CN107281755A - Construction method, device, storage medium, processor and the terminal of detection model - Google Patents
Construction method, device, storage medium, processor and the terminal of detection model Download PDFInfo
- Publication number
- CN107281755A CN107281755A CN201710576568.1A CN201710576568A CN107281755A CN 107281755 A CN107281755 A CN 107281755A CN 201710576568 A CN201710576568 A CN 201710576568A CN 107281755 A CN107281755 A CN 107281755A
- Authority
- CN
- China
- Prior art keywords
- info class
- class
- detection model
- data
- game
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
- A63F13/70—Game security or game management aspects
- A63F13/79—Game security or game management aspects involving player-related data, e.g. identities, accounts, preferences or play histories
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
- A63F13/70—Game security or game management aspects
- A63F13/75—Enforcing rules, e.g. detecting foul play or generating lists of cheating players
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F2300/00—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game
- A63F2300/50—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers
- A63F2300/53—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers details of basic data processing
- A63F2300/535—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers details of basic data processing for monitoring, e.g. of user parameters, terminal parameters, application parameters, network parameters
Abstract
The invention discloses a kind of construction method of detection model, device, storage medium, processor and terminal.This method includes：Multiple info class are obtained from data to be verified, wherein, data to be verified are extracted from the daily record data increased newly in preset range, and multiple info class are used to determine detection model to be used, and detection model is used to detect the abnormal behaviour in game；It is compared by the information gain to each info class in multiple info class, builds detection model.The plug-in detection scheme of game that the present invention is solved provided in correlation technique needs to obtain complete game data, and amount of calculation is larger and can not meet the technical problem that the increment of game data changes demand.
Description
Technical field
The present invention relates to computer realm, it is situated between in particular to a kind of construction method of detection model, device, storage
Matter, processor and terminal.
Background technology
Plug-in detection of playing, which is generally identified, belongs to abnormality detection problem, i.e. extracted from a series of daily record datas different
Regular data.Abnormality detection receives much concern in Data Mining, and is played an important role in many practical application scenes.
For example：Credit card fraud detection, network intrusion detection and other unusual checkings.At present, a large amount of prior arts by
Successfully research and develop and be directed to abnormality detection research, for example：Method for detecting abnormality based on figure, the abnormality detection side based on tensor
Method.
User behavior analysis is the method that current industry is commonly used to carry out the detection of game scripts robot.This method is used
The game player's daily record data extracted from game server, and then detect using data mining mode some unconventional precisions
The game of design is plug-in.It is this unconventional plug-in, it is plug-in different from tradition, it can be discriminated by the detection of simple client
Not.Unconventional plug-in disguise is stronger, be more difficult to be found, and plug-in designer is also known is used for plug-in be forcibly stopped
How problem, make the measure of reply property, for example in time：Change it is plug-in in the certain content that includes hide the outer of game company
Hang testing mechanism.Therefore, release improvement project in correlation technique, it is to analyze daily record data from different angles, for example：Point
Movement locus in doings, economic activity either virtual map under analysis game environment.Utilize common data mining skill
Art, for example：Classification (includes but is not limited to：SVMs, linear regression) or clustering technique is (including but not limited to：K averages are gathered
Class, hierarchical clustering etc.), to by empirically or domain knowledge choose player characteristic data excavate.
However, the solution proposed in correlation technique needs to gather complete game data, and trip is not considered
Play data can also change with the time in itself.Particularly when the total number of game data is more huge, it is necessary to expend compared with
Many hardware resources, and processing time is longer, it is higher to handle complexity.
For it is above-mentioned the problem of, effective solution is not yet proposed at present.
The content of the invention
At least one embodiment of the invention provides a kind of construction method of detection model, device, storage medium, processor
And terminal, need to obtain complete game data, meter at least to solve the plug-in detection scheme of game provided in correlation technique
Calculation amount is larger and can not meet the technical problem that the increment of game data changes demand.
According to a wherein embodiment of the invention there is provided a kind of construction method of detection model, including：
Multiple info class are obtained from data to be verified, wherein, data to be verified are the daily records increased newly out of preset range
Extracting data, multiple info class are used to determine detection model to be used, and detection model is used to detect the exception in game
Behavior；It is compared by the information gain to each info class in multiple info class, builds detection model.
Alternatively, multiple info class are obtained from data to be verified includes：Daily record data is extracted from game server；According to
Preparatory condition chooses data to be verified from daily record data, wherein, data to be verified include：The several game angles currently collected
The polytype action data that color is performed under same time dimension, each type action data is respectively set to an information
Class.
Alternatively, it is compared by the information gain to each info class in multiple info class, builds detection model bag
Include：Comparison step：It is compared by the information gain to each info class in multiple info class, chooses first information class and the
Two info class, wherein, the information gain of first information class is the maximum of the information gain of multiple info class, the second info class
Information gain is the second largest value of the information gain of multiple info class；Process step：When the information gain and second of first information class
When the difference of the information gain of info class is more than predetermined threshold value, the corresponding action data of first information class is set to detection model
Current structure element；Step toward division：According to splitting condition corresponding with first information class, next structure member to be generated is determined
Element, returns to comparison step.
Alternatively, the information gain of each info class is compared in by multiple info class, builds detection model
Before, in addition to：Ratio is occupied according to each info class in multiple info class, the corresponding information of each info class is calculated respectively
Entropy；The abnormal behaviour whether each info class is characterized as in game is set to Rule of judgment, and each info class pair is calculated respectively
The conditional entropy answered；Using the corresponding comentropy of each info class conditional entropy corresponding with each info class, each info class is calculated
Information gain.
Alternatively, process step also includes：If determining moving included in multiple info class at element currently building
Changed as data distribution, then create the alternative model associated with detection model, wherein, alternative model includes：Detection model
The structure element that middle whole has been generated.
Alternatively, determine that the action data included in multiple info class is distributed the bag that changes at currently structure element
Include：The corresponding action attributes value of every game role in several game roles is added to sliding window, wherein, action attributes value
Represent whether the action performed by every game role is abnormal；Sliding window is divided into Part I subwindow and Part II
Subwindow；When it is determined that the absolute value of the difference between the first parameter value and the second parameter value is more than or equal to predetermined threshold value, hold
It is continuous to abandon the newest data added to sliding window, and determine that action data distribution changes, until absolute value is less than default
Threshold value, wherein, the first parameter value is the statistical average in Part I subwindow, and the second parameter value is Part II subwindow
Interior statistical average.
Alternatively, after alternative model is created, in addition to：Using default Judging index to detection model and alternative model
It is compared, wherein, presetting Judging index includes at least one of：Recall rate, accuracy rate；When result of determination display substitutes mould
When type is better than detection model, then detection model is replaced using alternative model.
Alternatively, step toward division also includes：It is determined that after next structure element to be generated, control command is obtained, its
In, control command is used to indicate to stop division at next structure element to be generated.
According to a wherein embodiment of the invention, a kind of construction device of detection model is additionally provided, including：
Acquisition module, for obtaining multiple info class from data to be verified, wherein, data to be verified are from preset range
Extracted in interior newly-increased daily record data, multiple info class are used to determine detection model to be used, and detection model is used to detect
Abnormal behaviour in game；Module is built, for being compared by the information gain to each info class in multiple info class,
Build detection model.
Alternatively, acquisition module includes：Extraction unit, for extracting daily record data from game server；Acquiring unit, is used
In data to be verified are chosen from daily record data according to preparatory condition, wherein, data to be verified include：What is currently collected is several
The polytype action data that game role is performed under same time dimension, each type action data is respectively set to one
Individual info class.
Alternatively, building module includes：Comparing unit, for being increased by the information to each info class in multiple info class
Benefit is compared, and chooses first information class and the second info class, wherein, the information gain of first information class is multiple info class
The maximum of information gain, the information gain of the second info class is the second largest value of the information gain of multiple info class；Processing unit,
For when the information gain of first information class is more than predetermined threshold value with the difference of the information gain of the second info class, by the first letter
The corresponding action data of breath class is set to the current structure element of detection model；Divide unit, for according to first information class
Corresponding splitting condition, determines next structure element to be generated, returns to comparing unit.
Alternatively, said apparatus also includes：First computing module, for being accounted for according to each info class in multiple info class
It is proportional, the corresponding comentropy of each info class is calculated respectively；Second computing module, for whether each info class to be characterized as
Abnormal behaviour in game is set to Rule of judgment, and the corresponding conditional entropy of each info class is calculated respectively；3rd computing module, is used
In using the corresponding comentropy of each info class conditional entropy corresponding with each info class, the information for calculating each info class increases
Benefit.
Alternatively, processing unit, if being additionally operable at currently structure element determine moving included in multiple info class
Changed as data distribution, then create the alternative model associated with detection model, wherein, alternative model includes：Detection model
The structure element that middle whole has been generated.
Alternatively, processing unit includes：Subelement is added, for every game role in several game roles is corresponding
Action attributes value is added to sliding window, wherein, action attributes value represents whether the action performed by every game role is abnormal；
Subelement is divided, for sliding window to be divided into Part I subwindow and Part II subwindow；Subelement is handled, is used for
It is lasting to abandon most when it is determined that the absolute value of the difference between the first parameter value and the second parameter value is more than or equal to predetermined threshold value
It is new to be added to the data of sliding window, and determine that action data distribution changes, until absolute value is less than predetermined threshold value, its
In, the first parameter value is the statistical average in Part I subwindow, and the second parameter value is the number in Part II subwindow
According to average value.
Alternatively, building module also includes：Comparing unit, for using default Judging index is to detection model and substitutes mould
Type is compared, wherein, presetting Judging index includes at least one of：Recall rate, accuracy rate；Replacement unit, sentences for working as
When determining result display alternative model better than detection model, then detection model is replaced using alternative model.
Alternatively, divide unit, be additionally operable to, it is determined that after next structure element to be generated, obtain control command, its
In, control command is used to indicate to stop division at next structure element to be generated.
According to a wherein embodiment of the invention, a kind of storage medium is additionally provided, the storage medium includes the program of storage,
Wherein, the construction method of the above-mentioned detection model of equipment right of execution where controlling storage medium when program is run.
According to a wherein embodiment of the invention, a kind of processor is additionally provided, the processor is used for operation program, wherein,
Program performs the construction method of above-mentioned detection model when running.
According to a wherein embodiment of the invention, a kind of terminal is additionally provided, including：One or more processors, memory,
Display device and one or more programs, wherein, one or more programs are stored in memory, and be configured as by
One or more processors are performed, and one or more programs include the construction method for being used to perform above-mentioned detection model.
In an at least embodiment of the invention, using obtaining multiple info class from data to be verified, and by many
The information gain of each info class is compared in individual info class, builds the mode of detection model, using new out of preset range
The data to be verified extracted in the daily record data of increasing, have reached for detecting that the plug-in detection model of game changes over time
And the purpose constantly rebuild, it is achieved thereby that reduction builds the operand of detection model, the increment for meeting game data becomes
The technique effect of change demand, and then solve the plug-in detection scheme of game provided in correlation technique and need to obtain complete trip
Play data, amount of calculation is larger and can not meet the technical problem that the increment of game data changes demand.
Brief description of the drawings
Accompanying drawing described herein is used for providing a further understanding of the present invention, constitutes the part of the application, this hair
Bright schematic description and description is used to explain the present invention, does not constitute inappropriate limitation of the present invention.In the accompanying drawings：
Fig. 1 is the construction method according to the present invention wherein detection model of an embodiment；
Fig. 2 is the structured flowchart according to the present invention wherein construction device of the detection model of an embodiment；
Fig. 3 is the structured flowchart according to the present invention wherein construction device of the detection model of a preferred embodiment.
Embodiment
In order that those skilled in the art more fully understand the present invention program, below in conjunction with the embodiment of the present invention
Accompanying drawing, the technical scheme in the embodiment of the present invention is clearly and completely described, it is clear that described embodiment is only
The embodiment of a part of the invention, rather than whole embodiments.Based on the embodiment in the present invention, ordinary skill people
The every other embodiment that member is obtained under the premise of creative work is not made, should all belong to the model that the present invention is protected
Enclose.
It should be noted that term " first " in description and claims of this specification and above-mentioned accompanying drawing, "
Two " etc. be for distinguishing similar object, without for describing specific order or precedence.It should be appreciated that so using
Data can exchange in the appropriate case, so as to embodiments of the invention described herein can with except illustrating herein or
Order beyond those of description is implemented.In addition, term " comprising " and " having " and their any deformation, it is intended that cover
Lid is non-exclusive to be included, for example, the process, method, system, product or the equipment that contain series of steps or unit are not necessarily limited to
Those steps or unit clearly listed, but may include not list clearly or for these processes, method, product
Or the intrinsic other steps of equipment or unit.
According to a wherein embodiment of the invention there is provided a kind of embodiment of the construction method of detection model, it is necessary to illustrate
, can be held the step of the flow of accompanying drawing is illustrated in the computer system of such as one group computer executable instructions
OK, and, although show logical order in flow charts, but in some cases, can be with different from order herein
Perform shown or described step.
Fig. 1 is the construction method according to the present invention wherein detection model of an embodiment, as shown in figure 1, this method includes
Following steps：
Step S12, obtains multiple info class from data to be verified, wherein, data to be verified are new out of preset range
Extracted in the daily record data of increasing, multiple info class are used to determine detection model to be used, and detection model, which is used to detect, plays
In abnormal behaviour (for example：In gaming using plug-in)；
Step S16, is compared by the information gain to each info class in multiple info class, builds detection model.
By above-mentioned steps, it can use and multiple info class are obtained from data to be verified, and by multiple information
The information gain of each info class is compared in class, builds the mode of detection model, utilizes the day increased newly out of preset range
The data to be verified that will extracting data is arrived, have reached continuous for detecting the plug-in detection model of game to change over time
The purpose rebuild, it is achieved thereby that reduction builds the operand of detection model, meets the increment change demand of game data
Technique effect, and then solve the plug-in detection scheme of game provided in correlation technique and need to obtain complete game number
According to amount of calculation is larger and can not meet the technical problem that the increment of game data changes demand.
Alternatively, in step s 12, multiple info class are obtained from data to be verified can include step performed below：
Step S121, daily record data is extracted from game server；
Step S122, data to be verified are chosen according to preparatory condition from daily record data, wherein, data to be verified include：
The polytype action data that the several game roles currently collected are performed under same time dimension, each type action number
According to being respectively set to an info class.
Above-mentioned daily record data can be the daily record data provided on game server.Data to be verified can generally include but
It is not limited to：Log in game, exit game, receive an assignment, completion task, into map, exit map, get many times of experiences, skills
Can release, game role A hit kill game role B, game role hit kill monster, article using, the article that drops, drop equipment, business
Product transaction, into copy, exit copy, obtain money, using money, upgrading record, experience change record.
The game role of each game player's control has generation various motion.In order to which the action for catching these actions is special
Levy, it is necessary first to the action that game role is produced on each period is represented using characteristic vector.Such statistical (phase
When in above-mentioned preparatory condition) have a lot, wherein, simplest mode is the occurrence frequency for counting every kind of action.Except frequency
, can also be using relative value (for example beyond absolute value：The action of the action frequency of particular game role divided by whole game roles
Frequency sum).
The above-mentioned period can be by User Defined, and it both can be according to natural time shaft --- date Hour Minute Second,
Can also be using the virtual time in game, using grade as time shaft, game role occurs dynamic in every one-level or continuous multi-stage
The frequency of work, 1~5 grade, 6~10 grades, 11~15 grades etc..During data are chosen, it usually needs ensure what is chosen
The time span that game role is chosen is consistent, to carry out subsequent treatment.For example：Access time span was January 1 in 2017
The game role of game data is produced in day~this 30 days on January 30th, 2017, is that cycle statistics is dynamic according to one day time span
Make the indexs such as the frequency, or, choose the game role that game data is produced in 1~45 grade.
It should be noted that in view of plug-in quantity would generally be less than normal game role quantity, therefore, it can lead to first
The mode of over-sampling balances categorical measure.For example：In Data Mining, default sample set is divided into plug-in game
Role and the class of normal game role two.If the proportional difference of this two classes game role is excessive, it is assumed that in 200 game roles only
It is plug-in game role to have 5 game roles, and remaining 195 game role is normal game role, then just can will be outside
Hang game role to repeat to add into above-mentioned default sample set, for example：This 5 plug-in game roles are repeated to be put into default sample
This set 39 times, then performs follow-up training operation again.
Alternatively, step S16, is compared by the information gain to each info class in multiple info class, builds inspection
Step performed below can be included by surveying model：
Step S161, is compared by the information gain to each info class in multiple info class, chooses the first information
Class and the second info class, wherein, the information gain of first information class is the maximum of the information gain of multiple info class, the second letter
Cease second largest value of the information gain of class for the information gain of multiple info class；
Step S162, threshold is preset when the information gain of first information class is more than with the difference of the information gain of the second info class
During value, the corresponding action data of first information class is set to the current structure element of detection model；
Step S163, according to splitting condition corresponding with first information class, determines next structure element to be generated, returns
Step S161.
It will be described further below so that detection model is increment decision Binary Tree as an example, it is necessary first to set up a root section
Point (it is also to be obtained after being compared by the information gain to each info class in multiple info class), at the beginning of the root node
One statistic of beginningization, labeled as Aijk.For each example (x, y), x represents particular game role in special time period
The characteristic vector of action, y represents whether the game role belongs to the decision content of plug-in game role, wherein it is possible to be represented using 0
Normal game role, can represent plug-in game role using 1.Then, using the decision tree under initialization condition first to the trip
Play role is tested, and following Hoeffding are then performed again and adaptively set growth step.Test herein is accurate in order to obtain
The test results such as rate, recall rate, so as to as judging that effect is exported.
First, examples detailed above (x, y) is first reached into specific leaf along existing decision tree by a decision path
Node, then, then updates whole nodes of this paths process and the estimator A of leaf nodeiik.If current leaf section
There is a replaceable tree T in pointalt, then this replaceable tree is also required to perform corresponding Hoeffding and adaptively set to grow step
Suddenly.The information gain G each acted is calculated, its role is to assess the present condition of leaf node to grasp if appropriate for division is performed
Make.When calculating information gain, it is necessary to the step of using to a discretization.Discretization is the common operation in decision tree, nothing
By being traditional decision tree or increment type decision tree, this operation is moved mainly for the attribute or game role in discrete value
Make.So-called centrifugal pump can so use the value of limited numeral mark just as boys and girls, or primary school, junior middle school, senior middle school, university.
When decision tree is divided, it is necessary to discretization operations be performed to the attribute of successive value, to obtain different child nodes.
If the value of this action is successive value rather than centrifugal pump, a kind of height of sane increment type can be used
This discretization method.After the Gauss discretization method with this increment type, sliding-model control can be carried out to successive value.
If the information gain of that maximum attribute (number of times of game role generation action) of information gain, subtracts that second largest
The value of the information gain of attribute is more thanSo to maximum information gain, that is acted into line splitting, and right
Each splitting non-zero branch after discretization initializes an estimator.It is big by successive value interval division by using dichotomy
In split point and two parts less than or equal to split point.
Alternatively, in step S16, it is compared, is built by the information gain to each info class in multiple info class
Before detection model, step performed below can also be included：
Step S13, occupies ratio according to each info class in multiple info class, each info class is calculated respectively corresponding
Comentropy；
Step S14, the abnormal behaviour whether each info class is characterized as in game is set to Rule of judgment, calculates respectively
The corresponding conditional entropy of each info class；
Step S15, using the corresponding comentropy of each info class conditional entropy corresponding with each info class, calculates each letter
Cease the information gain of class.
In a preferred embodiment, the calculation of information gain is as follows：It is distributed for one, for example：One specific data
Collection includes three info class：A classes, B classes and C classes, the ratio that each classification is occupied are p (A)=0.2, p (B)=0.3, p
(C)=1-0.2-0.3=0.5, then comentropy H=- ∑sipilog(pi), i.e. 0.2log (0.2)+0.3log (0.3)+0.5log
(0.5)=0.301.Under normal conditions, entropy is smaller, and data set is more orderly.When data set only one of which classification, entropy is 0, this
It is the minimum value of entropy, represents that the data set is complete ordering.On this basis, also one conditional information entropy, and H (Y | X)=∑x∈Xp
(x) H (Y | X=x), for judging whether game role is plug-in game role, this conditional entropy be to specific action (for example：
In game enter copy number of times) divide one description.Difference H (X)-H (Y | X) of entropy before and after being divided for specific action
As information gain.
Alternatively, in step S162, the corresponding action data of first information class is set to the current structure of detection model
After element, step performed below can also be included：
Step S164, if determining that the action data included in multiple info class is distributed generation at element currently building
Change, then create the alternative model associated with detection model, wherein, alternative model includes：All generated in detection model
Build element.
If change detector (change detector) determines that data distribution changes.Assuming that there is currently action
A, action B and action C.If plug-in controlled game role, acted by will not all perform these three, and often
Select the consuming period and the high action of income is (for example：Action A) perform.But if being found game role to repeat
It is plug-in manipulate of being played to act A, then be likely to meet with title punishment.Start to control the game angle therefore, game is plug-in
Color repeats action B and action C, to reach the purpose for evading punishment.So, it is changed into repetition by repeating action A and is held
B and action C are made in action to cause data distribution to change.
If leaf node is not set alternatively, a replaceable tree T is created in leaf nodealt；Can if existed
Replace tree more accurate, then the leaf node 1 is just replaced with into replaceable tree Talt。
It should be noted that before the leaf node alternatively set is created, original tree section included with replaceable tree
Point content is identical, and since being created the leaf node alternatively set, it is original to set and alternatively set respective independent growths, its
In, both may include the node of identical content.
Alternatively, in step S164, the action data included in multiple info class is determined at currently structure element
Distribution changes and can include step performed below：
Step S1641, sliding window is added to by the corresponding action attributes value of every game role in several game roles,
Wherein, action attributes value represents whether the action performed by every game role is abnormal (for example：By plug-in manipulate of playing)；
Step S1642, Part I subwindow and Part II subwindow are divided into by sliding window；
Step S1643, when it is determined that the absolute value of the difference between the first parameter value and the second parameter value is more than or equal in advance
If during threshold value, persistently abandoning the newest data added to sliding window, and determine that action data distribution changes, until definitely
Value is less than predetermined threshold value, wherein, the first parameter value is the statistical average in Part I subwindow, and the second parameter value is second
Statistical average in the subwindow of part.
During implementing, sliding window W can be initialized first.What is included in each sliding window is by 0 and 1
The sequence of composition, wherein, 1 represents that corresponding characteristic vector is plug-in characteristic vector, and 0 represents that corresponding characteristic vector is normal special
Levy vector.Whenever getting a new characteristic vector, 0 or 1 just can be inserted in sliding window, so as to using in window
0 and 1 calculate variance with sum.
Then, any segmentation is carried out to sliding window W, to cause W=W0+W1, if condition can not be metThen need to abandon the corresponding action attributes value of last characteristic vector in sliding window, until
Meet above-mentioned condition
Wherein,(n0And n1Harmonic-mean), WithIt is
Statistical average in window W0 and W1, n0 and n1 represent the length of window.
Whenever getting a new characteristic vector, statistical information just can be updated, by dynamically adjusting sliding window
Size, to ensure that sliding window is as big as possible, and the data distribution in sliding window reaches unanimity.In addition, if in the presence of losing
The example abandoned, then just the data distribution changed can be notified to change detector.
Alternatively, in step S164, create after alternative model, step performed below can also be included：
Step S165, is compared using default Judging index to detection model and alternative model, wherein, default judgement refers to
Mark includes at least one of：Recall rate, accuracy rate；
Step S166, when result of determination shows that alternative model is better than detection model, then using alternative model to detection mould
Type is replaced.
Recall rate refers to that the plug-in quantity being correctly detected accounts for the ratio of all plug-in quantity that should be detected.It is false
If the quantity of the characteristic vector to be detected pre-set is 500, the quantity of normal characteristics vector is 420, plug-in characteristic vector
Quantity be 80, if the doubtful plug-in characteristic vector quantity finally detected be 100, wherein, 60 characteristic vectors are outer
Characteristic vector is hung, 40 characteristic vectors are plug-in characteristic vector, then recall rate is 60 and 80 ratio, i.e., 75%.
Accuracy rate refers to that the plug-in quantity being correctly detected accounts for the ratio for the plug-in quantity being actually detected.Assuming that pre-
The quantity of the characteristic vector to be detected first set is 500, and the quantity of normal characteristics vector is 420, the number of plug-in characteristic vector
Measure as 80, if the doubtful plug-in characteristic vector quantity finally detected is 100, then accuracy rate is 80 and 100 ratio
Value, i.e., 80%.
Quality between alternative model and detection model can be determined that by least one of recall rate and accuracy rate, and then
Determine the need for replacing detection model using alternative model.
Alternatively, in step S163, after determining next structure element to be generated, in addition to step performed below：
Step S167, obtains control command, wherein, control command is used to indicate to stop at next structure element to be generated
Only divide.
The effect divided if required up Stop node (i.e. next structure element to be generated), need to only judge division
Place sets a specified conditions so that judged result is false forever (equivalent to above-mentioned control command), you can stop division.
For example：It is 5 times in the number of times of the daily entrance copies of game role A, but is increased to suddenly 50 times in some periods, then the trip
The entrance copy operation played performed by role A is likely to be by plug-in manipulation of playing.But, if specific in order to meet
Red-letter day is (for example：The Spring Festival, National Day), game in exit particular bonus, for example：The probability increase of superfine product equipment is obtained in copy,
Or double empirical value can be obtained in copy, or be that rare BOSS is set in copy, then enter within the time period
The number of times for entering copy belongs to normal operating by the phenomenon that 5 times increase to 50 times suddenly, without continuing executing with splitting operation.
According to a wherein embodiment of the invention, a kind of embodiment of the construction device of detection model is additionally provided, Fig. 2 is root
According to the structured flowchart of the present invention wherein construction device of the detection model of an embodiment.As shown in Fig. 2 the device can include：
Acquisition module 10, for obtaining multiple info class from data to be verified, wherein, data to be verified are increased newly out of preset range
Daily record data in extract, multiple info class are used to determine detection model to be used, and detection model is used to detect in game
Abnormal behaviour；Module 20 is built, for being compared by the information gain to each info class in multiple info class, is built
Detection model.
Alternatively, acquisition module 10 includes：Extraction unit (not shown), for extracting daily record number from game server
According to；Acquiring unit (not shown), for data to be verified to be chosen from daily record data according to preparatory condition, wherein, treat school
Testing data includes：The polytype action data that the several game roles currently collected are performed under same time dimension, often
Type action data is respectively set to an info class.
Alternatively, building module 20 can include：Comparing unit (not shown), for by multiple info class
The information gain of each info class is compared, and chooses first information class and the second info class, wherein, the information of first information class
Gain is the maximum of the information gain of multiple info class, and the information gain of the second info class is the information gain of multiple info class
Second largest value；Processing unit (not shown), increases for the information gain when first information class and the information of the second info class
When the difference of benefit is more than predetermined threshold value, the corresponding action data of first information class is set to the current structure member of detection model
Element；Divide unit (not shown), for according to splitting condition corresponding with first information class, determining next structure to be generated
Element is built, comparing unit is returned.
Alternatively, Fig. 3 is the structured flowchart according to the present invention wherein construction device of the detection model of a preferred embodiment.
As shown in figure 3, said apparatus can also include：First computing module 30, for according to each info class in multiple info class
Occupy ratio, the corresponding comentropy of each info class is calculated respectively；Second computing module 40, for by each info class whether table
Levy and be set to Rule of judgment for the abnormal behaviour in game, the corresponding conditional entropy of each info class is calculated respectively；3rd calculates mould
Block 50, for using the corresponding comentropy of each info class conditional entropy corresponding with each info class, calculating each info class
Information gain.
Alternatively, processing unit, if being additionally operable at currently structure element determine moving included in multiple info class
Changed as data distribution, then create the alternative model associated with detection model, wherein, alternative model includes：Detection model
The structure element that middle whole has been generated.
Alternatively, processing unit can include：Add subelement (not shown), for will in several game roles it is every
The corresponding action attributes value of name game role is added to sliding window, wherein, action attributes value represents that every game role is held
Whether capable action is abnormal；Divide subelement (not shown), for by sliding window be divided into Part I subwindow and
Part II subwindow；Subelement (not shown) is handled, for when between the first parameter value of determination and the second parameter value
When the absolute value of difference is more than or equal to predetermined threshold value, the newest data added to sliding window are persistently abandoned, and determine action
Data distribution changes, until absolute value is less than predetermined threshold value, wherein, the first parameter value is the number in Part I subwindow
According to average value, the second parameter value is the statistical average in Part II subwindow.
Alternatively, building module 20 can also include：Comparing unit (not shown), for using default Judging index
Detection model and alternative model are compared, wherein, presetting Judging index includes at least one of：Recall rate, accuracy rate；
Replacement unit (not shown), for when result of determination shows that alternative model is better than detection model, then using alternative model
Detection model is replaced.
Alternatively, divide unit, be additionally operable to, it is determined that after next structure element to be generated, obtain control command, its
In, control command is used to indicate to stop division at next structure element to be generated.
According to a wherein embodiment of the invention, a kind of storage medium is additionally provided, storage medium includes the program of storage, its
In, equipment performs the construction method of above-mentioned detection model where controlling storage medium when program is run.Above-mentioned storage medium can
To include but is not limited to：USB flash disk, read-only storage (ROM), random access memory (RAM), mobile hard disk, magnetic disc or CD
Etc. it is various can be with the medium of store program codes.
According to a wherein embodiment of the invention, a kind of processor is additionally provided, processor is used for operation program, wherein, journey
The construction method of above-mentioned detection model is performed during sort run.Above-mentioned processor can include but is not limited to：Microprocessor (MCU) or
The processing unit of PLD (FPGA) etc..
According to a wherein embodiment of the invention, a kind of terminal is additionally provided, including：One or more processors, memory,
Display device and one or more programs, wherein, one or more programs are stored in memory, and be configured as by
One or more processors are performed, and program includes the construction method for being used to perform above-mentioned detection model.In certain embodiments, on
State terminal can be smart mobile phone (for example：Android phone, iOS mobile phones etc.), tablet personal computer, palm PC and mobile mutual
The terminal devices such as networked devices (Mobile Internet Devices, referred to as MID), PAD.Above-mentioned display device can be
The liquid crystal display (LCD) of touch-screen type, the liquid crystal display may be such that user can interact with the user interface of terminal.
In addition, above-mentioned terminal can also include：Input/output interface (I/O interfaces), USB (USB) port, network connect
Mouth, power supply and/or camera.
The embodiments of the present invention are for illustration only, and the quality of embodiment is not represented.
In the above embodiment of the present invention, the description to each embodiment all emphasizes particularly on different fields, and does not have in some embodiment
The part of detailed description, may refer to the associated description of other embodiment.
In several embodiments provided herein, it should be understood that disclosed technology contents, others can be passed through
Mode is realized.Wherein, device embodiment described above is only schematical, such as division of described unit, Ke Yiwei
A kind of division of logic function, can there is other dividing mode when actually realizing, such as multiple units or component can combine or
Person is desirably integrated into another system, or some features can be ignored, or does not perform.Another, shown or discussed is mutual
Between coupling or direct-coupling or communication connection can be the INDIRECT COUPLING or communication link of unit or module by some interfaces
Connect, can be electrical or other forms.
The unit illustrated as separating component can be or may not be it is physically separate, it is aobvious as unit
The part shown can be or may not be physical location, you can with positioned at a place, or can also be distributed to multiple
On unit.Some or all of unit therein can be selected to realize the purpose of this embodiment scheme according to the actual needs.
In addition, each functional unit in each embodiment of the invention can be integrated in a processing unit, can also
That unit is individually physically present, can also two or more units it is integrated in a unit.Above-mentioned integrated list
Member can both be realized in the form of hardware, it would however also be possible to employ the form of SFU software functional unit is realized.
If the integrated unit is realized using in the form of SFU software functional unit and as independent production marketing or used
When, it can be stored in a computer read/write memory medium.Understood based on such, technical scheme is substantially
The part contributed in other words to prior art or all or part of the technical scheme can be in the form of software products
Embody, the computer software product is stored in a storage medium, including some instructions are to cause a computer
Equipment (can for personal computer, server or network equipment etc.) perform each embodiment methods described of the invention whole or
Part steps.
Described above is only the preferred embodiment of the present invention, it is noted that for the ordinary skill people of the art
For member, under the premise without departing from the principles of the invention, some improvements and modifications can also be made, these improvements and modifications also should
It is considered as protection scope of the present invention.
Claims (19)
1. a kind of construction method of detection model, it is characterised in that including：
Multiple info class are obtained from data to be verified, wherein, the data to be verified are the daily records increased newly out of preset range
Extracting data, the multiple info class is used to determine detection model to be used, and the detection model, which is used to detect, plays
In abnormal behaviour；
It is compared by the information gain to each info class in the multiple info class, builds the detection model.
2. according to the method described in claim 1, it is characterised in that obtain the multiple info class from the data to be verified
Including：
The daily record data is extracted from game server；
The data to be verified are chosen from the daily record data according to preparatory condition, wherein, the data to be verified include：When
Before the polytype action data that is performed under same time dimension of the several game roles that collect, each type action data
It is respectively set to an info class.
3. method according to claim 2, it is characterised in that pass through the letter to each info class in the multiple info class
Breath gain is compared, and building the detection model includes：
Comparison step：It is compared by the information gain to each info class in the multiple info class, chooses the first information
Class and the second info class, wherein, the information gain of the first information class is the maximum of the information gain of the multiple info class
Value, the information gain of second info class is the second largest value of the information gain of the multiple info class；
Process step：When the information gain of the first information class is more than in advance with the difference of the information gain of second info class
If during threshold value, the corresponding action data of the first information class to be set to the current structure element of the detection model；
Step toward division：According to splitting condition corresponding with the first information class, next structure element to be generated is determined, is returned
The comparison step.
4. method according to claim 3, it is characterised in that each info class in by the multiple info class
Information gain is compared, before the structure detection model, in addition to：
Ratio is occupied according to each info class in the multiple info class, the corresponding comentropy of each info class is calculated respectively；
The abnormal behaviour whether each info class is characterized as in game is set to Rule of judgment, and each info class pair is calculated respectively
The conditional entropy answered；
Using the corresponding comentropy of each info class conditional entropy corresponding with each info class, the information for calculating each info class increases
Benefit.
5. method according to claim 3, it is characterised in that the process step also includes：
If determining that the action data distribution included in the multiple info class changes at element in current build,
The alternative model associated with the detection model is then created, wherein, the alternative model includes：In the detection model all
The structure element of generation.
6. method according to claim 5, it is characterised in that determine the multiple information at the current structure element
Included in class action data distribution change including：
The corresponding action attributes value of every game role in the several game roles is added to sliding window, wherein, it is described
Action attributes value represents whether the action performed by every game role is abnormal；
The sliding window is divided into Part I subwindow and Part II subwindow；
When it is determined that the absolute value of the difference between the first parameter value and the second parameter value is more than or equal to predetermined threshold value, persistently lose
The newest data added to the sliding window are abandoned, and determine that the action data distribution changes, until the absolute value
Less than the predetermined threshold value, wherein, first parameter value is the statistical average in the Part I subwindow, described the
Two parameter values are the statistical average in the Part II subwindow.
7. method according to claim 5, it is characterised in that after the alternative model is created, in addition to：
The detection model and the alternative model are compared using default Judging index, wherein, the default judgement refers to
Mark includes at least one of：Recall rate, accuracy rate；
When result of determination shows that the alternative model is better than the detection model, then using the alternative model to the detection
Model is replaced.
8. method according to claim 3, it is characterised in that the step toward division also includes：
It is determined that after the next structure element to be generated, control command is obtained, wherein, the control command is used to indicate
Stop division at the next structure element to be generated.
9. a kind of construction device of detection model, it is characterised in that including：
Acquisition module, for obtaining multiple info class from data to be verified, wherein, the data to be verified are from preset range
Extracted in interior newly-increased daily record data, the multiple info class is used to determine detection model to be used, the detection model
For detecting the abnormal behaviour in game；
Module is built, for being compared by the information gain to each info class in the multiple info class, is built described
Detection model.
10. device according to claim 9, it is characterised in that the acquisition module includes：
Extraction unit, for extracting the daily record data from game server；
Acquiring unit, for choosing the data to be verified from the daily record data according to preparatory condition, wherein, it is described to treat school
Testing data includes：The polytype action data that the several game roles currently collected are performed under same time dimension, often
Type action data is respectively set to an info class.
11. device according to claim 10, it is characterised in that the structure module includes：
Comparing unit, for being compared by the information gain to each info class in the multiple info class, chooses first
Info class and the second info class, wherein, the information gain of the first information class is the information gain of the multiple info class
Maximum, the information gain of second info class is the second largest value of the information gain of the multiple info class；
Processing unit, the difference for the information gain when the first information class and the information gain of second info class is big
When predetermined threshold value, the corresponding action data of the first information class is set to the current structure element of the detection model；
Divide unit, for according to splitting condition corresponding with the first information class, determining next structure element to be generated,
Return to the comparing unit.
12. device according to claim 11, it is characterised in that described device also includes：
First computing module, for occupying ratio according to each info class in the multiple info class, calculates each letter respectively
Cease the corresponding comentropy of class；
Second computing module, the abnormal behaviour for whether each info class to be characterized as in game is set to Rule of judgment, point
The corresponding conditional entropy of each info class is not calculated；
3rd computing module, for using the corresponding comentropy of each info class conditional entropy corresponding with each info class, calculating
The information gain of each info class.
13. device according to claim 11, it is characterised in that the processing unit, if be additionally operable to described current
Build and determine that the action data distribution included in the multiple info class changes at element, then create and the detection mould
The alternative model of type association, wherein, the alternative model includes：The structure element all generated in the detection model.
14. device according to claim 13, it is characterised in that the processing unit includes：
Subelement is added, is slided for the corresponding action attributes value of every game role in the several game roles to be added to
Window, wherein, the action attributes value represents whether the action performed by every game role is abnormal；
Subelement is divided, for the sliding window to be divided into Part I subwindow and Part II subwindow；
Subelement is handled, for being more than or equal in advance when the absolute value for determining the difference between the first parameter value and the second parameter value
If during threshold value, persistently abandoning the newest data added to the sliding window, and determine that the action data distribution changes,
Until the absolute value is less than the predetermined threshold value, wherein, first parameter value is the number in the Part I subwindow
According to average value, second parameter value is the statistical average in the Part II subwindow.
15. device according to claim 13, it is characterised in that the structure module also includes：
Comparing unit, for being compared using default Judging index to the detection model and the alternative model, wherein, institute
Stating default Judging index includes at least one of：Recall rate, accuracy rate；
Replacement unit, for when result of determination shows that the alternative model is better than the detection model, then being substituted using described
Model is replaced to the detection model.
16. device according to claim 11, it is characterised in that the division unit, is additionally operable to it is determined that described next
After structure element to be generated, control command is obtained, wherein, the control command is used to indicate described next to be generated
Build and stop division at element.
17. a kind of storage medium, it is characterised in that the storage medium includes the program of storage, wherein, in described program operation
When control the storage medium where detection model in equipment perform claim requirement 1 to 8 described in any one construction method.
18. a kind of processor, it is characterised in that the processor is used for operation program, wherein, right of execution when described program is run
Profit requires the construction method of the detection model described in any one in 1 to 8.
19. a kind of terminal, it is characterised in that including：One or more processors, memory, display device and one or many
Individual program, wherein, one or more of programs are stored in the memory, and are configured as by one or many
Individual computing device, one or more of programs include being used for the detection mould in perform claim requirement 1 to 8 described in any one
The construction method of type.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710576568.1A CN107281755B (en) | 2017-07-14 | 2017-07-14 | Detection model construction method and device, storage medium and terminal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201710576568.1A CN107281755B (en) | 2017-07-14 | 2017-07-14 | Detection model construction method and device, storage medium and terminal |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN107281755A true CN107281755A (en) | 2017-10-24 |
| CN107281755B CN107281755B (en) | 2020-05-05 |
Family
ID=60101919
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201710576568.1A Active CN107281755B (en) | 2017-07-14 | 2017-07-14 | Detection model construction method and device, storage medium and terminal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN107281755B (en) |
Cited By (17)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107820118A (en) * | 2017-11-17 | 2018-03-20 | 杭州电魂网络科技股份有限公司 | Game video recording, player method and device |
| CN107866072A (en) * | 2017-10-31 | 2018-04-03 | 浙江大学 | A kind of system that plug-in detection is carried out using increment decision-making tree |
| CN108366048A (en) * | 2018-01-10 | 2018-08-03 | 南京邮电大学 | A kind of network inbreak detection method based on unsupervised learning |
| CN108647720A (en) * | 2018-05-10 | 2018-10-12 | 上海扩博智能技术有限公司 | Iterative cycles recognition methods, system, equipment and the storage medium of commodity image |
| CN108744522A (en) * | 2018-05-23 | 2018-11-06 | 福州趣乐互动科技有限公司 | A kind of player's behaviour control method, terminal and storage medium based on mobile platform game |
| CN108905210A (en) * | 2018-07-24 | 2018-11-30 | 合肥爱玩动漫有限公司 | A kind of method of quick detection game studios |
| CN109091869A (en) * | 2018-08-10 | 2018-12-28 | 腾讯科技（深圳）有限公司 | Method of controlling operation, device, computer equipment and the storage medium of virtual objects |
| CN109304034A (en) * | 2018-10-25 | 2019-02-05 | 珠海市君天电子科技有限公司 | A kind of game cheat detection method and relevant device |
| CN109464807A (en) * | 2018-11-06 | 2019-03-15 | 网易（杭州）网络有限公司 | Detect game plug-in method, apparatus and terminal |
| CN109464808A (en) * | 2018-11-06 | 2019-03-15 | 网易（杭州）网络有限公司 | Detect game plug-in method, apparatus and terminal |
| CN109858549A (en) * | 2019-01-30 | 2019-06-07 | 腾讯科技（深圳）有限公司 | Training method, device and the medium of application identification and its identification model |
| CN110046102A (en) * | 2019-04-19 | 2019-07-23 | 深圳市腾讯网域计算机网络有限公司 | Balance detection method, device, equipment and the storage medium of virtual weapons |
| CN110201394A (en) * | 2019-06-05 | 2019-09-06 | 网易（杭州）网络有限公司 | Generation method, device, storage medium, processor and the terminal of accessory model |
| CN110287048A (en) * | 2019-05-09 | 2019-09-27 | 清华大学 | Data exception detection method and device |
| CN110393913A (en) * | 2019-07-26 | 2019-11-01 | 成都龙渊网络科技有限公司 | A kind of method and apparatus executing user's operation on touching terminal |
| CN112370793A (en) * | 2020-11-25 | 2021-02-19 | 上海幻电信息科技有限公司 | Risk control method and device for user account |
| CN115391084A (en) * | 2022-10-27 | 2022-11-25 | 北京蔚领时代科技有限公司 | Intelligent solution method and system for cloud game abnormity |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2007267876A (en) * | 2006-03-30 | 2007-10-18 | Namco Bandai Games Inc | Program, information storage medium, game device and game device management mechanism |
| CN101187959A (en) * | 2006-11-17 | 2008-05-28 | 中兴通讯股份有限公司 | Game cheat detection method based on decision tree |
| US20130343619A1 (en) * | 2012-06-21 | 2013-12-26 | Microsoft Corporation | Density estimation and/or manifold learning |
| CN106603538A (en) * | 2016-12-20 | 2017-04-26 | 北京安信天行科技有限公司 | Invasion detection method and system |
| CN106612202A (en) * | 2015-10-27 | 2017-05-03 | 网易（杭州）网络有限公司 | Method and system for pre-estimate and judgment of amount brushing of online game channel |
| CN106612216A (en) * | 2015-10-27 | 2017-05-03 | 北京国双科技有限公司 | Method and apparatus of detecting website access exception |
-
2017
- 2017-07-14 CN CN201710576568.1A patent/CN107281755B/en active Active
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2007267876A (en) * | 2006-03-30 | 2007-10-18 | Namco Bandai Games Inc | Program, information storage medium, game device and game device management mechanism |
| CN101187959A (en) * | 2006-11-17 | 2008-05-28 | 中兴通讯股份有限公司 | Game cheat detection method based on decision tree |
| US20130343619A1 (en) * | 2012-06-21 | 2013-12-26 | Microsoft Corporation | Density estimation and/or manifold learning |
| CN106612202A (en) * | 2015-10-27 | 2017-05-03 | 网易（杭州）网络有限公司 | Method and system for pre-estimate and judgment of amount brushing of online game channel |
| CN106612216A (en) * | 2015-10-27 | 2017-05-03 | 北京国双科技有限公司 | Method and apparatus of detecting website access exception |
| CN106603538A (en) * | 2016-12-20 | 2017-04-26 | 北京安信天行科技有限公司 | Invasion detection method and system |
Cited By (20)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107866072A (en) * | 2017-10-31 | 2018-04-03 | 浙江大学 | A kind of system that plug-in detection is carried out using increment decision-making tree |
| CN107820118B (en) * | 2017-11-17 | 2020-01-10 | 杭州电魂网络科技股份有限公司 | Game video recording and playing method and device |
| CN107820118A (en) * | 2017-11-17 | 2018-03-20 | 杭州电魂网络科技股份有限公司 | Game video recording, player method and device |
| CN108366048A (en) * | 2018-01-10 | 2018-08-03 | 南京邮电大学 | A kind of network inbreak detection method based on unsupervised learning |
| CN108366048B (en) * | 2018-01-10 | 2021-01-12 | 南京邮电大学 | Network intrusion detection method based on unsupervised learning |
| CN108647720A (en) * | 2018-05-10 | 2018-10-12 | 上海扩博智能技术有限公司 | Iterative cycles recognition methods, system, equipment and the storage medium of commodity image |
| CN108744522A (en) * | 2018-05-23 | 2018-11-06 | 福州趣乐互动科技有限公司 | A kind of player's behaviour control method, terminal and storage medium based on mobile platform game |
| CN108905210A (en) * | 2018-07-24 | 2018-11-30 | 合肥爱玩动漫有限公司 | A kind of method of quick detection game studios |
| CN109091869A (en) * | 2018-08-10 | 2018-12-28 | 腾讯科技（深圳）有限公司 | Method of controlling operation, device, computer equipment and the storage medium of virtual objects |
| CN109304034A (en) * | 2018-10-25 | 2019-02-05 | 珠海市君天电子科技有限公司 | A kind of game cheat detection method and relevant device |
| CN109464807A (en) * | 2018-11-06 | 2019-03-15 | 网易（杭州）网络有限公司 | Detect game plug-in method, apparatus and terminal |
| CN109464808A (en) * | 2018-11-06 | 2019-03-15 | 网易（杭州）网络有限公司 | Detect game plug-in method, apparatus and terminal |
| CN109858549A (en) * | 2019-01-30 | 2019-06-07 | 腾讯科技（深圳）有限公司 | Training method, device and the medium of application identification and its identification model |
| CN110046102A (en) * | 2019-04-19 | 2019-07-23 | 深圳市腾讯网域计算机网络有限公司 | Balance detection method, device, equipment and the storage medium of virtual weapons |
| CN110287048A (en) * | 2019-05-09 | 2019-09-27 | 清华大学 | Data exception detection method and device |
| CN110201394A (en) * | 2019-06-05 | 2019-09-06 | 网易（杭州）网络有限公司 | Generation method, device, storage medium, processor and the terminal of accessory model |
| CN110201394B (en) * | 2019-06-05 | 2023-03-24 | 网易（杭州）网络有限公司 | Generation method and device of accessory model, storage medium, processor and terminal |
| CN110393913A (en) * | 2019-07-26 | 2019-11-01 | 成都龙渊网络科技有限公司 | A kind of method and apparatus executing user's operation on touching terminal |
| CN112370793A (en) * | 2020-11-25 | 2021-02-19 | 上海幻电信息科技有限公司 | Risk control method and device for user account |
| CN115391084A (en) * | 2022-10-27 | 2022-11-25 | 北京蔚领时代科技有限公司 | Intelligent solution method and system for cloud game abnormity |
Also Published As
| Publication number | Publication date |
|---|---|
| CN107281755B (en) | 2020-05-05 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107281755A (en) | Construction method, device, storage medium, processor and the terminal of detection model | |
| Rahman et al. | A decision tree-based missing value imputation technique for data pre-processing | |
| CN106453357A (en) | Network ticket buying abnormal behavior recognition method and system and equipment | |
| CN103905532B (en) | The recognition methods of microblogging marketing account and system | |
| CN108874832A (en) | Target, which is commented on, determines method and device | |
| CN109464807A (en) | Detect game plug-in method, apparatus and terminal | |
| CN106446078A (en) | Information recommendation method and recommendation apparatus | |
| CN105302911A (en) | Data screening engine establishing method and data screening engine | |
| TW201939400A (en) | Method and device for determining group of target users | |
| CN104866699B (en) | A kind of online game intelligent data analysis method | |
| CN108009249A (en) | For the comment spam filter method of the fusion user behavior rule of unbalanced data | |
| CN103299304A (en) | Classification rule generation device, classification rule generation method, classification rule generation program and recording medium | |
| CN109767269A (en) | A kind for the treatment of method and apparatus of game data | |
| CN110046196A (en) | Identify correlating method and device, electronic equipment | |
| CN111510783B (en) | Method, device, electronic equipment and storage medium for determining video exposure | |
| CN108304853A (en) | Acquisition methods, device, storage medium and the electronic device for the degree of correlation of playing | |
| CN109272009A (en) | A kind of crowd portrayal extracting method and device based on big data analysis | |
| Ethayarajh et al. | Information-theoretic measures of dataset difficulty | |
| JP7256766B2 (en) | Inference basis analysis device and inference basis analysis method | |
| CN112587932A (en) | Game plug-in detection method and device, electronic equipment and storage medium | |
| CN106600432B (en) | Inter-behavior influence evaluation method and device based on social attribute behavior data | |
| Barrero et al. | On the statistical distribution of the expected run-time in population-based search algorithms | |
| Yu et al. | Detecting of PIU behaviors based on discovered generators and emerging patterns from computer-mediated interaction events | |
| JP6306951B2 (en) | Classification method and system of noise posting in social network service | |
| Šimović et al. | Classifying the Variety of Customers’ Online Engagement for Churn Prediction with a Mixed-Penalty Logistic Regression |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |