CN110665233A

CN110665233A - Game behavior identification method, device, equipment and medium

Info

Publication number: CN110665233A
Application number: CN201910807992.1A
Authority: CN
Inventors: 冯淦; 陈旺林; 齐雅婷; 刘浩
Original assignee: Tencent Technology Shenzhen Co Ltd
Current assignee: Tencent Technology Shenzhen Co Ltd
Priority date: 2019-08-29
Filing date: 2019-08-29
Publication date: 2020-01-10
Anticipated expiration: 2039-08-29
Also published as: CN110665233B

Abstract

The application provides a game behavior identification method, a game behavior identification device, equipment and a medium, wherein the method comprises the following steps: after receiving a game play-in request aiming at game play-in, obtaining game play-in data of all participants in the game play-in, wherein the game play-in data comprises basic data of all participants and operation sequences corresponding to multiple rounds of play-in operations of all participants; and identifying whether the game behavior corresponding to the game play-aiming request is abnormal game behavior or not by utilizing a behavior identification model based on the game play-aiming data. Compared with the prior art, the characteristics extracted by the method contain more details, the method can replace the design of the existing artificial statistical characteristics, has high identification efficiency on abnormal game behaviors, and solves the problems of various malicious behaviors such as small number weeding wool, illegal game currency transaction, cheating by a two-reed actor and the like in game business.

Description

Game behavior identification method, device, equipment and medium

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, a device, and a medium for identifying a game behavior.

Background

With the development of networks, network games based on the internet as a transmission medium are more and more favored by people. However, in the process of the network game, some abnormal game behaviors, such as illegal game chip transaction and group ganging cheating or personal cheating, pulling wool and small numbers, can occur, and the abnormal game behaviors can greatly influence the user experience of normal game participants.

In the prior art, for the detection of abnormal game behaviors such as illegal game currency transaction, group communication cheating or individual cheating, manual monitoring and manual countermeasures are generally adopted, so that the countermeasures are high in strength, the existing characteristics are difficult to identify the abnormal game behaviors, and the countermeasures are poor in effect. For the abnormal game behavior of the wool minus, although the simple machine confrontation can distinguish the wool minus operated by the script, the script of the wool minus can modify the parameters completely to achieve the behavior similar to the normal player, therefore, the existing simple machine confrontation is easy to be bypassed, and the defects of poor confrontation effect and high confrontation strength exist.

Disclosure of Invention

The application provides a game behavior identification method, a game behavior identification device, a game behavior identification equipment and a game behavior identification medium, which are used for solving at least one technical problem.

In one aspect, the present application provides a game behavior identification method, including:

after receiving a game play-in request aiming at game play-in, obtaining game play-in data of all participants in the game play-in, wherein the game play-in data comprises basic data of all participants and operation sequences corresponding to multiple rounds of play-in operations of all participants;

identifying whether the game behavior corresponding to the game play-aiming request is abnormal game behavior or not by utilizing a behavior identification model based on the game play-aiming data;

wherein the behavior recognition model is obtained based on machine learning training of an initial behavior recognition model, the behavior recognition model comprising a first network for extracting single-round operational features of all participants from the game pair data, a second network for extracting multi-round operational features of all participants from a plurality of the single-round operational features, and a masking layer for transferring length information of the operational sequence from the first network to the second network.

In another aspect, a game behavior recognition apparatus includes:

the game play matching method comprises an acquisition module, a game play matching module and a game play matching module, wherein the acquisition module is used for acquiring game play matching data of all participants in game play matching after receiving a game play matching request aiming at game play matching, and the game play matching data comprises basic data of all the participants and operation sequences corresponding to multiple rounds of play matching operation of all the participants;

the identification module is used for identifying whether the game behavior corresponding to the game play-aiming request is abnormal game behavior or not by utilizing a behavior identification model based on the game play-aiming data;

In another aspect, a game behavior recognition apparatus is provided, the apparatus including a processor and a memory, the memory having at least one instruction, at least one program, a set of codes, or a set of instructions stored therein, the at least one instruction, the at least one program, the set of codes, or the set of instructions being loaded and executed by the processor to implement a game behavior recognition method as described in any one of the above.

A further aspect provides a computer storage medium having stored therein at least one instruction, at least one program, set of codes or set of instructions for being loaded by a processor and executing a method of game behaviour recognition as described in any one of the above.

The game behavior identification method, the game behavior identification device, the game behavior identification equipment and the game behavior identification medium have the following technical effects:

the method comprises the steps that after a game play request aiming at game play is received, game play data of all participants in the game play are obtained, wherein the game play data comprise basic data of all the participants and operation sequences corresponding to multiple rounds of play operation of all the participants; and identifying whether the game behavior corresponding to the game play-aiming request is abnormal game behavior or not by utilizing a behavior identification model based on the game play-aiming data. Wherein the behavior recognition model is obtained based on machine learning training of an initial behavior recognition model, the behavior recognition model comprising a first network for extracting single-round operational features of all participants from the game pair data, a second network for extracting multi-round operational features of all participants from a plurality of the single-round operational features, and a masking layer for transferring length information of the operational sequence from the first network to the second network. The method and the device have the advantages that through designing two network structures and utilizing a behavior recognition model constructed by fusing the two network structures with the user-defined masking layer, the characteristics of the operation sequence can be effectively mined and extracted, the extracted characteristics contain more details than the prior art, the design of the existing artificial statistical characteristics can be replaced, the recognition efficiency of abnormal game behaviors is high, and the problems of various malicious behaviors such as thinning wool, illegal game coins, cheating by the double-reed actor and the like in game business are solved.

Drawings

In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative efforts.

FIG. 1 is a schematic illustration of an implementation environment provided by an embodiment of the present application;

FIG. 2 is a flow chart of a game behavior recognition method according to an embodiment of the present disclosure;

fig. 3 is a schematic flow chart illustrating a process of identifying a game behavior corresponding to a game-play-to-game request as a probability of an abnormal game behavior according to an embodiment of the present application;

FIG. 4 is a schematic flow chart illustrating another example of identifying a game behavior corresponding to a game-to-game request as an abnormal game behavior according to the present application;

FIG. 5 is a schematic flow chart of another example of a process for identifying a game behavior corresponding to a game-to-game request as an abnormal game behavior according to the present application;

FIG. 6 is a diagram illustrating training of a behavior recognition model according to an embodiment of the present disclosure;

FIG. 7 is a model framework diagram of an initial neural network model provided by an embodiment of the present application;

fig. 8 is a block diagram illustrating a game behavior recognition apparatus according to an embodiment of the present disclosure;

fig. 9 is a hardware structural diagram of an apparatus for implementing the method provided by the embodiment of the present application.

Detailed Description

Machine Learning (ML) is a multi-domain cross discipline, and relates to a plurality of disciplines such as probability theory, statistics, approximation theory, convex analysis, algorithm complexity theory and the like. The special research on how a computer simulates or realizes the learning behavior of human beings so as to acquire new knowledge or skills and reorganize the existing knowledge structure to continuously improve the performance of the computer. Machine learning is the core of artificial intelligence, is the fundamental approach for computers to have intelligence, and is applied to all fields of artificial intelligence. Machine learning and deep learning generally include techniques such as artificial neural networks, belief networks, reinforcement learning, transfer learning, inductive learning, and formal education learning.

In order to make the technical solutions better understood by those skilled in the art, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the drawings in the embodiments of the present application, and it is obvious that the described embodiments are only partial embodiments of the present application, but not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.

To make the objects, technical solutions and advantages of the present application more clear, embodiments of the present application will be described in further detail below with reference to the accompanying drawings.

Referring to fig. 1, a schematic diagram of an implementation environment provided by an embodiment of the present application is shown. The implementation environment may include: a terminal 10 and a server 20 connected to the terminal 10 through a network.

The terminal 10 may specifically include software running in a physical device, such as an application installed on the device, and may also include at least one of a smart phone, a desktop computer, a tablet computer, a notebook computer, a digital assistant, a smart wearable device, and the like, which are installed with the application. Specifically, the terminal 10 runs an operating system, which may be a desktop operating system such as a Windows (Windows) operating system, a Linux operating system, or a Mac OS (apple desktop operating system), or a mobile operating system such as an iOS (apple mobile terminal operating system) or an Android (Android) operating system.

The server 20 may be an independent server, a server cluster composed of a plurality of independent servers, or a cloud server providing basic cloud computing services such as a cloud computing server, a cloud database, and a cloud storage.

It should be understood that the implementation environment shown in fig. 1 is only one application environment of the present application, and is not limited to the application environment of the present application, and other application environments may include more or less computer devices than those shown in the drawings, or a network connection relationship of computer devices.

The following describes a specific embodiment of a game behavior recognition method according to the present application, and fig. 2 is a flowchart of a game behavior recognition method according to the embodiment of the present application, which provides the operation steps of the method according to the embodiment or the flowchart, but may include more or less operation steps based on conventional or non-inventive labor. The order of steps recited in the embodiments is merely one manner of performing the steps in a multitude of orders and does not represent the only order of execution. As shown in fig. 2, the executing subject of the method may be a server in the application environment, and the method may include:

s201: after receiving a game play-in request aiming at game play-in, obtaining game play-in data of all participants in the game play-in, wherein the game play-in data comprises basic data of all participants and operation sequences corresponding to multiple rounds of play-in operations of all participants.

The game match-up request may be a request sent by the terminal to the server to enter a game match-up for a certain type of game, and the game match-up request may carry game account identification information of the game match-up entered by the request logged in the terminal. The number of the first pending requests may be one or more. The game type may be a game type requiring a plurality of players to participate and to match each other, and may be, for example, a chess game (such as a landlord, a game of racing, a mahjong game, etc.), a sports game, or the like. Accordingly, the number of participants in the game pair is at least two.

After the game is played, each participant performs corresponding game play operation in the game play process. For example, the game owner and the game runner can play the game and pass the game. Taking mah-jong as an example, the game operations may include, but are not limited to, playing, hitting, mousing, touching, stroking, passing, and the like. Since during the game play of each game, from the game opening to the game ending, multiple game play operations are usually performed. Taking the ground fighter as an example, the participants are usually three: participant 1 (landholder), participant 2 (farmer 1) and participant 3 (farmer 2). Typically player 1 (ground owner) plays the cards first and then sequentially asks the remaining players (player 2 and player 3) one by one whether to play the cards (play operation), i.e. a round of play is completed.

The game play data is related data used to describe the play behavior of the participants in the game play. For example, the game play data may include basic data of all participants and a corresponding operation sequence of all participants in a plurality of rounds of play operations.

The basic data may include, among others, character information of the participants (e.g., landlord/farmer, whether to sit or not, teammate/enemy), identity information (e.g., novice/old, game level), hand information, game equipment information, game ability value information, and the like.

The operation sequence corresponding to the operation of all the players in the multiple rounds of game-play can comprise a card spectrum sequence, a game operation sequence and the like. In the case of a landholder, the basic data may include character information (e.g., landholder/farmer) and hand information of the participants. The sequence of operations corresponding to all players operating in the multiple rounds of game-play may include a sequence of card spectrums, which may be denoted as { pi }, where pi is the sequence of card spectrums corresponding to each player operating in the multiple rounds of game-play, respectively, and each sequence of card spectrums includes a sequence of card plays of the player operating in each round of game-play. The card spectrum sequence contains a large amount of information which can be used for identifying illegal behaviors, but the information is various and is difficult to use in a simple rule, a regression model and the like, so the prior art is not perfect in feature utilization.

In practical application, for example, a ground fighter is taken as an example, card playing sequences of all players in each round of game playing operation are obtained, and the respective card playing sequences can be encoded, for example, the respective card playing sequences can be encoded in a vector form or an array form, so as to obtain a data type which can be identified by a computer. For example, if the card-out sequence is "345678", the corresponding numerical code form may be expressed as: 1111110000000000 (where each digit corresponds to a card 3456789SJQKA2wW, and the value of each digit represents the number of cards; for example, the first "1" represents 1 "3").

S203: and identifying whether the game behavior corresponding to the game play-aiming request is abnormal game behavior or not by utilizing a behavior identification model based on the game play-aiming data.

Wherein the behavior recognition model is obtained based on machine learning training of the initial behavior recognition model. The behavior recognition model is used for recognizing game behaviors corresponding to game-to-game requests. Before the game play data is input into the behavior recognition model, the game play data can be correspondingly processed until the format requirement input into the behavior recognition model is met.

The abnormal game behavior includes, but is not limited to: cheating in ganging or personal cheating, illegal game chip trading, pulling wool trump and the like.

The behavior recognition model may be constructed from a variety of network structures. The network structure includes, but is not limited to, convolutional neural networks, cyclic neural networks, deep learning networks, and the like.

In a specific embodiment, the identifying, based on the game play data and by using a behavior recognition model, whether a game behavior corresponding to the game play request is an abnormal game behavior may include:

s2031: and identifying the probability that the game behavior corresponding to the game play-aiming request is abnormal game behavior by utilizing a behavior identification model based on the game play-aiming data.

In an alternative embodiment, the behavior recognition model may include a first network, a second network, and a montage layer.

Wherein the first network is used for extracting the single-round operation characteristics of all participants from the game match data. Specifically, the first network may be a Convolutional Neural Network (CNN). The first network may include a convolutional layer, a pooling layer, and a planarization layer. Wherein the convolutional and pooling layers may occur multiple times in the hidden layer.

The behavior recognition model may further include an input layer to which game play data is input and then entered into the first network, i.e., the first network may be a first layer of the behavior recognition model next to the input layer. The game match data comprises operation sequences corresponding to the operations of all participants in multiple rounds of match, and the number of rounds required from opening to ending of the game is different for the games of different rounds; accordingly, the sequence dimensions of the corresponding operation sequences are also necessarily the same. However, the conventional CNN does not support processing of variable-length data, and thus data dimensions in game play data may be converted into the same data as dimensions preset by the CNN before the game play data is input into the first network. For example, the data that does not reach the preset dimension may be subjected to zero padding processing, so that the data processed by the CNN is game match data with a fixed length.

The second network is used for extracting multi-round operation characteristics of all participants from a plurality of single-round operation characteristics. Specifically, the second network may be a Recurrent Neural Networks (RNN). Illustratively, the second network may be a bidirectional gated loop network GRU.

The masking layer is used for transferring length information of the operation sequence from the first network to a masking layer of the second network. As described above, the CNN does not support processing of variable-length data, and although the data is subjected to the "zero" complementing processing, the data subjected to the "zero" complementing processing is also subjected to the operation, and the corresponding value of the data subjected to the "zero" complementing processing after the corresponding operation is non-zero, which results in that the single-round operation characteristic output by the CNN contains a large amount of useless data. The method comprises the steps of obtaining length information of an operation sequence by setting a masking layer, wherein the length information of the operation sequence is used for representing dimension data of an original operation sequence. And then, transmitting the length information of the operation sequence to a second network, and before inputting the single-round operation features output by the CNN into the second network, filtering the data corresponding to the zero-filling processing according to the length information of the operation sequence to obtain updated single-round operation features, and then inputting the updated single-round operation features into the second network. The single round of operation feature of this update is a variable length data sequence.

As a variant, the first network may also be a deep neural network. The second network may also be at least one of a unidirectional cyclic neural network, a bidirectional gated cyclic network, a unidirectional gated cyclic network, and an LSTM network.

In another alternative embodiment, the behavior recognition model includes a first network, a second network, and a montage layer. Wherein the masking layer comprises a first masking layer and a second masking layer.

In this case, the identifying, based on the game play-targeting data and by using a behavior identification model, the probability that the game behavior corresponding to the game play-targeting request is an abnormal game behavior may specifically include:

s301: inputting the game match data into a first network in the behavior recognition model, and extracting the single-round operation characteristics of all participants; the single-round operation features are fixed-length feature sequences.

Specifically, the game match data includes the operation sequence corresponding to the operation of all the participants in the multiple rounds of match, and the number of rounds required from the opening to the end of the game is different for the games of different rounds; accordingly, the sequence dimensions of the corresponding operation sequences are also necessarily the same. However, the conventional CNN does not support processing of variable-length data, and thus data dimensions in game play data may be converted into the same data as dimensions preset by the CNN before the game play data is input into the first network. For example, the data which does not reach the preset dimension may be subjected to zero padding processing, so that the data processed by the CNN is game match data with a fixed length, and the extracted single-round operation feature is a fixed-length feature sequence.

The first network may include a convolutional layer, a pooling layer, and a planarization layer. And (3) after the DFT conversion characteristics are used for game match data, sequentially inputting the game match data into the convolutional layer, the pooling layer and the planarization layer for corresponding operation and characteristic extraction, and obtaining the single-round operation characteristics of all participants.

In practical application, for example, chess and card games are taken as an example, the game match data is input into a CNN network in the behavior recognition model, and the single-round playing characteristics of all participants are extracted. Due to the complicated playing method of the chess and card game, the possible types of the single-round playing of the players under the ordinary fighting ground master mode are more than 9 thousands, and under the pelagic playing method (any card can be replaced by pelagic cards), the types of the single-round playing are more than millions. The representation space of the card type is very sparse and difficult to model and train, and the manually designed characteristics are based on the understanding of people on the card, so that great information loss occurs on the expression of the card type. The method and the device use the front CNN network to extract the features of single round of card-playing, on one hand, reduce the information loss when the features are designed manually, and can replace the design of manual statistical features in the prior art; on the other hand, compared with the prior art, the extracted features contain more details, and the problem that the model is difficult to train due to the fact that the original sparse card type is directly used is solved.

S303: and inputting the game-play data into a first masking layer in the behavior recognition model, and extracting length information of the operation sequence.

Specifically, the length information of the operation sequence is obtained by extracting and recording each dimension data of the game match data through the first mask layer.

S305: and performing variable length processing on the single-round operation characteristics and the length information of the operation sequence by using a second masking layer in the behavior recognition model to obtain variable-length single-round operation characteristics.

Specifically, the length information of the operation sequence and a second masking layer in the behavior recognition model are utilized to restore the fixed-length single-wheel operation features extracted from the first network into variable-length single-wheel operation features, and the variable-length single-wheel operation features are single-wheel operation feature variable-length sequences and serve as the input of the second network.

S307: and inputting a plurality of the variable-length single-round operation features into the second network, and extracting corresponding multi-round operation features.

Specifically, the relevance sequence features are extracted through a bidirectional recurrent neural network, wherein the bidirectional recurrent neural network outputs corresponding multi-round operation features by using a bidirectional gated recurrent network GRU.

In practical application, taking the ground fighting as an example, a plurality of the variable-length single-round operation features are input into the bidirectional GRU network, and corresponding multi-round card-playing features are extracted. The fighting owner is a game with the rule that victory of a player is firstly completed, the number of the possible playing rounds of each game is variable, but the range of the game is approximately 1 to 90, and other chess and card games are also characterized by variable rounds. Since the discard sequence itself can be very long, conventional manually designed sequence pattern matching methods have low coverage and are difficult to analyze macroscopically and detect suspicious for longer sequences. The method and the device can better solve the problem of low coverage of manual design rules by extracting longer brand spectrum sequence characteristics by using the RNN model of the bidirectional GRU, and the extracted characteristics contain more brand spectrum variety details than the prior art.

Standard CNN implementations do not support variable-length sequence inputs, whereas the tile spectrum itself is a variable-length sequence. According to the method, two masking layers are customized, the first masking layer converts data into a fixed length before input through the CNN, and the second masking layer converts the data into a variable length before input through the RNN, so that the possibility of combining the CNN and the RNN is achieved in engineering.

S309: and inputting the multi-round operation characteristics to a classification output layer to obtain the probability that the game behavior corresponding to the game-play request is abnormal.

Specifically, the classification output layer is a two-classification output layer, and outputs the probability that the game behavior corresponding to the game play request is an abnormal game behavior. For example, the characteristics of the multiple rounds of operation can be classified into normal behavior and abnormal behavior through a sigmoid function.

Further, in another alternative embodiment, as shown in fig. 4, on the basis of the foregoing embodiment, after the step S303, the method may further include:

s401: first shape information including a plurality of single-round operational characteristics output by the first network is obtained.

Specifically, since the single-round operation features are processed by the convolution operation, the pooling operation and the flattening operation, the shape information of the data input to the first network is also adjusted accordingly. The first shape information output by the first network that includes a plurality of single-round operational characteristics is a size (length, width, height) or dimension.

S403: and performing corresponding operation processing on the extracted length information of the operation sequence to obtain length information of a processed operation sequence with second shape information, wherein the first shape information is matched with the second shape information.

Specifically, the corresponding operation processing corresponds to the above-described operations (for example, convolution operation, pooling operation, and flattening operation) performed on the game play data by the first network. In the present embodiment, the purpose of performing the corresponding operation processing is to match the second shape information of the length information of the extracted operation sequence with the first shape information to make the subsequent variable length processing more effective.

Accordingly, the step S305 may be replaced by:

s405: and performing variable length processing on the single-wheel operation characteristics and the processed length information of the operation sequence by using a second masking layer in the behavior recognition model to obtain variable-length single-wheel operation characteristics.

Specifically, the second mask layer respectively obtains the single-round operation features and the length information of the processed operation sequence, and then filters redundant data (for example, data subjected to zero padding operation) in the single-round operation features according to the length information of the processed operation sequence to obtain the variable-length single-round operation features.

In another alternative embodiment, based on the above embodiment, the behavior recognition model may further include an attention mechanism module. At this time, the masking layer is also used for transmitting the length information of the operation sequence to the attention mechanism module. Specifically, the second masking layer extracts the features of the combined output from the output of the CNN network of the recorded length information of the operation sequence through the RNN network, and meanwhile, delivers the length information of the operation sequence to the attention module. At this time, as shown in fig. 5, before the step S309, the method may further include:

s501: and acquiring attention vectors corresponding to the multi-round operation features.

Specifically, the attention vector may be a vector composed of feature weights corresponding to each operation feature in the multiple rounds of operation features. The characteristic weight is a relation that can represent the probability of the operation characteristic corresponding to each game-play time in one game and the abnormal game behavior. For example, the output multi-round operation characteristics are input to the attention mechanism module, and an attention vector corresponding to the multi-round operation characteristics is obtained.

S503: determining key operation features corresponding to the multi-round operation features by using the attention mechanism module based on the multi-round operation features, the length information of the operation sequence and the attention vector.

Specifically, the attention mechanism module performs key operation feature extraction by using length information of an operation sequence propagated by the second mask layer and combining the multiple rounds of operation features extracted by the RNN and the acquired attention vector. The key operational characteristics are characteristics describing a game in which a probability of an abnormal game behavior being output is correlated. For example, taking the landholder as an example, if the farmer 2 fries the cards of the farmer 1, or the farmer 2 deliberately deals the landholder with small cards, etc., these game operations can be used as key operations to perform corresponding feature extraction.

Because the sequence of each step of operation is lengthened, if the length information (filling 0) is lost, the redundant operation sequence can also generate meaningless numerical values through the bias operation of the RNN and the attention mechanism module, and at the moment, the intermediate hidden variables can be sparse. By propagating the length information of the operation sequence upwards, the problem can be reduced, and the accurate extraction of the operation characteristics is facilitated.

Correspondingly, the inputting the multiple rounds of operation features into the classification output layer to obtain the probability that the game play request is an abnormal game behavior may include:

s505: and inputting the key operation characteristics to a full connection layer to obtain the probability that the game-play request is abnormal game behavior.

For example, in a chess and card game, the game play of the chess and card game may be long, and the expression of the abnormal points is difficult to realize only through the macro features extracted by the RNN. The attention module added in the method simulates thought of suspicious report of game-dealing in manual checking, and can find key operation features from sequence features output by the RNN, namely extracting key card-dealing conditions of several rounds in game-dealing, extracting more suspicious features and improving the interpretability of detection results.

S2033: and comparing the probability with a preset probability threshold value, and judging whether the game behavior corresponding to the game opposite-game request is abnormal game behavior.

In the embodiment of the application, the preset probability threshold value can be set to any value including but not limited to 0.5-1. For example, if the preset probability threshold is 0.9, the determined probability that the game play request is an abnormal game behavior is 0.93, and since the probability (0.93) is greater than the preset probability threshold (0.9), the game behavior corresponding to the game play request is determined to be an abnormal game behavior. If the determined probability that the game play request is the abnormal game behavior is 0.6, determining that the game behavior corresponding to the game play request is not the abnormal game behavior because the probability is smaller than a preset probability threshold.

The method and the device have the advantages that through designing two network structures and utilizing a behavior recognition model constructed by fusing the two network structures with the user-defined masking layer, the characteristics of the operation sequence can be effectively mined and extracted, the extracted characteristics contain more details than the prior art, the design of the existing artificial statistical characteristics can be replaced, the recognition efficiency of abnormal game behaviors is high, and the problems of various malicious behaviors such as thinning wool, illegal game coins, cheating by the double-reed actor and the like in game business are solved.

In an alternative embodiment, the method may further comprise:

s205: and if the game behavior corresponding to the game play-against request is determined to be abnormal game behavior, executing corresponding countermeasure operation.

In the embodiment of the present application, the countermeasure operation includes, but is not limited to, reminding for abnormal operation, closing game play, blocking game play, sealing number, identity authentication, and the like. Specifically, after the game behavior corresponding to the game play-opposite request is determined to be the abnormal game behavior, the feature data corresponding to the probability that the abnormal game behavior corresponds to the threshold value may be extracted, the target participant who executes the abnormal game behavior is determined, and then the corresponding countermeasure operation is executed on the target participant.

In an alternative embodiment, the method further comprises the step of training the behavior recognition model.

Wherein the behavior recognition model is obtained based on machine learning training of the initial behavior recognition model.

The following describes training embodiments of the behavior recognition model provided in the present application.

Fig. 6 is a schematic diagram of training of a behavior recognition model according to an embodiment of the present application. The training step may be performed by the server of fig. 1; the method can be executed by other devices, and the server only acquires the behavior recognition model constructed by the server. As shown in fig. 6, a training process of a behavior recognition model is described by taking an example that the initial neural network model includes a first network, a second network, a first masking layer and a second masking layer, including:

s601: and constructing a training sample set.

The training sample set comprises a plurality of training samples, and each training sample comprises game sample play data of all sample participants in game sample play and corresponding sample classification labels; the game sample game-play data comprises a sample operation sequence corresponding to a plurality of game-play operations of all sample participants.

Different black and white training samples can be selected according to different abnormal game behaviors. Wherein, the white samples are selected for normal player play. For black samples, at least one of the following may be used:

1. weeding wool small mark: the match of the addition of a small number of the weeding wool;

2. illegal gaming chip transaction: the illegal trader deals with the ordinary player;

3. cheating of ganging: the reported cheating game.

S603: inputting the training sample set into a first network in an initial behavior recognition model, and extracting the single-round sample operation characteristics of all participants; the single round sample operation features are fixed length feature sequences.

S605: and inputting the training sample set into a first masking layer in the initial behavior recognition model, and extracting length information of the sample operation sequence.

S607: and carrying out variable length processing on the single-round sample operation characteristics and the length information of the sample operation sequence by utilizing a second masking layer in the initial behavior recognition model to obtain variable-length single-round sample operation characteristics.

S609: and inputting a plurality of the variable-length single-round sample operation features into a second network in the initial behavior recognition model, and extracting corresponding multi-round sample operation features.

S611: and inputting the multi-round sample operation characteristics to a classification output layer to obtain the sample probability that the game behavior corresponding to the game sample request corresponding to each training sample is the abnormal game behavior.

Specifically, for each type of black and white game play selected by the rule, the sample data of the game play is extracted as the model input, and the output is a binary probability value ranging from 0 to 1.

S613: and training the initial behavior recognition model based on the sample probability corresponding to each training sample and the corresponding sample classification label, and taking the target behavior recognition model corresponding to the condition meeting the training end as the behavior recognition model.

Specifically, the output of the last full-link layer is compared with the true value, the loss is calculated and propagated reversely, and then iteration is performed in sequence. The training end condition may be that a predetermined number of training times is reached or that the anomaly error is less than a predetermined threshold.

For details and advantages not disclosed in the training examples of the present application, please refer to the above-described method examples of the present application.

As shown in fig. 7, the initial neural network model includes a CNN network, a bidirectional GRU unit, a convolution mask layer, a merge mask layer, and an attention mechanism module. Wherein the CNN network may comprise a convolutional layer, a max-pooling layer, and a planarization layer (a Flatten layer) connected in sequence. The convolution mask layer may include an input mask layer, a mask copy layer, and a mask size processing layer connected in sequence, where the convolution mask layer is used to propagate sequence length information and may be regarded as a side channel that bypasses the CNN network, and the mask copy layer and the mask size processing layer are used to perform shape processing on the length information of the sample operation sequence, including, for example, dimension increasing and dimension decreasing processing, so as to match the data shape processed by the convolution mask layer with the data shape processed by the CNN network. The input layer is respectively connected with the convolution layer and the input masking layer, and the single-round sample operation characteristics output through the CNN network and the length information of the sample operation sequence with the matched shape output through the convolution masking layer are respectively input into the combined masking layer. After the masking layers are combined, on one hand, the two-way GRU unit is connected and used for transmitting the sample operation characteristics of the combination processing; and on the other hand, the system is connected with the attention mechanism module and is used for transmitting the length information of the sample operation sequence. The combined masking layer applies the length information of the operation sequence recorded by the left convolution masking layer to the CNN network output on the right side, the combined output extracts the characteristics through the bidirectional GRU unit, meanwhile, the length information of the operation sequence is sent to the attention module, and the key operation characteristics are extracted by combining the time sequence characteristics of the bidirectional GRU unit. And the full connection layer is connected behind the attention mechanism module and is used for outputting the two-classification probability. Taking the initial neural network model shown in fig. 8 as an example, the training process of the behavior recognition model is described, which includes:

s701: and constructing a training sample set.

Wherein the training sample set comprises a plurality of training samples (including black and white training samples), each training sample comprises game sample match data of all sample participants in the game sample match and a corresponding sample classification label; the game sample game-play data comprises a sample operation sequence corresponding to a plurality of game-play operations of all sample participants.

S703: inputting the training sample set into a CNN network in an initial behavior recognition model, and extracting the single-round sample operation characteristics of all participants; the single round sample operation features are fixed length feature sequences.

S705: inputting the training sample set into a convolution mask layer in the initial behavior recognition model, and extracting length information of the sample operation sequence.

S707: first shape information including a plurality of single-round sample operational characteristics output by the first network is obtained.

S709: and carrying out corresponding operation processing on the extracted length information of the sample operation sequence to obtain the length information of the processed sample operation sequence with second shape information, wherein the first shape information is matched with the second shape information.

S711: and utilizing a merged masking layer in the initial behavior recognition model to perform variable length processing on the single-round sample operation characteristics and the length information of the processed sample operation sequence to obtain variable-length single-round sample operation characteristics.

S713: and inputting a plurality of the variable-length single-round sample operation features into a bidirectional GRU unit in the initial behavior recognition model, and extracting corresponding multi-round sample operation features.

S715: and acquiring attention vectors corresponding to the multi-round operation features.

S717: determining key operation features corresponding to the multi-round operation features by using the attention mechanism module based on the multi-round operation features, the length information of the operation sequence and the attention vector.

S719: and inputting the key operation characteristics to a full connection layer to obtain the sample probability that the game behavior corresponding to the game sample request corresponding to each training sample is the abnormal game behavior.

S720: and training the initial behavior recognition model based on the sample probability corresponding to each training sample and the corresponding sample classification label, and taking the target behavior recognition model corresponding to the condition meeting the training end as the behavior recognition model.

Specifically, the parameters of the training may include, but are not limited to: parameters of the convolutional layer, parameters of the bidirectional GRU unit, parameters of the attention mechanism module, and parameters of the fully-connected layer.

In the chess and card game business, the income of the game can be influenced by pulling wool and small numbers to obtain a large number of game coins, the lottery risk can be brought to the game by illegal game coin transaction, and the bad game experience can be brought to normal players by ganging, getting through and cheating. The game behavior identification method provided by the application achieves good technical effects.

Particularly, for the detection of illegal game currency transaction, the coverage rate of the traditional rule model can only reach 20% to 30% under the condition that the accuracy rate is 95%, and the coverage rate of the behavior recognition model provided by the application can be improved to 82.9% under the condition that the accuracy rate is 97.6%. The coverage rate is increased by times while the accuracy rate is increased.

In effect, the number of small numbers of wool in the chess and card business is reduced by 83.9 percent, the price of illegal trading merchants is improved by 38.9 percent, the number of cheaters in gangues and collusion is reduced by 45.4 percent, and good positive influence is brought to the safety environment of the game.

The following are embodiments of the apparatus of the present application that may be used to perform embodiments of the method of the present application. For details which are not disclosed in the embodiments of the apparatus of the present application, reference is made to the embodiments of the method of the present application.

Referring to fig. 8, a block diagram of a game behavior recognition apparatus according to an embodiment of the present application is shown. The device has the function of realizing the server side in the above method example, and the function can be realized by hardware or by hardware executing corresponding software. The apparatus 80 may include:

an obtaining module 81, configured to obtain game play data of all participants in a game play after receiving a game play request for the game play, where the game play data includes basic data of all participants and an operation sequence corresponding to multiple rounds of play operations of all participants;

the identification module 82 is configured to identify, based on the game play-matching data, whether a game behavior corresponding to the game play-matching request is an abnormal game behavior by using a behavior identification model;

In some embodiments, the identification module 82 includes:

the identification submodule is used for identifying the probability that the game behavior corresponding to the game play-aiming request is abnormal game behavior by utilizing a behavior identification model based on the game play-aiming data;

and the judgment submodule is used for comparing the probability with a preset probability threshold value and judging whether the game behavior corresponding to the game opposite-playing request is abnormal game behavior.

In some embodiments, the overlay layer comprises a first overlay layer and a second overlay layer;

the identifier module comprises:

the first extraction unit is used for inputting the game match-up data into a first network in the behavior recognition model and extracting the single-round operation characteristics of all participants; the single-wheel operation features are fixed-length feature sequences;

the second extraction unit is used for inputting the game match data into a first masking layer in the behavior recognition model and extracting the length information of the operation sequence;

the variable length processing unit is used for carrying out variable length processing on the single-wheel operation characteristics and the length information of the operation sequence by utilizing a second masking layer in the behavior recognition model to obtain variable-length single-wheel operation characteristics;

a third extraction unit, configured to input the plurality of lengthened single-round operation features into the second network, and extract corresponding multi-round operation features;

and the first identification unit is used for inputting the multi-round operation characteristics to a classification output layer to obtain the probability that the game behavior corresponding to the game opposite-playing request is abnormal.

In some embodiments, the behavior recognition model further comprises an attention mechanism module, the masking layer further for passing length information of the sequence of operations to the attention mechanism module;

the identifier module further comprises:

the first acquisition unit is used for acquiring attention vectors corresponding to the multi-round operation features;

the key feature determining unit is used for determining key operation features corresponding to the multi-round operation features by using the attention mechanism module based on the multi-round operation features, the length information of the operation sequence and the attention vector;

and the second identification unit is used for inputting the key operation characteristics to a full connection layer to obtain the probability that the game opposite-game request is abnormal game behavior.

In some embodiments, the identification submodule further comprises:

a second acquisition unit configured to acquire first shape information including a plurality of single-round operation characteristics output by the first network;

and the processing unit is used for carrying out corresponding operation processing on the length information of the extracted operation sequence to obtain the length information of the processed operation sequence with second shape information, wherein the first shape information is matched with the second shape information.

In some embodiments, the apparatus further comprises:

and the model training module is used for training the behavior recognition model.

In some embodiments, the apparatus further comprises:

and the countermeasure module is used for executing corresponding countermeasure operation if the game behavior corresponding to the game countermeasure request is determined to be abnormal game behavior.

The embodiment of the present application provides a game behavior recognition device, which may include a processor and a memory, where the memory stores at least one instruction, at least one program, a code set, or a set of instructions, and the at least one instruction, the at least one program, the code set, or the set of instructions is loaded and executed by the processor to implement the game behavior recognition method provided in the above method embodiment.

The embodiment of the present application further provides a storage medium, where at least one instruction, at least one program, a code set, or an instruction set is stored in the storage medium, and the at least one instruction, at least one program, a code set, or an instruction set is loaded by a processor and executes any one of the above game behavior recognition methods.

Further, fig. 9 shows a hardware structure diagram of a device for implementing the method provided by the embodiment of the present application, where the device may be a computer terminal, a mobile terminal, or other devices, and the device may also participate in forming or including the apparatus provided by the embodiment of the present application. As shown in fig. 9, the computer terminal 10 may include one or more (shown as 102a, 102b, … …, 102 n) processors 102 (the processors 102 may include, but are not limited to, a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission device 106 for communication functions. Besides, the method can also comprise the following steps: a display, an input/output interface (I/O interface), a Universal Serial Bus (USB) port (which may be included as one of the ports of the I/O interface), a network interface, a power source, and/or a camera. It will be understood by those skilled in the art that the structure shown in fig. 9 is only an illustration and is not intended to limit the structure of the electronic device. For example, the computer terminal 10 may also include more or fewer components than shown in FIG. 9, or have a different configuration than shown in FIG. 9.

It should be noted that the one or more processors 102 and/or other data processing circuitry described above may be referred to generally herein as "data processing circuitry". The data processing circuitry may be embodied in whole or in part in software, hardware, firmware, or any combination thereof. Further, the data processing circuit may be a single stand-alone processing module, or incorporated in whole or in part into any of the other elements in the computer terminal 10 (or mobile device). As referred to in the embodiments of the application, the data processing circuit acts as a processor control (e.g. selection of a variable resistance termination path connected to the interface).

The memory 104 may be used to store software programs and modules of application software, such as program instructions/data storage devices corresponding to the methods described in the embodiments of the present application, and the processor 102 executes various functional applications and data processing by executing the software programs and modules stored in the memory 104, so as to implement one of the neural network processing methods described above. The memory 104 may include high speed random access memory, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include memory located remotely from the processor 102, which may be connected to the computer terminal 10 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

The transmission device 106 is used for receiving or transmitting data via a network. Specific examples of the network described above may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission device 106 includes a Network adapter (NIC) that can be connected to other Network devices through a base station to communicate with the internet. In one example, the transmission device 106 can be a Radio Frequency (RF) module, which is used to communicate with the internet in a wireless manner.

The display may be, for example, a touch screen type Liquid Crystal Display (LCD) that may enable a user to interact with a user interface of the computer terminal 10 (or mobile device).

It should be noted that: the sequence of the embodiments of the present application is only for description, and does not represent the advantages and disadvantages of the embodiments. And specific embodiments thereof have been described above. Other embodiments are within the scope of the following claims. In some cases, the actions or steps recited in the claims may be performed in a different order than in the embodiments and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In some embodiments, multitasking and parallel processing may also be possible or may be advantageous.

The embodiments in the present application are described in a progressive manner, and the same and similar parts among the embodiments can be referred to each other, and each embodiment focuses on the differences from the other embodiments. In particular, as for the device and server embodiments, since they are substantially similar to the method embodiments, the description is simple, and the relevant points can be referred to the partial description of the method embodiments.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program instructing relevant hardware, where the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.

The above description is only exemplary of the present application and should not be taken as limiting the present application, as any modification, equivalent replacement, or improvement made within the spirit and principle of the present application should be included in the protection scope of the present application.

Claims

1. A game behavior recognition method, comprising:

2. The method of claim 1, wherein the identifying whether the game behavior corresponding to the game play request is abnormal game behavior by using a behavior recognition model based on the game play data comprises:

based on the game play data, identifying the probability that the game behavior corresponding to the game play request is abnormal game behavior by using a behavior identification model;

and comparing the probability with a preset probability threshold value, and judging whether the game behavior corresponding to the game opposite-game request is abnormal game behavior.

3. The method of claim 2, wherein the overlay layers comprise a first overlay layer and a second overlay layer;

the identifying, by using a behavior identification model, the probability that the game behavior corresponding to the game play-to-play request is an abnormal game behavior based on the game play-to-play data includes:

inputting the game match data into a first network in the behavior recognition model, and extracting the single-round operation characteristics of all participants; the single-wheel operation features are fixed-length feature sequences;

inputting the game-play data into a first layout layer in the behavior recognition model, and extracting length information of the operation sequence;

carrying out variable length processing on the single-wheel operation characteristics and the length information of the operation sequence by utilizing a second masking layer in the behavior recognition model to obtain variable-length single-wheel operation characteristics;

inputting a plurality of variable-length single-round operation features into the second network, and extracting corresponding multi-round operation features;

and inputting the multi-round operation characteristics to a classification output layer to obtain the probability that the game behavior corresponding to the game-play request is abnormal.

4. The method of claim 3, wherein the behavior recognition model further comprises an attention mechanism module, and wherein the masking layer is further configured to pass length information of the sequence of operations to the attention mechanism module;

before the step of inputting the multi-round operation characteristics to the classification output layer and obtaining the probability that the game behavior corresponding to the game play request is the abnormal game behavior, the method comprises the following steps:

acquiring attention vectors corresponding to the multi-round operation features;

determining key operation features corresponding to the multi-round operation features by using the attention mechanism module based on the multi-round operation features, the length information of the operation sequence and the attention vector;

correspondingly, the inputting the multi-round operation features into a classification output layer to obtain the probability that the game play request is an abnormal game behavior includes:

and inputting the key operation characteristics to a full connection layer to obtain the probability that the game-play request is abnormal game behavior.

5. The method of claim 3, wherein the inputting the game play data into a first layout layer of the behavior recognition model, after extracting length information of the operation sequence, further comprises:

acquiring first shape information including a plurality of single-wheel operation characteristics output by the first network;

and performing corresponding operation processing on the extracted length information of the operation sequence to obtain length information of a processed operation sequence with second shape information, wherein the first shape information is matched with the second shape information.

6. The method of claim 1, further comprising the step of training the behavior recognition model, the training the behavior recognition model comprising:

constructing a training sample set, wherein the training sample set comprises a plurality of training samples, and each training sample comprises game sample play data and corresponding sample classification labels of all sample participants in game sample play; the game sample game-matching data comprises sample operation sequences corresponding to multiple rounds of game-matching operations of all sample participants;

inputting the training sample set into a first network in an initial behavior recognition model, and extracting the single-round sample operation characteristics of all participants; the single-round sample operation features are fixed-length feature sequences;

inputting the training sample set into a first masking layer in the initial behavior recognition model, and extracting length information of the sample operation sequence;

carrying out variable length processing on the single-round sample operation characteristics and the length information of the sample operation sequence by utilizing a second masking layer in the initial behavior recognition model to obtain variable-length single-round sample operation characteristics;

inputting a plurality of the variable-length single-round sample operation features into a second network in the initial behavior recognition model, and extracting corresponding multi-round sample operation features;

inputting the operation characteristics of the multiple rounds of samples into a classification output layer to obtain the sample probability that the game behavior corresponding to the game sample request corresponding to each training sample is the abnormal game behavior;

and training the initial behavior recognition model based on the sample probability corresponding to each training sample and the corresponding sample classification label, and taking the target behavior recognition model corresponding to the condition meeting the training end as the behavior recognition model.

7. The method of any one of claims 1-5, wherein the first network is a convolutional neural network or a deep neural network;

the second network is at least one of a unidirectional circulation neural network, a bidirectional gated circulation network, a unidirectional gated circulation network and an LSTM network.

8. A game behavior recognition apparatus, comprising:

9. A gaming behavior recognition apparatus comprising a processor and a memory, the memory having stored therein at least one instruction, at least one program, set of codes, or set of instructions, the at least one instruction, the at least one program, set of codes, or set of instructions being loaded and executed by the processor to implement a gaming behavior recognition method according to any of claims 1 to 7.

10. A computer storage medium having stored therein at least one instruction, at least one program, set of codes, or set of instructions, which is loaded by a processor and which performs a method of identifying a gambling behaviour as claimed in any one of claims 1 to 7.