to the characteristics of the nodes in each node cluster.

the acquisition module is specifically configured to:

Optionally, the obtaining module is specifically configured to:

Optionally, the detection module is specifically configured to:

Optionally, the detection module is further configured to:

In a third aspect, another embodiment of the present application provides a server, including: a processor, a storage medium and a bus, wherein the storage medium stores machine-readable instructions executable by the processor, the processor and the storage medium communicate via the bus when the server is running, and the processor executes the machine-readable instructions to perform the method according to any one of the first aspect.

In a fourth aspect, another embodiment of the present application provides a storage medium having a computer program stored thereon, where the computer program is executed by a processor to perform the method according to any one of the above first aspects.

The application provides a method, a device, a server and a storage medium for detecting a plug-in game, wherein the method comprises the following steps: constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: log data of virtual asset transactions conducted by a plurality of game characters in a game, a transaction map comprising: the method comprises the steps that a plurality of nodes and a transaction relation among the nodes, wherein each node corresponds to a game role, a preset structure vector algorithm is adopted to perform feature representation according to a transaction map to obtain a feature vector of each node, the nodes are clustered according to the feature vectors of the nodes to obtain at least one node cluster, and plug-in detection is performed on the nodes in each node cluster according to the features of the nodes in each node cluster. The plug-in node has certain regularity in the aspect of asset transaction, so that the detection of the game plug-in is realized on the basis of the transaction map, the accuracy of the game plug-in detection can be improved, and compared with the prior art, the plug-in detection has the advantages of wider coverage, higher recall rate and lower labor cost, and the game performance of a player is not influenced.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are required to be used in the embodiments will be briefly described below, it should be understood that the following drawings only illustrate some embodiments of the present application and therefore should not be considered as limiting the scope, and for those skilled in the art, other related drawings can be obtained from the drawings without inventive effort.

FIG. 1 is a first flowchart illustrating a method for detecting a plug-in game according to an embodiment of the present disclosure;

FIG. 2 illustrates a schematic diagram of a transaction map provided by an embodiment of the present application;

FIG. 3 is a flowchart illustrating a second method for detecting a plug-in game according to an embodiment of the present disclosure;

fig. 4 is a schematic diagram illustrating a K-layer fully connected network provided by an embodiment of the present application;

FIG. 5 is a schematic flow chart diagram showing a third method for detecting a plug-in game according to an embodiment of the present application;

FIG. 6 is a fourth flowchart illustrating a method for detecting a plug-in game according to an embodiment of the present disclosure;

FIG. 7 is a schematic flow chart diagram illustrating a fifth method for detecting a plug-in game according to an embodiment of the present application;

fig. 8 is a schematic diagram illustrating a node cluster provided in an embodiment of the present application;

FIG. 9 is a sixth flowchart illustrating a method for detecting a plug-in game according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram illustrating a detection device for a game store provided by an embodiment of the present application;

fig. 11 shows a schematic structural diagram of a server provided in an embodiment of the present application.

Detailed Description

In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it should be understood that the drawings in the present application are for illustrative and descriptive purposes only and are not used to limit the scope of protection of the present application. Additionally, it should be understood that the schematic drawings are not necessarily drawn to scale. The flowcharts used in this application illustrate operations implemented according to some embodiments of the present application. It should be understood that the operations of the flow diagrams may be performed out of order, and steps without logical context may be performed in reverse order or simultaneously. One skilled in the art, under the guidance of this application, may add one or more other operations to, or remove one or more operations from, the flowchart.

In addition, the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. The components of the embodiments of the present application, generally described and illustrated in the figures herein, can be arranged and designed in a wide variety of different configurations. Thus, the following detailed description of the embodiments of the present application, presented in the accompanying drawings, is not intended to limit the scope of the claimed application, but is merely representative of selected embodiments of the application. All other embodiments, which can be derived by a person skilled in the art from the embodiments of the present application without making any creative effort, shall fall within the protection scope of the present application.

It should be noted that in the embodiments of the present application, the term "comprising" is used to indicate the presence of the features stated hereinafter, but does not exclude the addition of further features.

Before receiving the technical solutions of the present application, first, the terms related to the present application will be described:

MMORPG: an abbreviation of Massive Multiplayer Online Role-Playing Game refers to a massively Multiplayer Online Role-Playing Game, which is one of computer network games.

WinAPI: the abbreviation of Windows API means Windows operating system application program interface, which is the interface for operating Windows kernel application program by computer program.

DLL: the abbreviation of Dynamic Link Library means Dynamic Link Library, which contains a part of functions required by an application program, and DLL injection is a common means for plug-in.

HOOK: chinese name: HOOKs are platforms for processing Windows messages, when programs call WinAPI, each HOOK is executed in sequence according to the sequence of a HOOK chain table, and the HOOK is used as a common mode in plug-in manufacturing.

Struc2 vec: an embedded algorithm for modeling the local structure of nodes in a graph can map the nodes in the graph into fixed-length vectors of a high-dimensional space.

Hierarchical Softmax: the high-efficiency model is provided for solving the problem that the calculation performance of the Softmax model is low when the data volume is too large.

DTW: the abbreviation of Dynamic Time warping, Dynamic Time warping algorithm, an algorithm for calculating sequence similarity based on Dynamic programming.

SkipGram: an algorithm for vector characterization of words in text is capable of mapping context-proximal words into adjacent space.

Node2 vec: a graph embedding algorithm based on random walk and SkipGram can map nodes in a graph into fixed-length vectors of a high-dimensional space.

DBSCAN: a density-based clustering algorithm is capable of dividing an area having a sufficient density into clusters and ensuring density transitivity inside the clusters. DBSCAN has the following advantages. 1) The cluster number does not need to be specified in advance, and developers do not need to limit the category and the degree of flooding of the plug-in advance under the problem of plug-in detection. 2) The DBSCAN is a density-based clustering algorithm, which can find out blocks with high density and transitivity in any shape, and therefore, is not limited by the meaning of character features. 3) The algorithm can effectively distinguish noise (local outliers), so that the effectiveness of cluster of the plug-in population is guaranteed.

T-SNE: an abbreviation of T-distributed Stochastic Neighbor Embedding, a data dimension reduction algorithm based on T distribution and random Neighbor Embedding.

k-order neighbors: given a certain node v in the graph, all the node sets with the shortest path length k from the node v are called k-order neighbors of the node v.

The following drawings: english name: graph, which refers to a data structure consisting of a series of nodes and directed or undirected connections between the nodes, is also commonly referred to as a network.

Degree: the degree, the number of nodes in the graph that are directly connected to a certain node v, is called the degree of the node v. The directed graph may be further subdivided into an in degree (in degree) and an out degree (out degree), which respectively indicate the number of nodes pointing to the node and the number of nodes pointed to by the node.

Complete graph: a graph in which edges between arbitrary nodes exist is called a full graph, and is also often called a fully connected graph. For example, an undirected complete graph contains n nodes, n (n-1)/2 edges; the directed complete graph contains n nodes, n (n-1) edges.

Then, several detection methods of the game plug-in provided by the prior art are explained:

firstly, a game client records various characteristics of a plug-in process and characteristic codes generated by memory code segments through process check, and is forbidden when a process with the same characteristics is found in the running process of the game process, however, the same characteristics can be changed along with the update of the plug-in program, and the accuracy of plug-in detection is low by adopting the scheme.

Secondly, checking is carried out based on a client file, a game client continuously scans the game file and a system file, checks whether the files are modified or not, uploads the files to a server when unknown program files are found so as to analyze dangerous behaviors and determine whether to be forbidden or not, however, a plug-in developer can be independent of the game client and automatically hangs the files only in a mode of simulating human operation such as automatic clicking, so that checking is avoided, and in addition, a protection means based on the client file easily causes reduction of game performance.

And thirdly, based on protection of a window operating system application program interface (Windows API, WinAPI), a game client actively adopts a HOOK (HOOK) mechanism to intervene in the key WinAPI and start anti-debugging so as to prevent WinAPI(s) with HOOK from being hung externally to realize related functions, however, the version of the Windows system is complicated, and the situation of system crash and blue screen is easy to occur in the scheme of active HOOK when the system is updated, so that the experience of a user is influenced.

And fourthly, the intervention operation is manually verified, statistical analysis is carried out by using the empirical characteristics, and the player is checked according to the empirical characteristics, however, the scheme requires higher labor cost and depends on the understanding of the player on the appearance and the game.

The fifth anomaly detection method based on graph analysis is to establish a relationship network for game data logged in by a user and to adopt the traditional graph segmentation technology and other technologies to complete the identification of abnormal individual groups, however, graph segmentation algorithms generally have higher time complexity and are greatly influenced by the connectivity in the graph. For individuals who are similar in the map but have no direct association, the migration recognition capability is lacking, that is, the accuracy of the game cheating detection is not high.

According to the sixth method for modeling based on the behavior sequence in the game of the player, the characterization vector of the behavior pattern is constructed through the collection and analysis of the behavior logs of the diagonal colors, and the plug-in identification is completed.

Based on the above problems, applicants find that in an MMORPG game, a certain program script is automatically hung to realize automatic tasks, strange, upgrade, money-buying and other operations, and in-game property transfer and collection is performed, game properties are collected to a few principals in a hierarchical manner, and then the game properties are subjected to profit-making with external transactions, and based on the collection mode, the cheating plug-in has certain regularity in property transfer, that is, "cheating plug-in number" or "principals number" in the same level has higher structural similarity among different cheating plug-in groups, so that the application realizes detection of the cheating plug-in game based on a transaction map, wherein the transaction map comprises: the system comprises a plurality of nodes and a transaction relation among the nodes, wherein each node corresponds to one game role, so that the accuracy of detecting the cheating plug-in of the game can be improved, and compared with the existing scheme, the labor cost is reduced.

The following describes the method for detecting a plug-in game provided by the embodiment of the present application in detail with reference to several specific embodiments.

Fig. 1 is a schematic flow chart illustrating a method for detecting a plug-in game provided in an embodiment of the present application, where an execution main body of the embodiment may be a game server. As shown in fig. 1, the method includes:

s101, constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: log data of virtual asset transactions conducted by a plurality of game characters in a game, a transaction map comprising: the game system comprises a plurality of nodes and transaction relations among the nodes, wherein each node corresponds to a game role.

The game client may generate a game log when running the game application, and send the game log to the game server, and the game server may store the game log in a preset log library, and it should be noted that the game client may send the game log to the server in real time or at regular time, which is not particularly limited in this embodiment.

The Game application may be any one of Massive Multiplayer Online Role Playing Games (MMORPGs), and in order to detect a plug-in of the Game application, the Game server may obtain a Game log sent by a Game client from a preset log library, and then obtain a Game transaction log from the Game log, where the Game transaction log includes: the log data of virtual asset transactions performed by the plurality of game characters in the game, that is, the game log includes a game transaction log of virtual asset transactions performed by the game characters transmitted by the plurality of game clients, wherein the virtual asset can be, for example, virtual money paid to the game character B when the game character a purchases a virtual item from the game character B.

In this embodiment, a transaction graph is constructed according to a game transaction log, where the transaction graph includes a plurality of nodes and transaction relationships between the nodes, each node corresponds to a game character, edges between the nodes represent the transaction relationships between the nodes, and the edges between the nodes may be directed edges, for example, when the game character a pays virtual money to the game character B, an arrow of the edge between the node corresponding to the game character a and the node corresponding to the game character B points to the game character B.

The log data of virtual asset transactions performed by a plurality of game characters in a game includes transaction data and transaction item data. Table 1 is an illustration of a transaction database and table 2 is an illustration of a transaction item.

TABLE 1

Field(s)	Explanation of the invention
		ItemID	Article ID
ItemValue	Value of goods
		ItemType	Type of article

TABLE 2

It should be noted that the value of the article can be manually estimated by an expert in game operation, or the transaction price of the article in the game virtual mall can be estimated within a certain period of time, and a transaction map is constructed according to the transaction data and the transaction article data.

Because the edges in the transaction graph are used for representing the transaction relationship between the nodes, in order to more effectively excavate the property convergence phenomenon, the transaction graph can be subjected to edge filtering according to the preset transaction relationship.

The preset transaction relationship may be that the transaction frequency is less than or equal to the preset transaction frequency, and/or the actual value difference is less than or equal to the preset value difference, that is, edges satisfying the preset transaction relationship in the transaction map are filtered, and only edges where the transaction frequency is greater than the preset transaction frequency and the actual value difference exceeds the preset value difference are reserved.

The actual value difference is calculated by using the transaction item data in table 2 to calculate the actual transfer value of each transaction in table 1. For example, ID1 purchased an item worth 200 copper money from ID2, but given only 100 copper money, the actual value of the transaction was 100 copper money.

Fig. 2 is a schematic diagram of a transaction graph provided by an embodiment of the present application, and as shown in fig. 2, each node (indicated by a dot) in the transaction graph represents a game character, edges between the nodes indicate that the two nodes have a transaction relationship, and the edges between the nodes are directed edges, for example, if game character a pays virtual money to game character B, then the direction of the arrow may be that game character a points to game character B.

And S102, performing feature representation by adopting a preset structure vector algorithm according to the transaction map to obtain a feature vector of each node.

S103, clustering the plurality of nodes according to the feature vectors of the plurality of nodes to obtain at least one node cluster.

And the preset structure vector algorithm is used for mapping the nodes in the map into fixed-length vectors of a high-dimensional space. According to the transaction map, a preset structure vector algorithm can be adopted to perform feature representation on each node in the transaction map, and a feature vector of each node is obtained.

Then, the characteristic vectors of the nodes in the transaction map are clustered to obtain at least one node cluster, namely, the nodes with certain similarity can be converged into one node cluster according to the characteristic vectors of the nodes.

It should be noted that the preset structure vector algorithm may be improved based on the Struc2vec algorithm.

And S104, performing plug-in detection on the nodes in each node cluster according to the characteristics of the nodes in each node cluster.

In this embodiment, after obtaining at least one node cluster, in order to further identify whether a node in each node cluster is a store-on near point, store-on detection may be performed on the node in each node cluster according to the characteristics of the node in each node cluster, so as to identify a store-on node from each node cluster.

Wherein, the characteristic of node can be the portrait characteristic of the game role that the node corresponds, and portrait characteristic can include: the basic information of the character can comprise account information, the character name, the online time, the recharge amount and the like, and the statistical information can comprise the playing method, the daily participation times, the daily chatting times and the like.

In a possible implementation manner, the server pre-stores the characteristics of the plug-in nodes, then calculates the similarity between the characteristics of the nodes in each node cluster and the characteristics of the plug-in nodes, if the similarity is greater than or equal to the preset similarity, the node is considered as the plug-in node, and if the similarity is less than the preset similarity, the node is considered not to be the plug-in node.

The method for detecting the cheating program of the game provided by the embodiment comprises the following steps: constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: log data of virtual asset transactions conducted by a plurality of game characters in a game, a transaction map comprising: the method comprises the steps that a plurality of nodes and transaction relations among the nodes are achieved, each node corresponds to a game role, feature representation is conducted through a preset structure vector algorithm according to a transaction map, a feature vector of each node is obtained, the nodes are clustered according to the feature vectors of the nodes, at least one node cluster is obtained, and plug-in detection is conducted on the nodes in each node cluster according to the features of the nodes in each node cluster. Due to the fact that the plug-in node has certain regularity in the aspect of asset transaction, detection of game plug-ins is achieved on the basis of the transaction map, accuracy of game plug-in detection can be improved, and compared with the prior art, labor cost is reduced.

Optionally, the preset structure vector algorithm includes: a structural distance algorithm, a network construction algorithm, and a wandering-based vector characterization algorithm. The following describes, with reference to the embodiment of fig. 2, performing feature representation by using a preset structure vector algorithm according to a transaction map to obtain a feature vector of each node.

Fig. 3 is a schematic flow diagram illustrating a second method for detecting a game plug-in provided in an embodiment of the present application, and as shown in fig. 3, performing feature representation by using a preset structure vector algorithm according to a transaction map to obtain a feature vector of each node, where the method includes:

s201, calculating a k-order structural distance of every two nodes by adopting a structural distance algorithm according to the degree sequence of every two nodes in the transaction graph, wherein the k-order structural distance is used for representing the structural similarity of k-order neighbor nodes of every two nodes.

The structural distance algorithm is used for calculating the structural distance between two nodes, and generally, the larger the structural distance is, the smaller the structural similarity is, and the smaller the structural distance is, the larger the structural similarity is.

The degree sequence of a node may be a sequence of degrees of k-th order neighbor nodes of the node in the transaction graph. In general, if the degrees of two nodes are the same, the node structures of the two nodes are similar, and if the degrees of the neighbors of the two nodes are also the same, the node structures of the two nodes are higher than those of the neighbors of the two nodes, so in this embodiment, the degree sequence of the k-order neighbor node is taken as a consideration, and according to the degree sequence of each two nodes in the transaction graph, a structural distance algorithm is adopted, so that the k-order structural distance of each two nodes can be calculated, and the k-order structural distance is used for representing the structural similarity of the k-order neighbor node of each two nodes, that is, the k-order structural distance is adopted to reflect the structural similarity between the k-order neighbor nodes of the two nodes.

S202, according to the K-order structure distance of every two nodes, a network construction algorithm is adopted to construct a K-th layer network, a K-layer fully-connected network with the K-layer network is obtained, and the K-layer fully-connected network comprises the following steps: the edge weight of every two nodes in each layer network and the edge weight of the same node in the adjacent layer network.

A fully connected network may also be referred to as a full graph, which refers to a graph in which edges between arbitrary nodes exist. A K-tier fully-connected network means that each node replicates K copies, that is, the nodes in each tier are identical. It should be noted that the nodes in the fully-connected network of each layer are all nodes in the transaction graph.

Fig. 4 shows a schematic diagram of a K-layer fully-connected network provided in an embodiment of the present application, and as shown in fig. 4, each layer of fully-connected network includes four nodes, which total K layers.

Wherein, K layer full connection network can be K layer full connection graph, K layer weighted network, that is to say, K layer full connection network includes: the edge weights of every two nodes in each layer network and the edge weight of the same node in the adjacent layer network, the edges of every two nodes in each layer network are shown as solid lines in fig. 4, and the edges of the same node in the adjacent network are shown as dotted lines in fig. 4.

In this embodiment, the network construction algorithm is used for constructing a K-th layer fully-connected network by using K-order structural distances of every two nodes, that is, the K-order structural distances of every two nodes have a certain corresponding relationship with a K-th layer network in the K-th layer fully-connected network, and then the K-th layer fully-connected network with the K-layer network can be obtained according to the constructed K-th layer network, where K is 0 or any positive integer smaller than K.

And S203, obtaining the characteristic vector of each node in the K-th network by adopting a migration-based vector characterization algorithm according to the K-layer full-connection network.

The vector characterization algorithm based on the wandering comprises a random wandering algorithm and a training language model. For each node, the random walk algorithm is used for obtaining a walk sequence of the node in a K-layer fully-connected network, the walk sequence comprises nodes which the node passes through when the node randomly walks in the K-layer fully-connected network, so that a plurality of walk sequences are obtained, then the obtained plurality of walk sequences are used as input, a training language model is adopted to obtain a vector of each node in each layer of the network, and the vector of each node in the K-th layer of the network is used as a feature vector of the node.

Wherein, K layer full connection network includes: the edge weights of every two nodes in each layer network and the edge weight of the same node in the adjacent layer network, when random walk is performed, if two walk directions occur, the node corresponding to the edge with the larger edge weight is used as the next node to walk, for example, the node a in fig. 3 can walk around the node B and the node C, but since the edge weight between the node a and the node B is 0.9 and the edge weight between the node a and the node C is 0.1, the next node to walk is indicated as the node B.

It should be noted that the training language model may be based on the Hierarchical software max and the SkipGram training language model, and the dimension of the output vector may also be preset, for example, may be 128 dimensions, and the details may be referred to in the related description in the prior art.

It should be noted that the degree may include an in-degree and an out-degree, so when calculating the sequence distance between the first node and the second node, two K-layer fully-connected networks may be constructed according to the sequence of the in-degree and the sequence of the out-degree respectively according to steps S201 to S202, and therefore in step S203, two eigenvectors of the same node may be obtained, and then the two eigenvectors are spliced to obtain the eigenvector of the node.

The method for detecting the cheating program of the game provided by the embodiment comprises the following steps: according to the degree sequence of every two nodes in the transaction map, a structural distance algorithm is adopted to calculate the K-order structural distance of every two nodes, the K-order structural distance is used for representing the structural similarity of K-order neighbor nodes of every two nodes, a network construction algorithm is adopted according to the K-order structural distance of every two nodes to construct a K-th network, a K-layer full-connection network with the K-layer network is obtained, and the K-layer full-connection network comprises: and the edge weights of every two nodes in each layer network and the edge weight of the same node in the adjacent layer network are obtained by adopting a wandering-based vector characterization algorithm according to the K layer full-connection network to obtain the characteristic vector of each node in the K layer network. The characteristic vectors of the nodes can be obtained by adopting an intelligent algorithm without strong expert experience of a developer on games, so that the accuracy of the characteristic vectors is improved.

Optionally, the following describes, with reference to the embodiment of fig. 5, calculating a k-order structural distance of every two nodes by using a structural distance algorithm according to the degree sequence of every two nodes in the transaction graph. Fig. 5 is a schematic flow diagram showing a third method for detecting a game plug-in provided in the embodiment of the present application, and as shown in fig. 5, calculating a k-order structural distance of every two nodes by using the structural distance algorithm according to a degree sequence of every two nodes in a transaction map includes:

s301, a first degree sequence of a first node and a second degree sequence of a second node in every two nodes are obtained.

S302, calculating the sequence distance between the first degree sequence and the second degree sequence.

S303, calculating the k-order structure distance of the first node and the second node according to the sequence distance and the structure distance of the previous-order neighbor node, wherein the previous-order neighbor node comprises: a first-order neighbor node of the first node and a first-order neighbor node of the second node in the transaction graph.

Each two nodes comprise a first node and a second node, the first degree sequence of the first node is a sequence formed by degrees of k-order neighbor nodes of the first node, and the second degree sequence of the second node is a sequence formed by degrees of k-order neighbor nodes of the second node.

In this embodiment, a first degree sequence of a first node and a second degree sequence of a second node in every two nodes are obtained, a sequence distance between the first degree sequence and the second degree sequence is calculated, and then a k-order structure distance between the first node and the second node is calculated according to the sequence distance and a structure distance of a previous-order neighbor node, where the k-order structure distance is used to represent a structure similarity of k-order neighbor nodes of every two nodes, where the previous-order neighbor node includes: a first-order neighbor node of the first node and a first-order neighbor node of the second node in the transaction graph.

That is, the k-order structural distance of the first node and the second node depends on the structural distance of the previous-order neighbor node.

In one possible implementation, the k-th order structure distance of the first node and the second node may be calculated according to the following formula:

f_k(u,v)＝f_k-1(u,v)+g(s(R_k(u)),s(R_k(v)))

wherein f is_k(u, v) is the k-th order structure distance of node u and node v, f_k-1(u, v) is the structural distance of node u and the first-order neighbor node of node v, s (R)_k(u)) is the degree sequence of node u, s (R)_k(v) G (s (R)) is the degree sequence of node v_k(u)),s(R_k(v) )) is s (R)_k(u)) and s (R)_k(v) ) of the sequence. Wherein, | R_k(u)|>0,|R_k(v)|>0，f_-1＝0。

Optionally, the obtaining a first degree sequence of a first node and a second degree sequence of a second node in every two nodes includes:

and arranging the degrees of the k-stage neighbor nodes of the first node according to an ascending order to obtain a first degree sequence.

And (4) arranging the degrees of the k-stage neighbor nodes of the second node according to an ascending order to obtain a second degree sequence.

In a possible implementation manner, the degrees of k-stage neighbor nodes of the first node may be sorted in ascending order to obtain a first degree sequence, and the degrees of k-stage neighbor nodes of the second node may be sorted in ascending order to obtain a second degree sequence, that is, the degrees of the nodes having a path length of k from the first node are sorted in ascending order to obtain a first degree sequence, and the degrees of the nodes having a path length of k from the second node are sorted in ascending order to obtain a second degree sequence.

It should be noted that the path length between adjacent nodes is 1, and the path lengths of two nodes separated by one node are 2, that is, one edge represents that the path length is 1, and two edges represent that the path length is 2.

Optionally, calculating the sequence distance of the first degree sequence and the second degree sequence comprises:

The Dynamic Time Warping (DTW) algorithm is an algorithm for calculating sequence similarity based on Dynamic programming, that is, a sequence distance between a first degree sequence and a second degree sequence is calculated by taking the first degree sequence and the second degree sequence as input and adopting the Dynamic Time Warping algorithm.

It should be noted that the core of the DTW algorithm is to calculate the element distance between every two elements in two sequences, and then calculate the sequence distance of the two sequences according to the calculated multiple element distances. The element distance is calculated in the following manner:

wherein a is any one element in the first degree sequence, b is any one element in the second degree sequence, max (a, b) is the maximum value of a and b, min (a, b) is the minimum value of a and b, and d (a, b) is the element distance between a and b.

The method for detecting the cheating program of the game provided by the embodiment comprises the following steps: acquiring a first degree sequence of a first node and a second degree sequence of a second node in every two nodes, calculating a sequence distance between the first degree sequence and the second degree sequence, and calculating a k-order structure distance between the first node and the second node according to the sequence distance and a structure distance of a previous-order neighbor node, wherein the previous-order neighbor node comprises: a first-order neighbor node of the first node and a first-order neighbor node of the second node in the transaction graph. Therefore, the structural distance of the nodes can be calculated, the structural similarity of the two nodes is reflected, and subsequent plug-in detection based on the structural similarity of the nodes is facilitated.

Fig. 6 shows a flow diagram of a fourth method for detecting a plug-in game provided in the embodiment of the present application, where as shown in fig. 6, a network construction algorithm is adopted to construct a K-th layer network according to a K-order structural distance between every two nodes, so as to obtain a K-layer fully connected network with the K-layer network, where the method includes:

s401, calculating k-order edge weight of every two nodes in the k-th layer network according to the k-order structure distance.

The K-order structure distance and a K-th layer network in the K-layer fully-connected network have a certain corresponding relation, so that the K-order edge weight of every two nodes in the K-th layer network can be calculated according to the K-order structure distance. Illustratively, the following formula may be employed for calculation:

wherein, w_k(u, v) is the k-th order edge weight between node u and node v, f_k(u, v) is the k-th order structure distance of node u and node v.

Wherein, K layer full connection network still includes: and the edge weight of the same node in the adjacent layer network. Then the k +1 order edge weight of the same node in the k +1 th network and the k-1 order edge weight of the same node in the k +1 th network and the k +1 th network need to be obtained, which will be described below with reference to steps S402-S403.

S402, according to the number of the nodes of which the edge weights pointing to the nodes in the k-th network meet preset weight conditions, calculating the k + 1-order edge weights of the same node in the k-th network and the k + 1-order network.

The preset weight condition may be greater than or equal to a preset weight value.

Alternatively, the k +1 order edge weight may be calculated with reference to the following formula:

w(u_k,u_k+1)＝log(Γ_k(u)+e)

wherein, w (u)_k,u_k+1) Is as followsk +1 order edge weights, Γ, of nodes u in k-th and k + 1-th layer networks_k(u) is the number of nodes in the k-th layer network whose edge weights pointing to the node u meet the preset weight condition, and e is a constant.

Optionally, satisfying the preset weight condition includes: greater than or equal to the average edge weight of the k-th network.

The average edge weight is an average value of all edge weights in the k-th network, that is, the k + 1-order edge weight of the same node in the k-th network and the k + 1-th network can be calculated according to the number of nodes in the k-th network, where the edge weight is greater than or equal to the average edge weight of the k-th network and points to each node.

S403, constructing a K-layer fully-connected network according to the K-order side weight, the K + 1-order side weight and the K-1-order side weight, wherein the K-1-order side weight is a preset weight.

The k +1 order edge weight may be a preset weight, for example, may be 1, and refer to the following formula:

w(u_k+1,u_k)＝1

wherein, w (u)_k+1,u_k) The edge weights of the k-1 order of the node u in the k-th network and the k + 1-th network are the edge weights of the node u in the k-th network and the k + 1-th network, that is, the edge weights of the same node in the k-th network and the k + 1-th network and the edge weights of the same node in the k + 1-th network and the k-th network have directions, the edge weight of the node u in the k-th network pointing to the node u in the k + 1-th network is obtained through calculation, and the edge weight of the node u in the k + 1-th network pointing to the node u in the k-th network is a known preset weight.

And constructing the whole K-layer fully-connected network according to the K-order edge weights of every two nodes in each layer network, the K + 1-order edge weights of the same node in the K-th layer network and the K + 1-th layer network and the K-1-order edge weights of the same node in the K-th layer network and the K-th layer network.

The method for detecting the cheating program of the game provided by the embodiment comprises the following steps: and according to the K-order structural distance, calculating K-order edge weights of every two nodes in the K-th network, calculating K + 1-order edge weights of the same node in the K-th network and the K + 1-order network according to the number of nodes of which the edge weights pointing to the nodes in the K-th network meet preset weight conditions, and constructing a K-layer fully-connected network according to the K-order edge weights, the K + 1-order edge weights and the K-1-order edge weights, wherein the K-1-order edge weights are preset weights. Therefore, a K-layer full-connection network can be constructed according to the edge weight of each layer of network and the edge weight of the adjacent network, and the subsequent acquisition of the feature vector of the node is facilitated.

Optionally, the following describes an acquisition process of at least one node cluster with reference to the embodiment of fig. 7. Fig. 7 is a schematic flow diagram illustrating a fifth method for detecting a game cheating program according to an embodiment of the present application, where as shown in fig. 7, clustering a plurality of nodes according to feature vectors of the plurality of nodes to obtain at least one node cluster includes:

and S501, calculating the node distance of every two nodes according to the feature vectors of the nodes.

S502, clustering the plurality of nodes according to the node distance between every two nodes to obtain at least one initial cluster.

The node distance between every two nodes can be calculated according to the feature vectors of the plurality of nodes, and the method for calculating the node distance according to the feature vectors is similar to that in the prior art and is not repeated herein.

Then, according to the calculated node distance between every two nodes, clustering is performed on the plurality of nodes, for example, nodes with the node distance smaller than a preset distance can be gathered into one class, so as to obtain at least one initial cluster.

Optionally, clustering the plurality of nodes according to the node distance between every two nodes to obtain at least one initial cluster, including:

if at least one pair of target nodes exists in every two nodes, clustering the nodes in the preset neighborhood range where each pair of target nodes is located to obtain at least one initial cluster, wherein the node distance of each pair of target nodes is smaller than or equal to the preset neighborhood value.

If at least one pair of target nodes exists in every two nodes, clustering the nodes in the preset neighborhood range where each pair of target nodes is located, namely, presetting a preset neighborhood value, and if at least one pair of target nodes whose node distance is less than or equal to the preset neighborhood value exist in every two nodes, aggregating the nodes in the preset neighborhood range where each pair of target nodes is located into one class, namely, clustering the nodes in the preset neighborhood range where the target nodes are located only when the node distance is less than or equal to the preset neighborhood value, so as to obtain at least one initial cluster.

Optionally, the preset neighborhood value may be 1.7, and the preset neighborhood range may be a range of a circle having a center point of each pair of target nodes and a radius of the preset neighborhood value.

S503, acquiring at least one node cluster from at least one initial cluster according to the number of nodes in each initial cluster.

In order to further determine whether the node in each initial cluster is a plug-in node, it is further determined whether each initial cluster is a cluster satisfying the condition. The condition may be that the number of nodes is greater than or equal to a preset number, for example.

Optionally, acquiring at least one node cluster from at least one initial cluster according to the number of nodes in each initial cluster, including:

and if at least one cluster with the number of nodes larger than or equal to the preset number exists in at least one initial cluster, taking the at least one cluster as at least one node cluster.

Even if an initial cluster is formed, whether a node cluster is formed needs to be determined according to the number of nodes in the initial cluster, and if at least one cluster with the number of nodes larger than or equal to a preset number exists in the initial cluster, the at least one cluster is used as at least one node cluster, that is, the number of nodes in each node cluster is larger than or equal to the preset number.

Alternatively, the preset number may be 30.

It should be noted that, because the feature vectors of the nodes in each node cluster are high-dimensional, the dimensions of the nodes may be visualized, fig. 8 shows a schematic diagram of the node cluster provided in the embodiment of the present application, as shown in fig. 8, the size of a neighborhood is set to 1.7, the number of nodes in the node cluster may be set to 30, and it can be seen that the node cluster determined in fig. 8 is clearly distinguished from other initial clusters (respectively labeled as cluster 1, cluster 2, and cluster 3).

It should be noted that steps S601-S603 may be performed by using the DBSCAN algorithm.

The method for detecting the cheating program of the game provided by the embodiment comprises the following steps: calculating the node distance between every two nodes according to the feature vectors of the nodes, clustering the nodes according to the node distance between every two nodes to obtain at least one initial cluster, and acquiring at least one node cluster from the at least one initial cluster according to the number of the nodes in each initial cluster. Therefore, the node cluster can be obtained through an intelligent algorithm, and subsequent detection of the plug-in node according to the node cluster is facilitated.

Optionally, for at least one node cluster in the embodiment of fig. 8, a cheating detection may be further performed on nodes in each node cluster. Fig. 9 is a schematic flow diagram six illustrating a method for detecting a game cheating program according to an embodiment of the present application, where as shown in fig. 9, detecting cheating on a node in each node cluster according to a characteristic of the node in each node cluster includes:

s601, if the pre-marked external hanging nodes exist in the node cluster, acquiring the proportion of the external hanging nodes in the node cluster.

The pre-marked add-on node may be a pre-recorded add-on node, and for example, an account of a previously detected add-on node may be saved. When the node cluster is obtained, the account number of the plug-in node stored in advance can be inquired to determine whether the pre-marked plug-in node exists in the node cluster, if the pre-marked plug-in node exists in the node cluster, the proportion of the plug-in node in the node cluster is obtained, the proportion of the plug-in node is the proportion of the plug-in node in the node cluster, and if the node cluster comprises 30 nodes and 15 plug-in nodes, the proportion of the plug-in node is 50%.

S602, if the proportion of the plug-in nodes is smaller than the preset proportion, acquiring first characteristics of the plug-in nodes and second characteristics of other nodes except the plug-in nodes in the initial cluster.

And S603, carrying out similarity analysis according to the first characteristic and the second characteristic to obtain the similarity between the external hanging node and other nodes.

And S604, if the similarity is greater than or equal to the preset similarity, determining the node cluster as a plug-in cluster.

The first characteristic of the external hanging node is the portrait characteristic of the external hanging node, and the second characteristic of other nodes except the external hanging node in the initial cluster is the portrait characteristic of other nodes. The portrait features may include: the basic information of the character can comprise account information, the character name, the online time, the recharge amount and the like, and the statistical information can comprise the playing method, the daily participation times, the daily chatting times and the like.

If the proportion of the plug-in nodes is smaller than the preset proportion, further acquiring first characteristics of the plug-in nodes and second characteristics of other nodes, and performing similarity analysis on the first characteristics and the second characteristics, namely calculating the similarity of the first characteristics and the second characteristics, and if the similarity is larger than or equal to the preset similarity, considering the node cluster as the plug-in cluster, namely, the nodes in the node cluster are all plug-in nodes.

It should be noted that the number of the external hanging nodes is at least one, and when the similarity is calculated, the average characteristic of the first characteristic of the external hanging node may be taken, and the similarity between the average characteristic and the second characteristic of each other node may be calculated.

Optionally, if the proportion of the external hanging nodes is greater than or equal to the preset proportion, the method further includes:

and S605, if the proportion of the plug-in nodes is larger than or equal to the preset proportion, determining that the node cluster is the plug-in cluster.

That is, if the proportion of the add-on nodes is greater than or equal to the preset proportion, all the nodes in the node cluster are the add-on nodes.

Certainly, the detected account information of the plug-in node can be stored in a MySQL database, and all the portrait features and the clustering results detected as plug-ins are stored in a File form and stored according to a File Transfer Protocol (FTP), so that subsequent verification results and batch prohibition can be performed in game operation.

It should be noted that the representation characteristics of the plug-in node can be displayed through a visualization tool, and the visualization tool can visually display the difference between the current node and other nodes, so that evidentiary support is provided for judging whether a certain node uses the plug-in node, the accuracy of an output result can be verified, and the closed-loop logic of plug-in detection is completed.

The method for detecting the cheating program of the game provided by the embodiment comprises the following steps: if the node cluster has the externally hung nodes marked in advance, acquiring the proportion of the externally hung nodes in the node cluster, if the proportion of the externally hung nodes is smaller than the preset proportion, acquiring first characteristics of the externally hung nodes and second characteristics of other nodes except the externally hung nodes in the initial cluster, performing similarity analysis according to the first characteristics and the second characteristics, acquiring the similarity between the externally hung nodes and other nodes, and if the similarity is larger than or equal to the preset similarity, determining the node cluster as the externally hung cluster; and if the proportion of the plug-in nodes is greater than or equal to the preset proportion, determining the node cluster as the plug-in cluster. Therefore, the plug-in nodes in the node cluster can be detected based on the proportion of the plug-in nodes and the characteristics of the nodes, and the plug-in detection accuracy is improved.

Fig. 10 is a schematic structural diagram of a detection device for a game store provided in an embodiment of the present application, and as shown in fig. 10, the detection device 70 for a game store includes:

a processing module 701, configured to construct a transaction graph according to a game transaction log, where the game transaction log includes: log data of virtual asset transactions conducted by a plurality of game characters in a game, the transaction map comprising: the plurality of nodes and the transaction relationship among the nodes, wherein each node corresponds to a game role;

an obtaining module 702, configured to perform feature representation by using a preset structure vector algorithm according to the transaction map, to obtain a feature vector of each node; clustering the plurality of nodes according to the feature vectors of the plurality of nodes to obtain at least one node cluster;

the detecting module 703 is configured to perform plug-in detection on the node in each node cluster according to the characteristics of the node in each node cluster.

the obtaining module 702 is specifically configured to:

Optionally, the obtaining module 702 is specifically configured to:

Optionally, the detection module 703 is specifically configured to:

Optionally, the detecting module 703 is further configured to:

The description of the processing flow of each module in the device and the interaction flow between the modules may refer to the related description in the above method embodiments, and will not be described in detail here.

Fig. 11 shows a schematic structural diagram of a server provided in an embodiment of the present application, and as shown in fig. 11, the server 80 includes: a processor 801, a storage medium 802 and a bus 803, wherein the storage medium 802 stores machine-readable instructions executable by the processor 801, when the server 80 runs, the processor 801 communicates with the storage medium 802 through the bus 803, and the processor 801 executes the machine-readable instructions to execute the method of the above method embodiment.

The embodiment of the application also provides a storage medium, wherein a computer program is stored on the storage medium, and when the computer program is executed by a processor, the method of the embodiment of the method is executed.

It can be clearly understood by those skilled in the art that, for convenience and brevity of description, the specific working processes of the system and the apparatus described above may refer to corresponding processes in the method embodiments, and are not described in detail in this application. In the several embodiments provided in the present application, it should be understood that the disclosed system, apparatus and method may be implemented in other ways. The above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is merely a logical division, and there may be other divisions in actual implementation, and for example, a plurality of modules or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection of devices or modules through some communication interfaces, and may be in an electrical, mechanical or other form.

In addition, functional units in the embodiments of the present application may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The functions, if implemented in the form of software functional units and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.

The above description is only for the specific embodiments of the present application, but the scope of the present application is not limited thereto, and any person skilled in the art can easily conceive of the changes or substitutions within the technical scope of the present application, and shall be covered by the scope of the present application.

Claims

1. A method for detecting a store outside a game, comprising:

constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: log data of virtual asset transactions conducted by a plurality of game characters in a game, the transaction map comprising: the system comprises a plurality of nodes and a transaction relation among the nodes, wherein each node corresponds to a game role;

2. The method of claim 1, wherein the predetermined structure vector algorithm comprises: a structural distance algorithm, a network construction algorithm and a vector characterization algorithm based on migration;

according to the K-order structure distance of every two nodes, constructing a K-th layer network by adopting the network construction algorithm to obtain a K-layer fully-connected network with the K-layer network, wherein the K-layer fully-connected network comprises: the edge weight of every two nodes in each layer network and the edge weight of the same node in the adjacent layer network; k is 0 or any positive integer less than K;

3. The method according to claim 2, wherein calculating the k-th order structural distance of each two nodes according to the degree sequence of each two nodes in the transaction graph by using the structural distance algorithm comprises:

4. The method of claim 3, wherein obtaining the first degree sequence of the first node and the second degree sequence of the second node in each two nodes comprises:

5. The method of claim 3, wherein the calculating the sequence distance of the first degree sequence and the second degree sequence comprises:

6. The method according to claim 2, wherein the constructing a K-th layer network by using the network construction algorithm according to the K-th order structure distance of every two nodes to obtain the K-layer fully connected network with the K-layer network comprises:

7. The method according to claim 6, wherein the meeting of the preset weight condition comprises: greater than or equal to the average edge weight of the k-th network.

8. The method of claim 1, wherein clustering the plurality of nodes according to their feature vectors to obtain at least one node cluster comprises:

9. The method of claim 8, wherein clustering the plurality of nodes according to the node distance between every two nodes to obtain at least one initial cluster comprises:

10. The method according to claim 8 or 9, wherein the obtaining at least one node cluster from the at least one initial cluster according to the number of nodes in each initial cluster comprises:

11. The method according to claim 8, wherein the detecting the cheating on the nodes in each node cluster according to the characteristics of the nodes in each node cluster comprises:

if the proportion of the plug-in nodes is smaller than a preset proportion, acquiring first characteristics of the plug-in nodes and second characteristics of other nodes except the plug-in nodes in the initial cluster;

12. The method of claim 11, further comprising:

13. A detection device for gaming cheating, comprising:

the processing module is used for constructing a transaction map according to a game transaction log, wherein the game transaction log comprises: log data of virtual asset transactions conducted by a plurality of game characters in a game, the transaction map comprising: the system comprises a plurality of nodes and a transaction relation among the nodes, wherein each node corresponds to a game role;

14. A server, comprising: a processor, a storage medium and a bus, the storage medium storing machine-readable instructions executable by the processor, the processor and the storage medium communicating via the bus when the server is running, the processor executing the machine-readable instructions to perform the method of any one of claims 1-12.

15. A storage medium having stored thereon a computer program for performing the method according to any of claims 1-12 when executed by a processor.