CN109464807A - Detect game plug-in method, apparatus and terminal - Google Patents
Detect game plug-in method, apparatus and terminal Download PDFInfo
- Publication number
- CN109464807A CN109464807A CN201811315157.8A CN201811315157A CN109464807A CN 109464807 A CN109464807 A CN 109464807A CN 201811315157 A CN201811315157 A CN 201811315157A CN 109464807 A CN109464807 A CN 109464807A
- Authority
- CN
- China
- Prior art keywords
- measured
- suspicious degree
- plug
- game
- data
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
- A63F13/70—Game security or game management aspects
- A63F13/75—Enforcing rules, e.g. detecting foul play or generating lists of cheating players
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F13/00—Video games, i.e. games using an electronically generated display having two or more dimensions
- A63F13/80—Special adaptations for executing a specific game genre or game mode
- A63F13/822—Strategy games; Role-playing games
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F2300/00—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game
- A63F2300/50—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers
- A63F2300/55—Details of game data or player data management
- A63F2300/5586—Details of game data or player data management for enforcing rights or rules, e.g. to prevent foul play
-
- A—HUMAN NECESSITIES
- A63—SPORTS; GAMES; AMUSEMENTS
- A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
- A63F2300/00—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game
- A63F2300/80—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game specially adapted for executing a specific type of game
- A63F2300/807—Role playing or strategy games
Landscapes
- Engineering & Computer Science (AREA)
- Multimedia (AREA)
- Business, Economics & Management (AREA)
- Computer Security & Cryptography (AREA)
- General Business, Economics & Management (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The invention discloses a kind of method, apparatus and terminal that detection game is plug-in.Wherein, this method comprises: obtaining the testing data of object to be measured；Testing data is detected based on multiple unsupervised learning models, obtains multiple characterization vectors corresponding with multiple unsupervised learning models, wherein multiple unsupervised learning models obtain multiple characterization vectors for being trained to the data of multiple objects；Clustering processing is carried out to multiple characterization vectors from default dimension, obtains cluster result；Suspicious degree corresponding with default dimension is obtained according to cluster result；Judge whether object to be measured is exception object according to suspicious degree corresponding with default dimension, wherein exception object has plug-in behavior.The present invention solves the lower technical problem of the plug-in accuracy of prior art detection game.
Description
Technical field
The present invention relates to computer fields, in particular to a kind of method, apparatus and terminal that detection game is plug-in.
Background technique
It is cheating program by cheating or modifying game to speculate that game is plug-in.Game is plug-in to have a variety of kinds
Class, for MMORPG (Massively Multiplayer Online Role Playing Games, Massive Multiplayer Online Role
The abbreviation of Playing Game) for, automatic extension is the first concern object of the plug-in testing staff of game, wherein automatic hang can
The operations such as player is automatically performed task, brush blames, upgrades, collects money from the audience are realized by procedure script, and are carried out money transfer and collected.Thus
As it can be seen that automatic hang the balance for seriously destroying the game ecosphere, the fairness and playability of game are reduced.
Game is plug-in to be usually considered as maximum enemy by game operation, and there are mainly four types of traditional plug-in detection modes:
Mode one: it is plug-in to detect game by game process, and whether mainly detection game client opens black name
It is plug-in to can determine that the client is equipped with if client opens the plug-in process in blacklist for plug-in process in list.
However, in this approach, plug-in developer quickly can modify and hide to the plug-in process of client, so that plug-in inspection
Survey personnel are not easy to detect plug-in.
Mode two: statistics and analysis is carried out come the game behavior to player using empirical features, rule of thumb feature is to object for appreciation
Family is interrogated and examined.However, in this approach, human cost is relatively high, while plug-in feature often changes, and experience is special
Levy regular failure.
Mode three: by detecting client screen, externally hung software window on screen is identified.However, in this approach, outside
It hangs player and is good at hiding externally hung software window, it is plug-in so as to cause that can not detect.
Mode four: the method based on conventional machines study is detected to plug-in.However, being first mostly in this approach
Manual extraction feature, then carry out subsequent modeling, the feature extracted can not expressed intact player's behavior, be also beyond expression in timing
Complete information.
For the lower problem of the plug-in accuracy of above-mentioned prior art detection game, effective solution is not yet proposed at present
Scheme.
Summary of the invention
The embodiment of the invention provides a kind of method, apparatus and terminal that detection game is plug-in, at least to solve existing skill
Art detects the lower technical problem of the plug-in accuracy of game.
According to an aspect of an embodiment of the present invention, a kind of method that detection game is plug-in is provided, comprising: obtain to be measured
The testing data of object；Testing data is detected based on multiple unsupervised learning models, is obtained and multiple unsupervised learnings
The corresponding multiple characterization vectors of model, wherein multiple unsupervised learning models are obtained for being trained to the data of multiple objects
To multiple characterization vectors；Clustering processing is carried out to multiple characterization vectors from default dimension, obtains cluster result；According to cluster result
Obtain suspicious degree corresponding with default dimension；Judge whether object to be measured is abnormal right according to suspicious degree corresponding with default dimension
As, wherein exception object has plug-in behavior.
According to another aspect of an embodiment of the present invention, a kind of device that detection game is plug-in is additionally provided, comprising: obtain mould
Block, for obtaining the testing data of object to be measured；Detection module, for based on multiple unsupervised learning models to testing data into
Row detection, obtains multiple characterization vectors corresponding with multiple unsupervised learning models, wherein multiple unsupervised learning models are used for
The data of multiple objects are trained, multiple characterization vectors are obtained；Cluster module, for from default dimension to it is multiple characterize to
Amount carries out clustering processing, obtains cluster result；Processing module, for obtaining suspection corresponding with default dimension according to cluster result
Degree；Judgment module, for judging whether object to be measured is exception object according to suspicious degree corresponding with default dimension, wherein different
Normal object has plug-in behavior.
According to another aspect of an embodiment of the present invention, a kind of terminal that detection game is plug-in is additionally provided, comprising: processing
Device detects testing data for obtaining the testing data of object to be measured, and based on multiple unsupervised learning models, obtains
Then multiple characterization vectors corresponding with multiple unsupervised learning models carry out from cluster multiple characterization vectors from default dimension
Reason, obtains cluster result, and obtain suspicious degree corresponding with default dimension according to cluster result, last basis and default dimension pair
The suspicious degree answered judges whether object to be measured is exception object, wherein exception object has plug-in behavior, multiple unsupervised learnings
Model obtains multiple characterization vectors for being trained to the data of multiple objects；Display, for showing pair of exception object
Image information.
According to another aspect of an embodiment of the present invention, a kind of storage medium is additionally provided, which includes storage
Program, wherein program executes the plug-in method of detection game.
According to another aspect of an embodiment of the present invention, a kind of processor is additionally provided, which is used to run program,
In, detection game plug-in method is executed when program is run.
In embodiments of the present invention, by the way of unsupervised learning, by obtaining the testing data of object to be measured, then
Testing data is detected based on multiple unsupervised learning models, obtains multiple tables corresponding with multiple unsupervised learning models
Vector is levied, and clustering processing is carried out to multiple characterization vectors from default dimension, obtains cluster result.Then, according to cluster result
Suspicious degree corresponding with default dimension is obtained, and judges whether object to be measured is abnormal according to suspicious degree corresponding with default dimension
Object, wherein exception object has plug-in behavior, and multiple unsupervised learning models are for instructing the data of multiple objects
Practice, obtains multiple characterization vectors.
In above process, using the method for unsupervised learning, the testing data of object to be measured is passed through into multiple nothings respectively
Supervised learning model finally clusters multiple characterization vectors from default dimension to obtain multiple characterization vectors, and according to
Cluster result obtains suspicious degree, improves the plug-in accuracy of detection game.In addition, during detection game is plug-in, nothing
It needs manpower to participate in, reduces artificial participation, release manpower, reduce the error caused by artificial incorrect operation, improve
Game plug-in detection efficiency.
It can be seen that scheme provided herein can solve the prior art detection game it is plug-in accuracy it is lower
Technical problem.
Detailed description of the invention
The drawings described herein are used to provide a further understanding of the present invention, constitutes part of this application, this hair
Bright illustrative embodiments and their description are used to explain the present invention, and are not constituted improper limitations of the present invention.In the accompanying drawings:
Fig. 1 is a kind of method flow diagram that detection game is plug-in according to an embodiment of the present invention；
Fig. 2 is a kind of frame diagram of optional Mission Objective according to an embodiment of the present invention；
Fig. 3 is a kind of structural schematic diagram of optional detection terminal according to an embodiment of the present invention；
Fig. 4 is a kind of optional schematic diagram for obtaining testing data according to an embodiment of the present invention；
Fig. 5 is a kind of apparatus structure schematic diagram that detection game is plug-in according to an embodiment of the present invention；And
Fig. 6 is a kind of schematic diagram of optional Seq2vec model according to an embodiment of the present invention.
Specific embodiment
In order to enable those skilled in the art to better understand the solution of the present invention, below in conjunction in the embodiment of the present invention
Attached drawing, technical scheme in the embodiment of the invention is clearly and completely described, it is clear that described embodiment is only
The embodiment of a part of the invention, instead of all the embodiments.Based on the embodiments of the present invention, ordinary skill people
The model that the present invention protects all should belong in member's every other embodiment obtained without making creative work
It encloses.
It should be noted that description and claims of this specification and term " first " in above-mentioned attached drawing, "
Two " etc. be to be used to distinguish similar objects, without being used to describe a particular order or precedence order.It should be understood that using in this way
Data be interchangeable under appropriate circumstances, so as to the embodiment of the present invention described herein can in addition to illustrating herein or
Sequence other than those of description is implemented.In addition, term " includes " and " having " and their any deformation, it is intended that cover
Cover it is non-exclusive include, for example, the process, method, system, product or equipment for containing a series of steps or units are not necessarily limited to
Step or unit those of is clearly listed, but may include be not clearly listed or for these process, methods, product
Or other step or units that equipment is intrinsic.
Embodiment 1
According to embodiments of the present invention, a kind of embodiment of the method that detection game is plug-in is provided, it should be noted that attached
The step of process of figure illustrates can execute in a computer system such as a set of computer executable instructions, though also,
So logical order is shown in flow charts, but in some cases, it can be to be different from shown by sequence execution herein
Or the step of description.
Fig. 1 is the plug-in method flow diagram of detection game according to an embodiment of the present invention, as shown in Figure 1, this method includes
Following steps:
Step S102 obtains the testing data of object to be measured.
In step s 102, object to be measured is game client, and testing data is game when game client is run, trip
Play client log generated.
Optionally, the plug-in detection terminal of detection game can obtain testing data by the log of game client,
In, the case where log recording of game client game client completes Mission Objective.At (the Massively Multiplayer Online angle MMORPG
Color game for play, the abbreviation of Massive Multiplayer Online Role Playing Game) in game, in MMORPG
Task dividable be three classes, i.e. main line task (Main quest), everyday tasks (Dailyquest) and scene task
(Instancedquest).Wherein, aim at client day generated when game running in different types of task comprising difference
Content.
Specifically, the frame diagram of Mission Objective as shown in Figure 2, as shown in Figure 2, in main line task, player is being created
After account, a series of main line plot is needed to complete in main line map to unlock subsequent branch line task.Normal player is usual
It can be attracted by main line plot, to complete the Mission Objective in entire main line map.In main line task, log includes interior
Holding can be but be not limited to complete in main line map the time of Mission Objective, the time of game ratings upgrading etc..However, outside game
Extension can carry out main line task automatically, and after creating account, a large amount of to obtain by completing main line task in main line map
Game money, and reach the game money that will build up on after a certain specific grade in game ratings and produce.
Everyday tasks refer to the repetitive task that can be carried out daily in game, since everyday tasks do not have uniqueness,
Cause, the reward obtained by everyday tasks be not usually high.In addition, everyday tasks would generally give one accumulabile object of player
Product, when article reaches certain amount, article can be exchanged into corresponding reward by player.Everyday tasks can allow player to produce game
The raw idea logined daily, extends the life cycle of game.In everyday tasks, the content that log includes can be but be not limited to
The time of everyday tasks, the quantity for completing everyday tasks etc. are completed daily.However, plug-in can complete these by automatic script
Everyday tasks in daily map publish game, and therefrom earn experience and money.
Scene task is usually completely self-contained task, field in team semi-independent, in task on the basis of game itself
Scape task can usually favorably accomplish under team's cooperation, coordination.Task in scene map is usually to pass through in game more
The task with more money is tested, in scene task, the content that log includes can be but be not limited to complete the time of scene task
Deng.However, hanging over outside into after scene, the scene task that can be automatically performed in scene map, for example, killing strange and earning automatically
Money causes unfairness to other players.
Step S104 detects testing data based on multiple unsupervised learning models, obtains and multiple unsupervised
Practise the corresponding multiple characterization vectors of model, wherein multiple unsupervised learning models are used to be trained the data of multiple objects,
Obtain multiple characterization vectors.
It should be noted that multiple unsupervised learning models can include but is not limited to LSTM (Long in step S104
Short-Term Memory, a kind of shot and long term memory, improvement network of Recognition with Recurrent Neural Network), (one kind is for by sequence by seq2vec
Column are mapped to the algorithm of vector), seq2topic (a kind of for sequence to be mapped to the algorithm of theme probability vector) and
Sequence Autoencoder (a kind of autocoder for Sequence Learning).
In a kind of optional scheme, the structural schematic diagram of terminal is detected as shown in figure 3, from the figure 3, it may be seen that detection terminal packet
Include detection trigger module, behavior characterization module, Distributed Cluster module, group's suspicious degree analysis module and plug-in label mould
Block.Wherein, detection trigger module obtains number to be measured for detecting to the behavioral data (i.e. above-mentioned log) of object to be measured
According to；Behavior characterization module is used to carry out representative learning to the behavior sequence (or behavioral data, i.e., above-mentioned log) of game player,
Multiple characterization vectors are obtained, i.e. behavior characterization module executes above-mentioned steps S104；Distributed Cluster module is used in Spark frame
Lower to carry out Distributed Cluster using multiple characterization vectors, i.e. Distributed Cluster module executes above-mentioned steps S106；Group's suspicious degree
The cluster result that analysis module obtains Distributed Cluster module is analyzed, and multiple suspicious degrees, i.e. group's suspicious degree point are obtained
It analyses module and executes step S108；Plug-in mark module determines to be measured according to multiple suspicious degrees that group's suspicious degree analysis module obtains
Whether object is exception object, i.e., plug-in mark module executes step S110.
Step S106 carries out clustering processing to multiple characterization vectors from default dimension, obtains cluster result.
It should be noted that in this application Distributed Cluster module can be used DBSCAN algorithm to characterization vector gather
Class processing.It is easily noted that, Distributed Cluster module is clustered using distributed algorithm DBSCAN algorithm, can be effective
The problem of for solution non-distributed clustering algorithm when carrying out clustering processing, time-consuming, occupies a large amount of CPU memories.
Step S108 obtains suspicious degree corresponding with default dimension according to cluster result.
It should be noted that default dimension include at least it is one of following: synteny dimension, modeling dimension, numerical dimension,
Protectiveness dimension and complementary dimension, suspicious degree corresponding with default dimension include at least one of following: synteny suspicious degree,
Model suspicious degree, numerical suspicious degree, protectiveness suspicious degree and complementary suspicious degree.Wherein, the processing of different dimensions is multiple
Different data in classification results, for example, master to be processed is to be measured right in multiple classification results in synteny dimension direction
The network address information (i.e. IP address) of the hardware information of elephant and object to be measured.
Step S110 judges whether object to be measured is exception object according to suspicious degree corresponding with default dimension, wherein different
Normal object has plug-in behavior.
It should be noted that after having obtained suspicious degree corresponding with default dimension, plug-in mark module is to obtaining
Multiple suspicious degrees carry out COMPREHENSIVE CALCULATING, and are ranked up.Then by calculated result and ranking results in the front end of detection terminal
(for example, display screen) is shown.Operation team (the plug-in personnel of detection game) is outer to being judged to having according to displaying result
The game player of extension behavior is marked.
Based on scheme defined by above-mentioned steps S102 to step S110, can know, by the way of unsupervised learning,
By obtaining the testing data of object to be measured, it is then based on multiple unsupervised learning models and testing data is detected, obtain
Multiple characterization vectors corresponding with multiple unsupervised learning models, and multiple characterization vectors are carried out from cluster from default dimension
Reason, obtains cluster result.Then, suspicious degree corresponding with default dimension is obtained according to cluster result, and according to default dimension
Corresponding suspicious degree judges whether object to be measured is exception object, wherein exception object has plug-in behavior, multiple unsupervised
Model is practised for being trained to the data of multiple objects, obtains multiple characterization vectors.
In above process, using the method for unsupervised learning, the testing data of object to be measured is passed through into multiple nothings respectively
Supervised learning model finally clusters multiple characterization vectors from default dimension to obtain multiple characterization vectors, and according to
Cluster result obtains suspicious degree, improves the plug-in accuracy of detection game.In addition, during detection game is plug-in, nothing
It needs manpower to participate in, reduces artificial participation, release manpower, reduce the error caused by artificial incorrect operation, improve
Game plug-in detection efficiency.
It can be seen that scheme provided herein can solve the prior art detection game it is plug-in accuracy it is lower
Technical problem.
In a kind of optional scheme, the testing data for obtaining object to be measured be may include steps of:
Step S1020 obtains the behavioral data of object to be measured, wherein game visitor when behavioral data can be running game
Family end games log generated；
Step S1022, selection meets the data of at least one trigger condition in subordinate act data；
Step S1024 determines the corresponding triggering type of at least one trigger condition；
Step S1026 determines testing data according to triggering type from the data for meet at least one trigger condition.
Specifically, the schematic diagram of acquisition testing data as shown in Figure 4 detects trigger mode after obtaining games log
Block analyzes games log, determines the triggering type of the corresponding trigger condition of games log, wherein at least one triggering item
The corresponding triggering type of part includes at least one following: grade trigger condition, time trigger condition and scenario triggered condition.Example
Such as, the grade of recording game player has reached 35 grades in games log, is greater than 30 grades, meets grade trigger condition, then detect touching
It sends out module and the grade based on game player is extracted into testing data in the segmentation stage.
It should be noted that in above process, detection trigger module is segmented behavioral data in the segmentation stage, with
Extracted valid data constructs the training set of high quality.Wherein, for different types of Mission Objective, using as shown in Figure 4
Three kinds of segmentation methods.Specifically, main line task is unfolded since main line plot is the raising with player levels, and
And plug-in generally game money produced after grade reaches 30 grades.Therefore, detection trigger module is according to player levels come to object for appreciation
Family's game behavior sequence is truncated, for example, only take the behavioral data of grade player between 1-30 grades as testing data,
In, it can be segmented according to 1-5,1-10,1-15,1-20,1-25,1-30 etc. grade.For everyday tasks, due to everyday tasks
It is the same task all repeated daily, therefore, detection trigger module chooses the behavioral data of player one day (i.e. 24 hours),
And it is segmented to obtain testing data by date.For scene task, detect trigger module only take player after entering scene,
The behavioral data before scene is left, behavior data contain the most information of scene task.
In a kind of optional scheme, detection trigger module can be by selecting to meet at least one following subordinate act data
The data of at least one trigger condition include: that the grade of object to be measured reaches predetermined level；Object to be measured generates game events
Time is in preset time range；The identification information of object to be measured is associated with default scene of game.
Specifically, the grade of object to be measured reaches predetermined level corresponding to grade trigger condition, wherein detect the sheet of terminal
Rank list is stored in ground storage region.Trigger module is detected by supervising to player's upgrade event all in game
Control, and collect the mark (for example, ID, IP address etc.) of all players for being upgraded to given level (for example, 30 grades) and as master
Line task carries out the main object of plug-in detection.The time that object to be measured generates game events is in preset time range corresponding
In time trigger condition, detect trigger module can daily morning timed collection it is all on the same day on the day before had online behavior
The mark (for example, ID, IP address etc.) of the player of (it is assumed that all online players have been involved in everyday tasks) is used as everyday tasks
Carry out the main object of plug-in detection.The identification information of object to be measured is associated with default scene of game to correspond to scenario triggered item
Part, it is similar with grade trigger condition, it detects and is stored with scene list in the local storage region of terminal.Detection trigger module passes through
Scene of game event is passed in and out to player all in game to be monitored, and collects all given scenarios that are upgraded to (for example, 30
Grade) player mark (for example, ID, IP address etc.) and the main object of plug-in detection is carried out as scene task.
It should be noted that the original user log being collected into from game services end is typically all unstructured or half structure
The text data of change, therefore, before being detected to testing data, it is necessary first to which original log is converted into structuring number
According to.Specifically, the corresponding games log of each game player, the games log of game player are mentioned according to timestamp ordering
Take the following feature that games log summarizes: timestamp and EventID.Wherein, timestamp is player's Event Timestamp, is used
At the time of describing the generation of game player's current behavior；EventID is the class event identifier of game player, for describing player
Current detailed behavior, for example, used certain technical ability, obtained certain article etc..
In addition it is also necessary to illustrate, there are one between the games log that the multiple client with plug-in behavior generates
Fixed similitude, and what the games log that the client with plug-in behavior generates was generated with the client for not having plug-in behavior
There are biggish differences between games log.Therefore, in order to better describe game player behavior sequence similitude, behavior
Four kinds of different representative learning methods can be used in characterization module, so as to learn the not Tongfang to the behavior sequence of game player
The information in face.
Optionally, testing data is detected based on multiple unsupervised learning models, is obtained and multiple unsupervised learnings
The corresponding multiple characterization vectors of model may include:
Step S1040 is trained the data of multiple objects, obtains multiple unsupervised learning models；
Step S1042, using testing data as the input data of multiple unsupervised learning models, so that multiple no prisons
It superintends and directs learning model to detect testing data, exports characterization vector corresponding with each unsupervised learning model.
Specifically, behavior characterization module carries out the study of characterization model based on obtained whole player's behavior sequences, obtain
To behavior characterization module and the characterization vector of player's behavior sequence.Now to four kinds of unsupervised learning moulds in behavior characterization module
Type is introduced.
(1) LSTM model is shot and long term memory network, is a kind of time recurrent neural network, when being suitable for handling and predicting
Between be spaced and postpone relatively long critical event in sequence.LSTM has a variety of applications in sciemtifec and technical sphere.Based on LSTM
System can learn interpreter language, control robot, image analysis, documentation summary, speech recognition etc. task.For place
Manage time series data, RNN (Recurrent Neural Network, Recognition with Recurrent Neural Network are modeled for series model) table
Very strong advantage is revealed, in this application, has been modeled using LSTM model come the generation time to game events.First
In order to solve the problems, such as the sequence random length of testing data, the application is by Padding function to short sequence polishing and long sequence
The mode of truncation is arranged, so that the sequence for the level segments such as player is each can keep fixed length.In addition, by Event2Vec (by event
Sequence is mapped as the model of vector characterization) (Embedding) is encoded to the mark of the game events of player, in coding
Afterwards, game events are just mapped to a higher dimensional space vector, then again to the number of the vector characteristics of the game events, game events
Value tag, the levels characteristic of game events, the time interval feature of game events carry out splicing and are fused into a state-event spy
Sign, then state-event feature is input in LSTM model and is trained, state-event feature learning is abstracted into a fixed length
Vector, this vector is exactly the output of LSTM model, finally again be based on this feature vector, connect a full articulamentum, most
A decision value is exported by Sigmoid function afterwards, to be made whether plug-in judgement.
(2) Seq2vec model is created based on doc2vec.Wherein, doc2vec is similar to word2vec principle.?
Each player's behavior can correspond to a random N-dimensional vector in doc2vec, while using artificial neural network as N-dimensional
The sorting algorithm of vector, by unsupervised training, the context relation of learning behavior obtains the optimal vector of each behavior.?
Using the event identifier of player as words in seq2vec model, the sequence of events of game player is as document.Seq2vec simultaneously
Window value need to be arranged in model, indicate the range of the context considered in training vector.Model can be according to window value in training
Size the context relation of sequence of events is learnt, it is available corresponding with event identifier that training terminates Seq2vec model
Characterization vector, and characterization vector corresponding with sequence of events.Such as in Fig. 6, D is paragraph in doc2vec
(paragraph) or the number of document (i.e. document), in Seq2vec, for characterizing the mark of player's behavior sequence, W
For the event id (E1, E2, E3 and E4 in such as Fig. 6) for corresponding to player in paragraph (paragraph) or document (i.e. document).
Specifically, the event id of the behavior sequence mark of each player and all events is initialized first when carrying out model training
For a K dimensional vector, then the event id vector in behavior sequence vector sum context is input in model, hidden layer by this
A little vectors cumulative (or taking mean value or direct splicing) obtain intermediate vector, the input as softmax classifier.It was training
Cheng Zhong, behavior sequence id are remained unchanged, and the event id in the same behavior sequence shares a behavior sequence vector, that is,
It is the context semanteme that entire behavior sequence is all utilized in the probability of predicted events id.
(3) Seq2topic is proposed based on LDA (Latent Dirichlet Allocation) principle.LDA Chinese
Shelves obey multinomial distribution to theme, and theme to word obeys multinomial distribution.LDA belongs to unsupervised technology, can be used to identify big rule
The subject information hidden in mould document sets or corpus.In seq2topic word can be set by the event identifier of game player
Word (i.e. word), the sequence of events of each player are set as document (i.e. document).In addition, in seq2topic model
The quantity of designated key is needed, specifically can determine the number of topics in model according to game themes classification that may be present in game
Amount.Seq2topic model can distribute a theme after training for the sequence of events of each event and each player.Together
When, each player's sequence of events, which corresponds to each theme, can obtain corresponding probability.For example, theme quantity is set to 128,
Then each player's sequence of events can all obtain corresponding 128 probability values (probability that player's sequence of events belongs to this theme).
Then, using this 128 vector tieed up as the characterization vector of player's sequence of events.Due to the behavioral similarity of plug-in player, then
The game themes of different plug-in players are also close, and the game themes of plug-in player and normal player have differences.
(4) Sequence Autoencoder model is as a self-supervisory learning process, model structure and self-supervisory sequence
Column learning structure is identical.Wherein, list entries and output sequence are the behavior sequences of the same player, and the target of the model is weight
Structure list entries itself.Therefore, Sequence Autoencoder model can extract encoder in the last one time step
On hidden state or hidden state mean value in each time step characterized as the vector of player's behavior sequence.Its
In, encoder is that one layer of two-way RNN (build for series model by recurrent neural network, Recognition with Recurrent Neural Network
Mould), the unidirectional RNN that decoder is one layer.All RNN units are made of LSTM unit.
Optionally, Distributed Cluster module can be used DBSCAN algorithm and be clustered.DBSCAN algorithm is Martin
A kind of density-based algorithms that Ester is proposed, the object for appreciation with height behavioral similarity can be obtained by DBSCAN algorithm
The cluster of family.DBSCAN (Density-Based Spatial Clustering of Applications with Noise) is
One more representational density-based algorithms.Different from division and hierarchy clustering method, it will be defined as density
The maximum set of connected point can be cluster having region division highdensity enough, and can be in the spatial database of noise
The cluster of middle discovery arbitrary shape.
It should be noted that unsupervised algorithm passes through plug-in behavioral similarity, it is easier to send out compared to monitor model
Existing some plug-in variations and novel plug-in, and obtain the efficiency that can also be improved plug-in label after plug-in group.
In a kind of optional scheme, suspicious degree corresponding with default dimension is obtained according to cluster result, may include as
It is at least one lower: cluster result being divided according to the network address information of the hardware information of object to be measured and object to be measured
Analysis, obtains synteny suspicious degree；Cluster result is analyzed according to the corresponding name information of object to be measured and account information,
Obtain modeling suspicious degree；Commented according to the dress of object to be measured, grade and transaction record analyze cluster result, obtain numerical value
Property suspicious degree；Cluster result is analyzed according to the membership grade of object to be measured, obtains protectiveness suspicious degree；It is general according to first
Rate, the second probability and cluster result obtain complementary suspicious degree, wherein the first probability is according to unsupervised model to number to be measured
It is the probability of exception object according to the object to be measured analyzed, the second probability is the abnormal transaction detection according to object to be measured
The object to be measured that model analyzes testing data is the probability of exception object.
Specifically, being analyzed according to following five dimensions of plug-in player: synteny in group's suspicious degree analysis module
Dimension (hardware, IP etc.), modeling dimension (pet name, URS etc.), numerical dimension (dress is commented, grade, money record etc.), protectiveness
Dimension (VIP etc.), complementary dimension (killing record, abnormal transaction, unsupervised model etc.).Finally, can by front end can
The result for the scheme of supervising is shown depending on changing.Operation can see the information of player in front end and be marked, and then mark
Player enter killing intervene logic.
(1) synteny dimension.In terms of the synteny dimension of game player mainly to hardware information and IP information into
Row analysis.Plug-in player would generally use machine login account similar in the same IP or IP, and hardware information also can basic phase
Together.In IP similarity analysis, most IP address type is all C class at present as a result, therefore works as the number (net of first three section
Network number) it is identical when, it is believed that client is the different hosts under the same network, i.e. when the number of first three section of IP address is identical
It can determine that IP address is consistent.The ratio of the number IP_SUM of all IP in the number IP_COUNT and cluster that one IP occurs in cluster
For the repetitive rate IPRR (IP repetitive rate) of the IP, i.e.,
It, can be using maximum repetitive rate as the IP repetitive rate of cluster after the repetitive rate (IPRR) for obtaining all difference IP
IPRROC (IP repetition rate of cluster), i.e.,
IPRROC=max (IPRROC1... ..., IPRROCN)
In above formula, number that N is IP after duplicate removal in cluster.
It should be noted that the calculation of the hardware repetitive rate HWRROC of cluster is similar with IPRROC, the hardware of cluster is obtained
The IP repetitive rate IPRROC of repetitive rate HWRROC and cluster is the synteny suspicious degree CS (collinearity of cluster
Suspicions two indices).Wherein, the synteny suspicious degree CS of cluster meets following formula:
CS=θ × IPRROC+ (1- θ) × HWRROC
(2) dimension is modeled.The analysis of modeling dimension, which refers to, models the pet name and urs account prefix of game player
Analysis.According to the analysis of the pet name and urs account prefix to game player, it may be determined that the pet name and urs prefix of normal player
Usually with certain meaning, and the pet name of plug-in player and urs prefix are then mixed and disorderly letter, number or Chinese combinatorics on words.
The urs prefix of player is analyzed, can be modeled according to existing plug-in flag data, by the urs of player
Prefix character string is converted into 01 combining characters string according to digital alphabet, and is arrived using the character string after the conversion as sequence inputting
In LSTM, learn the syntagmatic of various letters, number etc. in player urs prefix by LSTM.To be obtained by the model
The urs suspicious degree suspicions of playerurs。
And for pet name suspicious degree suspicionsnickname, word segmentation processing can be carried out to the pet name first, then according to participle
Afterwards the quantity of word, number of Chinese character etc. carries out modeling analysis in each word.In this application, spy is constructed using MLP model
Mapping relations between sign and player's suspicious degree.
Pass through suspicionsursWith suspicionsnicknameThe modeling suspicious degree MS of the available player
(modeling suspicions):
MS=β × suspicionsurs+(1-β)×suspicionsnickname
(3) numerical dimension.The analysis of numerical dimension be the dress of player is commented, grade and money record analyze.
For plug-in player be game role is automatically controlled by script, therefore the dress of plug-in player comment it is general all relatively uniform or
Person is close, while grade and money record also can be almost the same, as a result, when the dress for detecting player in certain clusters comments, grade
There is high consistency with money record etc., i.e., the variance very little that the dress of player is commented in cluster, grade and money record etc., then the cluster
Numerical suspicious degree will be very high, variance is inversely proportional with suspicious degree.The following are the calculation formula of cluster synthesis variance:
Wherein, varclusterFor the synthesis variance of cluster；N is the number of attribute (dress comment, grade etc.)；variFor corresponding attribute
Variance；γiFor the discount factor of corresponding attribute, the influence degree of attribute is embodied.
The variance var of numerical suspicious degree NS (the numerical suspicions) and cluster of clusterclusterIt is inversely proportional:
Wherein σ is for controlling varclusterTransforming degree size between NS.
(4) protectiveness dimension.The analysis of protectiveness dimension is analyzed the VIP grade of player.Carry out protectiveness dimension
The equity of high-grade VIP player is mainly protected in the analysis of degree, since VIP player is fewer using plug-in probability, to subtract
Few high-grade VIP is by the probability of misplacement.The VIP higher grade of player, and degree of protection is higher.Therefore, VIP accounting in cluster
VIPclusterCalculation formula is as follows:
Wherein, levelvipFor the VIP grade of player, the player levels for not opening VIP are 0.In addition, the VIP for obtaining cluster is accounted for
Compare VIPclusterAfter, which is protectiveness suspicious degree PS (protective suspicions).
(5) complementary dimension.The analysis of complementary dimension mainly in conjunction with killing database, abnormal transaction detection model,
And existing unsupervised model analyzes the plug-in player having detected that.Specifically, can be according to unsupervised model to cluster
The prediction probability of middle player, abnormal transaction detection model are to the prediction result of player and the classification results of existing monitor model
Three values determine whether player is plug-in.
Complementary suspicious degree SS (subsidiary suspicions) calculates as follows:
Wherein, n is attribute (killing database, the abnormal transaction detection model etc.) number for assisting us to judge；
proportioniFor in cluster have a certain complementary attribute player's proportion, for example, (having been existed by killing in cluster
Recorded in killing database) accounting.
After obtaining the suspicious degree in each dimension, plug-in mark module can be according to suspicious degree corresponding with default dimension
Judge whether object to be measured is exception object, the specific steps are as follows:
Step S1100 determines the weighted value of suspicious degree corresponding with default dimension
Step S1102 is weighted according to weighted value pair suspicious degree corresponding with default dimension, obtains comprehensive suspection
Degree；
Step S1104 determines whether object to be measured is exception object according to comprehensive suspicious degree.
Specifically, plug-in mark module suspects synteny suspicious degree CS (collinearity suspicions), modeling
Spend MS (modeling suspicions), numerical suspicious degree NS (numerical suspicions), protectiveness suspicious degree PS
(protective suspicions) and complementary suspicious degree SS (subsidiary suspicions) carry out COMPREHENSIVE CALCULATING and obtain
To five synthesis suspicious degree CPS (Comprehensive suspicions).
Wherein, μ is the discount factor of various suspicious degrees, represents the significance level of such suspicious degree.
It optionally, can be according to the size of comprehensive suspicious degree and preset suspicious degree after comprehensive suspicious degree is calculated
Determine whether object to be measured is exception object, for example, comprehensive suspicious degree is greater than preset suspicious degree, it is determined that object to be measured is
Exception object.
In addition, plug-in mark module is also to be measured after determining that object to be measured is exception object according to comprehensive suspicious degree
Object is marked, and obtains label result, wherein label result indicates that object to be measured is exception object.
Specifically, the result of unsupervised scheme is showed game operation group by the visualization of front end by plug-in mark module
Team facilitates operation team to carry out plug-in label.Runing team can be somebody's turn to do in front end page according to type of play and time inquiring
All kinds of suspicious degree numerical value of each cluster in the cluster result and cluster result of period.We are logical for these numeric datas
The form for crossing figure or table is visualized.Meanwhile plug-in mark module also can by each generic attributes of data in cluster (such as
Urs prefix, the pet name, IP and hardware information etc. we for analysis attribute) be shown in front end, operation team can basis
Certain attribute or whole attribute for needing to check player, facilitate the reliability of operation team verifying suspicious degree.
Meanwhile operation team can be marked to plug-in player or cluster is determined as.The player marked by operation team
Or the player in certain cluster can be included into plug-in registration database, be trained and mould to be supplied to monitor model
Type iteration.
Embodiment 2
According to embodiments of the present invention, a kind of Installation practice that detection game is plug-in is additionally provided, it should be noted that should
The plug-in method of the detection game in embodiment 1 can be performed in device, wherein Fig. 5 is detection game according to an embodiment of the present invention
Plug-in apparatus structure schematic diagram, as shown in figure 5, the device includes: to obtain module 501, detection module 503, cluster module
505, processing module 507 and judgment module 509.
Wherein, module 501 is obtained, for obtaining the testing data of object to be measured；Detection module 503, for based on multiple
Unsupervised learning model detects testing data, obtains multiple characterization vectors corresponding with multiple unsupervised learning models,
Wherein, multiple unsupervised learning models obtain multiple characterization vectors for being trained to the data of multiple objects；Cluster module
505, for carrying out clustering processing to multiple characterization vectors from default dimension, obtain cluster result；Processing module 507 is used for root
Suspicious degree corresponding with default dimension is obtained according to cluster result；Judgment module 509, for according to suspection corresponding with default dimension
Degree judges whether object to be measured is exception object, wherein exception object has plug-in behavior.
It should be noted that above-mentioned acquisition module 501, detection module 503, cluster module 505, processing module 507 and
Judgment module 509 corresponds to the step S102 to step S110 in embodiment 1, and five modules are shown with what corresponding step was realized
Example is identical with application scenarios, but is not limited to the above embodiments 1 disclosure of that.
In a kind of optional scheme, obtain module include: the first acquisition module, selecting module, the first determining module with
And second determining module.Wherein, first module is obtained, for obtaining the behavioral data of object to be measured；Selecting module is used for from row
Meet the data of at least one trigger condition for selection in data；First determining module, for determining at least one trigger condition
Corresponding triggering type；Second determining module, for true from the data for meet at least one trigger condition according to triggering type
Determine testing data.
It should be noted that above-mentioned first obtains module, selecting module, the first determining module and the second determining module pair
It should be in the step S1020 to step S1026 in embodiment 1, the example and applied field that four modules are realized with corresponding step
Scape is identical, but is not limited to the above embodiments 1 disclosure of that.
In a kind of optional scheme, the corresponding triggering type of at least one trigger condition includes at least one following: etc.
Grade trigger condition, time trigger condition and scenario triggered condition, wherein by being selected at least one following subordinate act data
The data for meeting at least one trigger condition include: that the grade of object to be measured reaches predetermined level；Object to be measured generates game thing
The time of part is in preset time range；The identification information of object to be measured is associated with default scene of game.
In a kind of optional scheme, detection module includes: training module and output module.Wherein, training module is used
It is trained in the data to multiple objects, obtains multiple unsupervised learning models；Output module, for distinguishing testing data
As the input data of multiple unsupervised learning models, so that multiple unsupervised learning models detect testing data, it is defeated
Characterization vector corresponding with each unsupervised learning model out.
It should be noted that above-mentioned training module and output module correspond to the step S1040 in embodiment 1 to step
S1042, two modules are identical as example and application scenarios that corresponding step is realized, but it is public to be not limited to the above embodiments 1 institute
The content opened.
In a kind of optional scheme, dimension is preset including at least one of following: synteny dimension, modeling dimension, numerical value
Property dimension, protectiveness dimension and complementary dimension, suspicious degree corresponding with default dimension includes at least one of following: synteny
Suspicious degree, modeling suspicious degree, numerical suspicious degree, protectiveness suspicious degree and complementary suspicious degree, wherein according to cluster result
Suspicious degree corresponding with default dimension is obtained, including at least one following: according to the hardware information of object to be measured and to be measured right
The network address information of elephant analyzes cluster result, obtains synteny suspicious degree；According to the corresponding title letter of object to be measured
Breath and account information analyze cluster result, obtain modeling suspicious degree；It is commented according to the dress of object to be measured, grade and friendship
Easily record analyzes cluster result, obtains numerical suspicious degree；According to the membership grade of object to be measured to cluster result into
Row analysis, obtains protectiveness suspicious degree；Complementary suspicious degree is obtained according to the first probability, the second probability and cluster result,
In, the first probability is the probability that the object to be measured analyzed according to unsupervised model testing data is exception object,
It is different that second probability, which is according to the object to be measured that the abnormal transaction detection model of object to be measured analyzes testing data,
The probability of normal object.
In a kind of optional scheme, judgment module includes: third determining module, computing module and the 4th determining mould
Block.Wherein, third determining module, for determining the weighted value of suspicious degree corresponding with default dimension；Computing module is used for basis
Weighted value pair suspicious degree corresponding with default dimension is weighted, and obtains comprehensive suspicious degree；4th determining module is used for root
Determine whether object to be measured is exception object according to comprehensive suspicious degree.
It should be noted that above-mentioned third determining module, computing module and the 4th determining module correspond in embodiment 1
Step S1100 to step S1104, the example and application scenarios that three modules and corresponding step are realized be identical but unlimited
In 1 disclosure of that of above-described embodiment.
In a kind of optional scheme, determining that object to be measured is detection trip after exception object according to comprehensive suspicious degree
It plays plug-in device further include: mark module.Mark module, for object to be measured to be marked, marked as a result, its
In, label result indicates that object to be measured is exception object.
Embodiment 3
According to embodiments of the present invention, a kind of terminal embodiment that detection game is plug-in is additionally provided, it should be noted that should
The plug-in method of the detection game in embodiment 1 can be performed in system, wherein the terminal includes: processor and display.
Wherein, processor, for obtaining the testing data of object to be measured, and based on multiple unsupervised learning models to be measured
Data are detected, and multiple characterization vectors corresponding with multiple unsupervised learning models are obtained, then from default dimension to multiple
It characterizes vector and carries out clustering processing, obtain cluster result, and suspicious degree corresponding with default dimension is obtained according to cluster result, most
Judge whether object to be measured is exception object according to suspicious degree corresponding with default dimension afterwards, wherein exception object has plug-in
Behavior, multiple unsupervised learning models obtain multiple characterization vectors for being trained to the data of multiple objects；Display,
For showing the object information of exception object.
From the foregoing, it will be observed that, by obtaining the testing data of object to be measured, being then based on multiple by the way of unsupervised learning
Unsupervised learning model detects testing data, obtains multiple characterization vectors corresponding with multiple unsupervised learning models,
And clustering processing is carried out to multiple characterization vectors from default dimension, obtain cluster result.Then, according to cluster result obtain in advance
If the corresponding suspicious degree of dimension, and judge whether object to be measured is exception object according to suspicious degree corresponding with default dimension,
In, exception object has plug-in behavior, and multiple unsupervised learning models obtain more for being trained to the data of multiple objects
A characterization vector.
In above process, using the method for unsupervised learning, the testing data of object to be measured is passed through into multiple nothings respectively
Supervised learning model finally clusters multiple characterization vectors from default dimension to obtain multiple characterization vectors, and according to
Cluster result obtains suspicious degree, improves the plug-in accuracy of detection game.In addition, during detection game is plug-in, nothing
It needs manpower to participate in, reduces artificial participation, release manpower, reduce the error caused by artificial incorrect operation, improve
Game plug-in detection efficiency.
It can be seen that scheme provided herein can solve the prior art detection game it is plug-in accuracy it is lower
Technical problem.
In a kind of optional scheme, processor is also used to obtain the behavioral data of object to be measured, and in subordinate act data
Selection meets the data of at least one trigger condition, then determines the corresponding triggering type of at least one trigger condition, last root
Testing data is determined from the data for meet at least one trigger condition according to triggering type.
In a kind of optional scheme, the corresponding triggering type of at least one trigger condition includes at least one following: etc.
Grade trigger condition, time trigger condition and scenario triggered condition, wherein processor can pass through at least one following subordinate act number
According to the middle data for selecting to meet at least one trigger condition: the grade of object to be measured reaches predetermined level；Object to be measured generates trip
The time of play event is in preset time range；The identification information of object to be measured is associated with default scene of game.
In a kind of optional scheme, processor is also trained the data of multiple objects, obtains multiple unsupervised
Model is practised, then using testing data as the input data of multiple unsupervised learning models, so that multiple unsupervised learnings
Model detects testing data, exports characterization vector corresponding with each unsupervised learning model.
In a kind of optional scheme, dimension is preset including at least one of following: synteny dimension, modeling dimension, numerical value
Property dimension, protectiveness dimension and complementary dimension, suspicious degree corresponding with default dimension includes at least one of following: synteny
Suspicious degree, modeling suspicious degree, numerical suspicious degree, protectiveness suspicious degree and complementary suspicious degree, wherein processor is by such as
It is at least one lower that suspicious degree corresponding with default dimension is obtained according to cluster result: according to the hardware information of object to be measured and to
The network address information for surveying object analyzes cluster result, obtains synteny suspicious degree；According to the corresponding name of object to be measured
Claim information and account information to analyze cluster result, obtains modeling suspicious degree；Commented according to the dress of object to be measured, grade with
And transaction record analyzes cluster result, obtains numerical suspicious degree；Cluster is tied according to the membership grade of object to be measured
Fruit is analyzed, and protectiveness suspicious degree is obtained；Complementary suspection is obtained according to the first probability, the second probability and cluster result
Degree, wherein it is exception object that the first probability, which is according to the object to be measured that unsupervised model analyzes testing data,
Probability, the second probability are the object to be measured analyzed according to the abnormal transaction detection model of object to be measured testing data
For the probability of exception object.
In a kind of optional scheme, the weighted value of the also determining suspicious degree corresponding with default dimension of processor, and according to
Weighted value pair suspicious degree corresponding with default dimension is weighted, and obtains comprehensive suspicious degree, then according to comprehensive suspicious degree
Determine whether object to be measured is exception object.
In a kind of optional scheme, determining that object to be measured is processor after exception object according to comprehensive suspicious degree
Also object to be measured is marked, obtains label result, wherein label result indicates that object to be measured is exception object.
Embodiment 4
According to another aspect of an embodiment of the present invention, a kind of storage medium is additionally provided, which includes storage
Program, wherein program executes the plug-in method of the detection game in embodiment 1.
Embodiment 5
According to another aspect of an embodiment of the present invention, a kind of processor is additionally provided, which is used to run program,
In, it is executed when program is run in embodiment 1 and detects the plug-in method of game.
The serial number of the above embodiments of the invention is only for description, does not represent the advantages or disadvantages of the embodiments.
In the above embodiment of the invention, it all emphasizes particularly on different fields to the description of each embodiment, does not have in some embodiment
The part of detailed description, reference can be made to the related descriptions of other embodiments.
In several embodiments provided herein, it should be understood that disclosed technology contents can pass through others
Mode is realized.Wherein, the apparatus embodiments described above are merely exemplary, such as the division of the unit, Ke Yiwei
A kind of logical function partition, there may be another division manner in actual implementation, for example, multiple units or components can combine or
Person is desirably integrated into another system, or some features can be ignored or not executed.Another point, shown or discussed is mutual
Between coupling, direct-coupling or communication connection can be through some interfaces, the INDIRECT COUPLING or communication link of unit or module
It connects, can be electrical or other forms.
The unit as illustrated by the separation member may or may not be physically separated, aobvious as unit
The component shown may or may not be physical unit, it can and it is in one place, or may be distributed over multiple
On unit.It can some or all of the units may be selected to achieve the purpose of the solution of this embodiment according to the actual needs.
It, can also be in addition, the functional units in various embodiments of the present invention may be integrated into one processing unit
It is that each unit physically exists alone, can also be integrated in one unit with two or more units.Above-mentioned integrated list
Member both can take the form of hardware realization, can also realize in the form of software functional units.
If the integrated unit is realized in the form of SFU software functional unit and sells or use as independent product
When, it can store in a computer readable storage medium.Based on this understanding, technical solution of the present invention is substantially
The all or part of the part that contributes to existing technology or the technical solution can be in the form of software products in other words
It embodies, which is stored in a storage medium, including some instructions are used so that a computer
Equipment (can for personal computer, server or network equipment etc.) execute each embodiment the method for the present invention whole or
Part steps.And storage medium above-mentioned includes: that USB flash disk, read-only memory (ROM, Read-Only Memory), arbitrary access are deposited
Reservoir (RAM, Random Access Memory), mobile hard disk, magnetic or disk etc. be various to can store program code
Medium.
The above is only a preferred embodiment of the present invention, it is noted that for the ordinary skill people of the art
For member, various improvements and modifications may be made without departing from the principle of the present invention, these improvements and modifications are also answered
It is considered as protection scope of the present invention.
Claims (11)
1. a kind of method that detection game is plug-in characterized by comprising
Obtain the testing data of object to be measured；
The testing data is detected based on multiple unsupervised learning models, is obtained and the multiple unsupervised learning model
Corresponding multiple characterization vectors, wherein the multiple unsupervised learning model is obtained for being trained to the data of multiple objects
To the multiple characterization vector；
Clustering processing is carried out to the multiple characterization vector from default dimension, obtains cluster result；
Suspicious degree corresponding with the default dimension is obtained according to the cluster result；
Judge whether the object to be measured is exception object according to suspicious degree corresponding with the default dimension, wherein described different
Normal object has plug-in behavior.
2. the method according to claim 1, wherein obtaining the testing data of object to be measured, comprising:
Obtain the behavioral data of the object to be measured；
Selection meets the data of at least one trigger condition from the behavioral data；
Determine the corresponding triggering type of at least one described trigger condition；
The testing data is determined from the data for meeting at least one trigger condition according to the triggering type.
3. according to the method described in claim 2, it is characterized in that, the corresponding triggering type packet of at least one described trigger condition
Include at least one following: grade trigger condition, time trigger condition and scenario triggered condition, wherein by as follows at least it
One from the behavioral data selection meet the data of at least one trigger condition and include:
The grade of the object to be measured reaches predetermined level；
The time that the object to be measured generates game events is in preset time range；
The identification information of the object to be measured is associated with default scene of game.
4. the method according to claim 1, wherein based on multiple unsupervised learning models to the testing data
It is detected, obtains multiple characterization vectors corresponding with the multiple unsupervised learning model, comprising:
The data of multiple objects are trained, the multiple unsupervised learning model is obtained；
Using the testing data as the input data of the multiple unsupervised learning model, so that the multiple unsupervised
Learning model detects the testing data, exports characterization vector corresponding with each unsupervised learning model.
5. the method according to claim 1, wherein the default dimension is including at least one of following: synteny
Dimension, modeling dimension, numerical dimension, protectiveness dimension and complementary dimension, suspicious degree corresponding with the default dimension
Including at least one of following: synteny suspicious degree, modeling suspicious degree, numerical suspicious degree, protectiveness suspicious degree and complementary
Suspicious degree, wherein suspicious degree corresponding with the default dimension is obtained according to the cluster result, including at least one following:
According to the network address information of the hardware information of the object to be measured and the object to be measured to the cluster result into
Row analysis, obtains the synteny suspicious degree；
The cluster result is analyzed according to the corresponding name information of the object to be measured and account information, is obtained described
Model suspicious degree；
Commented according to the dress of the object to be measured, grade and transaction record analyze the cluster result, obtain the number
Value property suspicious degree；
The cluster result is analyzed according to the membership grade of the object to be measured, obtains the protectiveness suspicious degree；
The complementary suspicious degree is obtained according to the first probability, the second probability and the cluster result, wherein described first is general
It is the general of the exception object that rate, which is according to the object to be measured that unsupervised model analyzes the testing data,
Rate, second probability are to be analyzed to obtain to the testing data according to the abnormal transaction detection model of the object to be measured
The object to be measured be the exception object probability.
6. the method according to claim 1, wherein being sentenced according to the suspicious degree corresponding with the default dimension
Whether the object to be measured that breaks is exception object, comprising:
The weighted value of determining suspicious degree corresponding with the default dimension；
It is weighted according to the weighted value pair suspicious degree corresponding with the default dimension, obtains comprehensive suspicious degree；
Determine whether the object to be measured is the exception object according to the comprehensive suspicious degree.
7. according to the method described in claim 6, it is characterized in that, determining the object to be measured according to the comprehensive suspicious degree
After the exception object, the method also includes: the object to be measured is marked, obtains label result, wherein institute
It states label result and indicates that the object to be measured is the exception object.
8. a kind of device that detection game is plug-in characterized by comprising
Module is obtained, for obtaining the testing data of object to be measured；
Detection module, for being detected to the testing data based on multiple unsupervised learning models, obtain with it is the multiple
The corresponding multiple characterization vectors of unsupervised learning model, wherein the multiple unsupervised learning model is used for multiple objects
Data are trained, and obtain the multiple characterization vector；
Cluster module obtains cluster result for carrying out clustering processing to the multiple characterization vector from default dimension；
Processing module, for obtaining suspicious degree corresponding with the default dimension according to the cluster result；
Judgment module, for judge whether the object to be measured is extremely right according to suspicious degree corresponding with the default dimension
As, wherein the exception object has plug-in behavior.
9. a kind of terminal that detection game is plug-in characterized by comprising
Processor, for obtaining the testing data of object to be measured, and based on multiple unsupervised learning models to the testing data
It is detected, multiple characterization vectors corresponding with the multiple unsupervised learning model is obtained, then from default dimension to described
Multiple characterization vectors carry out clustering processing, obtain cluster result, and obtain and the default dimension pair according to the cluster result
The suspicious degree answered, it is last to judge whether the object to be measured is exception object according to suspicious degree corresponding with the default dimension,
Wherein, the exception object has plug-in behavior, and the multiple unsupervised learning model is used to carry out the data of multiple objects
Training, obtains the multiple characterization vector；
Display, for showing the object information of the exception object.
10. a kind of storage medium, which is characterized in that the storage medium includes the program of storage, wherein described program right of execution
Benefit detects the plug-in method of game described in requiring any one of 1 to 7.
11. a kind of processor, which is characterized in that the processor is for running program, wherein right of execution when described program is run
Benefit detects the plug-in method of game described in requiring any one of 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811315157.8A CN109464807A (en) | 2018-11-06 | 2018-11-06 | Detect game plug-in method, apparatus and terminal |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201811315157.8A CN109464807A (en) | 2018-11-06 | 2018-11-06 | Detect game plug-in method, apparatus and terminal |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN109464807A true CN109464807A (en) | 2019-03-15 |
Family
ID=65672245
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201811315157.8A Pending CN109464807A (en) | 2018-11-06 | 2018-11-06 | Detect game plug-in method, apparatus and terminal |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN109464807A (en) |
Cited By (14)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110075524A (en) * | 2019-05-10 | 2019-08-02 | 腾讯科技（深圳）有限公司 | Anomaly detection method and device |
| CN110876851A (en) * | 2019-11-20 | 2020-03-13 | 腾讯科技（深圳）有限公司 | Plug-in identification method, server, system and storage medium |
| CN110909630A (en) * | 2019-11-06 | 2020-03-24 | 腾讯科技（深圳）有限公司 | Abnormal game video detection method and device |
| CN111010365A (en) * | 2019-10-12 | 2020-04-14 | 中国平安财产保险股份有限公司 | External hanging detection method and device based on login data and computer equipment |
| CN111298445A (en) * | 2020-02-07 | 2020-06-19 | 腾讯科技（深圳）有限公司 | Target account detection method and device, electronic equipment and storage medium |
| CN111417021A (en) * | 2020-03-16 | 2020-07-14 | 广州虎牙科技有限公司 | Plug-in identification method and device, computer equipment and readable storage medium |
| CN111858275A (en) * | 2020-07-03 | 2020-10-30 | 深圳前海微众银行股份有限公司 | Method, device, equipment and storage medium for identifying abnormal media behaviors |
| CN112221156A (en) * | 2020-10-27 | 2021-01-15 | 腾讯科技（深圳）有限公司 | Data abnormality recognition method, data abnormality recognition device, storage medium, and electronic device |
| CN112616074A (en) * | 2021-03-08 | 2021-04-06 | 武汉斗鱼鱼乐网络科技有限公司 | Target group identification method and electronic equipment |
| CN113289346A (en) * | 2021-05-21 | 2021-08-24 | 网易（杭州）网络有限公司 | Task model training method and device, electronic equipment and storage medium |
| CN113318455A (en) * | 2021-05-24 | 2021-08-31 | 网易（杭州）网络有限公司 | Game data processing method and device |
| CN113537363A (en) * | 2021-07-20 | 2021-10-22 | 北京奇艺世纪科技有限公司 | Abnormal object detection method and device, electronic equipment and storage medium |
| CN114077872A (en) * | 2021-11-29 | 2022-02-22 | 税友软件集团股份有限公司 | Data anomaly detection method and related device |
| CN115391084A (en) * | 2022-10-27 | 2022-11-25 | 北京蔚领时代科技有限公司 | Intelligent solution method and system for cloud game abnormity |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101848160A (en) * | 2010-05-26 | 2010-09-29 | 钱叶魁 | Method for detecting and classifying all-network flow abnormity on line |
| CN105354133A (en) * | 2015-09-28 | 2016-02-24 | 网易（杭州）网络有限公司 | Game log data processing method and apparatus |
| CN107158707A (en) * | 2017-04-27 | 2017-09-15 | 浙江大学 | A kind of method for detecting abnormality and device played for MMORPGs |
| CN107185243A (en) * | 2017-04-26 | 2017-09-22 | 厦门吉比特网络技术股份有限公司 | A kind of recognition methods of network game external store |
| CN107281755A (en) * | 2017-07-14 | 2017-10-24 | 网易（杭州）网络有限公司 | Construction method, device, storage medium, processor and the terminal of detection model |
| US20180077179A1 (en) * | 2016-09-09 | 2018-03-15 | Ca, Inc. | Bot detection based on divergence and variance |
-
2018
- 2018-11-06 CN CN201811315157.8A patent/CN109464807A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101848160A (en) * | 2010-05-26 | 2010-09-29 | 钱叶魁 | Method for detecting and classifying all-network flow abnormity on line |
| CN105354133A (en) * | 2015-09-28 | 2016-02-24 | 网易（杭州）网络有限公司 | Game log data processing method and apparatus |
| US20180077179A1 (en) * | 2016-09-09 | 2018-03-15 | Ca, Inc. | Bot detection based on divergence and variance |
| CN107185243A (en) * | 2017-04-26 | 2017-09-22 | 厦门吉比特网络技术股份有限公司 | A kind of recognition methods of network game external store |
| CN107158707A (en) * | 2017-04-27 | 2017-09-15 | 浙江大学 | A kind of method for detecting abnormality and device played for MMORPGs |
| CN107281755A (en) * | 2017-07-14 | 2017-10-24 | 网易（杭州）网络有限公司 | Construction method, device, storage medium, processor and the terminal of detection model |
Cited By (23)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN110075524A (en) * | 2019-05-10 | 2019-08-02 | 腾讯科技（深圳）有限公司 | Anomaly detection method and device |
| CN111010365A (en) * | 2019-10-12 | 2020-04-14 | 中国平安财产保险股份有限公司 | External hanging detection method and device based on login data and computer equipment |
| CN111010365B (en) * | 2019-10-12 | 2022-04-15 | 中国平安财产保险股份有限公司 | External hanging detection method and device based on login data and computer equipment |
| CN110909630A (en) * | 2019-11-06 | 2020-03-24 | 腾讯科技（深圳）有限公司 | Abnormal game video detection method and device |
| CN110909630B (en) * | 2019-11-06 | 2023-04-18 | 腾讯科技（深圳）有限公司 | Abnormal game video detection method and device |
| CN110876851A (en) * | 2019-11-20 | 2020-03-13 | 腾讯科技（深圳）有限公司 | Plug-in identification method, server, system and storage medium |
| CN111298445B (en) * | 2020-02-07 | 2021-08-10 | 腾讯科技（深圳）有限公司 | Target account detection method and device, electronic equipment and storage medium |
| CN111298445A (en) * | 2020-02-07 | 2020-06-19 | 腾讯科技（深圳）有限公司 | Target account detection method and device, electronic equipment and storage medium |
| WO2021155687A1 (en) * | 2020-02-07 | 2021-08-12 | 腾讯科技（深圳）有限公司 | Target account inspection method and apparatus, electronic device, and storage medium |
| CN111417021A (en) * | 2020-03-16 | 2020-07-14 | 广州虎牙科技有限公司 | Plug-in identification method and device, computer equipment and readable storage medium |
| CN111858275A (en) * | 2020-07-03 | 2020-10-30 | 深圳前海微众银行股份有限公司 | Method, device, equipment and storage medium for identifying abnormal media behaviors |
| CN111858275B (en) * | 2020-07-03 | 2022-12-20 | 深圳前海微众银行股份有限公司 | Method, device, equipment and storage medium for identifying abnormal media behaviors |
| CN112221156A (en) * | 2020-10-27 | 2021-01-15 | 腾讯科技（深圳）有限公司 | Data abnormality recognition method, data abnormality recognition device, storage medium, and electronic device |
| CN112616074A (en) * | 2021-03-08 | 2021-04-06 | 武汉斗鱼鱼乐网络科技有限公司 | Target group identification method and electronic equipment |
| CN112616074B (en) * | 2021-03-08 | 2021-05-28 | 武汉斗鱼鱼乐网络科技有限公司 | Target group identification method and electronic equipment |
| CN113289346A (en) * | 2021-05-21 | 2021-08-24 | 网易（杭州）网络有限公司 | Task model training method and device, electronic equipment and storage medium |
| CN113318455A (en) * | 2021-05-24 | 2021-08-31 | 网易（杭州）网络有限公司 | Game data processing method and device |
| CN113318455B (en) * | 2021-05-24 | 2024-04-19 | 网易（杭州）网络有限公司 | Game data processing method and device |
| CN113537363A (en) * | 2021-07-20 | 2021-10-22 | 北京奇艺世纪科技有限公司 | Abnormal object detection method and device, electronic equipment and storage medium |
| CN113537363B (en) * | 2021-07-20 | 2023-12-15 | 北京奇艺世纪科技有限公司 | Abnormal object detection method and device, electronic equipment and storage medium |
| CN114077872A (en) * | 2021-11-29 | 2022-02-22 | 税友软件集团股份有限公司 | Data anomaly detection method and related device |
| CN115391084A (en) * | 2022-10-27 | 2022-11-25 | 北京蔚领时代科技有限公司 | Intelligent solution method and system for cloud game abnormity |
| CN115391084B (en) * | 2022-10-27 | 2023-01-24 | 北京蔚领时代科技有限公司 | Intelligent solution method and system for cloud game abnormity |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN109464807A (en) | Detect game plug-in method, apparatus and terminal | |
| Liu et al. | Toward AI fashion design: An Attribute-GAN model for clothing match | |
| Li et al. | Deep reinforcement learning for robust emotional classification in facial expression recognition | |
| CN109464808A (en) | Detect game plug-in method, apparatus and terminal | |
| CN110162703A (en) | Content recommendation method, training method, device, equipment and storage medium | |
| CN108905209A (en) | Plug-in detection method and system, electronic equipment and storage medium in game | |
| US20160328604A1 (en) | Systems and methods of monitoring activities at a gaming venue | |
| CN110532996A (en) | The method of visual classification, the method for information processing and server | |
| CN106776619A (en) | Method and apparatus for determining the attribute information of destination object | |
| CN109583468A (en) | Training sample acquisition methods, sample predictions method and corresponding intrument | |
| Yampolskiy et al. | Face recognition in the virtual world: recognizing avatar faces | |
| Mo et al. | Image feature learning for cold start problem in display advertising | |
| KR20200075114A (en) | System and Method for Matching Similarity between Image and Text | |
| CN110152290A (en) | Game running method and device, storage medium and electronic device | |
| CN111212303A (en) | Video recommendation method, server and computer-readable storage medium | |
| CN109872162A (en) | A kind of air control classifying identification method and system handling customer complaint information | |
| CN104951807B (en) | The determination method and apparatus of stock market's mood | |
| CN109903053B (en) | Anti-fraud method for behavior recognition based on sensor data | |
| CN112791414B (en) | Plug-in recognition model training method and device, electronic equipment and storage medium | |
| CN110580489B (en) | Data object classification system, method and equipment | |
| CN106537387B (en) | Retrieval/storage image associated with event | |
| CN108959323A (en) | Video classification methods and device | |
| CN108427661A (en) | A kind of new big data label manufacturing process and device | |
| CN110532429A (en) | It is a kind of based on cluster and correlation rule line on user group's classification method and device | |
| CN111400525B (en) | Fashion clothing intelligent matching and recommending method based on vision combination relation learning |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |