CN111558226B

CN111558226B - Method, device, equipment and storage medium for detecting abnormal operation behaviors

Info

Publication number: CN111558226B
Application number: CN202010350641.5A
Authority: CN
Inventors: 赵枫; 殷赵辉; 胡和君; 潘泓; 李多航; 刘翔; 宋润青; 卓文辉; 肖纯; 王喜悦
Original assignee: Tencent Technology Chengdu Co Ltd
Current assignee: Tencent Technology Chengdu Co Ltd
Priority date: 2020-04-28
Filing date: 2020-04-28
Publication date: 2023-04-18
Anticipated expiration: 2040-04-28
Also published as: CN111558226A

Abstract

The application provides a method, a device, equipment and a storage medium for detecting abnormal operation behaviors, relates to the technical field of computers, and is used for detecting the abnormal operation behaviors of operation data simulating normal game operation. The method comprises the following steps: acquiring behavior data of a game player related to target operation from a set number of game picture frames containing the target operation; and matching the data distribution characteristics of the behavior data with data mutation characteristics to determine whether the game player has abnormal operation behaviors, wherein the data mutation characteristics are determined in advance according to the behavior data of the abnormal operation behaviors associated with the target operation. According to the method, whether the abnormal operation behavior of the operation data simulating the normal game operation exists in the game player or not can be determined according to whether the data distribution characteristics of the acquired behavior data are mutated or not.

Description

Method, device, equipment and storage medium for detecting abnormal operation behaviors

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, a device, and a storage medium for detecting abnormal operation behavior.

Background

Some game players may adopt abnormal operation behaviors in the game, for example, operation data simulating normal game operations such as plug-in behaviors and the like to help the game players to realize target operations in the game, so that the problem of how to detect the abnormal operation behaviors simulating the operation data of the normal game operations becomes a problem to be considered through level cards set in the game by the game players.

Disclosure of Invention

The embodiment of the application provides a method, a device, equipment and a storage medium for detecting abnormal operation behaviors, and is used for providing a method for detecting the abnormal operation behaviors of operation data simulating normal game operation.

In a first aspect of the present application, a method for detecting an abnormal operation behavior is provided, including:

acquiring behavior data of a game player aiming at the target operation from a set number of game picture frames related to the target operation;

and matching the data distribution characteristics of the behavior data with data mutation characteristics to determine whether the game player has abnormal operation behaviors, wherein the data mutation characteristics are determined in advance according to the behavior data of the abnormal operation behaviors aiming at the target operation.

In a possible implementation manner, the behavior data is obtained and sent by the game client after the game client detects the target operation.

In a possible implementation manner, the behavior data is obtained after the game player is detected to perform the target operation.

In a second aspect of the present application, there is provided an apparatus for detecting an abnormal operation behavior, including:

a behavior data acquisition unit for acquiring behavior data of a game player for a target operation from a set number of game screen frames associated with the target operation;

and the operation behavior determining unit is used for matching the data distribution characteristics of the behavior data with data mutation characteristics to determine whether the game player has abnormal operation behaviors, wherein the data mutation characteristics are determined in advance according to the behavior data of the abnormal operation behaviors aiming at the target operation.

In a possible implementation manner, the behavior data obtaining unit is specifically configured to:

when a target operation detection function of an application program interface API corresponding to the game detects the target operation, calling a first proxy function, and determining behavior data associated with the target operation from operation data obtained through a second proxy function, wherein: the second proxy function is used for acquiring the operation data of the target operation in the corresponding game picture frame in real time;

and after determining the behavior data corresponding to the target operation, recalling the target operation detection function to detect the target operation.

In a possible implementation manner, the device is a game server device, and the behavior data is obtained and sent by the game client after detecting the target operation.

In a possible implementation manner, the device is a game client device, and the behavior data is acquired after the game player is detected to perform the target operation.

In a third aspect of the present application, there is provided a computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, the processor implementing the method of the first aspect and any one of the possible embodiments when executing the program.

In a fourth aspect of the present application, a computer-readable storage medium is provided, which stores computer instructions that, when executed on a computer, cause the computer to perform the method according to the first aspect and any one of the possible embodiments.

Due to the adoption of the technical scheme, the embodiment of the application at least has the following technical effects:

generally, behavior data associated with normal game operation of a game player in a game does not change suddenly, and whether the game player has abnormal operation behavior or not can be determined by analyzing whether the data distribution characteristics of the behavior data associated with target operation are matched with the characteristics of the data mutation characteristics, namely the abnormal operation behavior of the behavior data simulating the normal game operation of the game player can be detected, and the accuracy of detecting the abnormal operation behavior in the game is improved.

Drawings

Fig. 1 is a schematic view of an application scenario of abnormal operation behavior detection according to an embodiment of the present application;

fig. 2 is a diagram illustrating another application scenario for detecting abnormal operation behavior according to an embodiment of the present application;

fig. 3 is a schematic flowchart of a method for detecting abnormal operation behavior according to an embodiment of the present application;

FIG. 4 is a schematic diagram of code execution logic of a game according to an embodiment of the present application;

FIG. 5 is a schematic diagram illustrating a process of implementing instruction jumping by function instrumentation according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram of a memory structure provided in an embodiment of the present application;

fig. 7 is a data distribution diagram of behavior data associated with abnormal operation behavior according to an embodiment of the present application;

fig. 8 is a schematic data distribution diagram of behavior data associated with abnormal operation behaviors according to an embodiment of the present application;

fig. 9 is a data distribution diagram of behavior data associated with abnormal operation behavior according to an embodiment of the present application;

fig. 10 is a data distribution diagram of behavior data associated with abnormal operation behavior according to an embodiment of the present application;

FIG. 11 is a diagram of a game frame according to an embodiment of the present application;

FIG. 12 is a schematic diagram illustrating an interaction process between a game client and a game server according to an embodiment of the present application;

FIG. 13 is a schematic diagram of behavior data associated with a killing operation according to an embodiment of the present disclosure;

fig. 14 is a schematic structural diagram of an abnormality detection apparatus according to an embodiment of the present application;

FIG. 15 is a schematic structural diagram of a computer device according to an embodiment of the present application;

fig. 16 is a schematic structural diagram of a terminal device according to an embodiment of the present application.

Detailed Description

In order to better understand the technical solutions provided by the embodiments of the present application, the following detailed description is made with reference to the drawings and specific embodiments.

It should be noted that the terms "first," "second," and the like in the description and claims of the present invention and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the invention described herein are capable of operation in other sequences than those illustrated or described herein.

In order to facilitate those skilled in the art to better understand the technical solutions of the present application, the following description refers to the technical terms of the present application.

The game client is a game terminal for the game player to log in and carry out game operation.

The game server side: and the server is used for interacting with the game client to finish the operation behavior of the game player in the game.

Automatic aiming cheating function: for short, the game player uses the plug-in to modify the game orientation data or move the mouse in the shooting game, so as to assist the game player to quickly move the gunpoint sight to the target position of the shooting object, such as the body or the head of an enemy, and achieve the action of assisting the game player to quickly and accurately aim.

An input device: the device for helping the game player to realize the control of the game role is connected with the game client through a data transmission interface such as a USB, a wired network, a wireless network such as Bluetooth or wifi and the like, and can be but not limited to a mouse, a keyboard, an operating handle or a virtual reality VR device and the like.

Operation position information: the operation position of the input device in the corresponding game screen frame, for example, when the input device is a mouse, the operation position information may be a cursor position of the mouse in the corresponding game screen frame.

Behavior data: the game player can obtain the action data from each game picture frame by triggering the operation data in the corresponding game picture frame through the input device.

Data distribution characteristics, data mutation characteristics and mutation data segments: the data distribution characteristics refer to the distribution characteristics and data change characteristics of behavior data arranged according to a certain sequence; the data mutation characteristic refers to a characteristic that the data distribution characteristic of the behavior data arranged continuously changes suddenly; the mutation data section is the behavior data with data distribution characteristics conforming to the continuous arrangement of the data mutation characteristics; specifically, the data distribution characteristics of the behavior data reflect the characteristics of game operations of game players in the game, and the behavior data triggered before and after the game players perform normal game operations generally change smoothly, that is, the behavior data arranged adjacently does not change too much suddenly; however, when a game player simulates behavior data of normal game operation by using abnormal operation behaviors such as plug-ins, the simulated behavior data is often suddenly increased or decreased from behavior data triggered by normal game operation adjacent to the simulated behavior data, or suddenly increased or decreased from adjacent simulated behavior data, that is, the data distribution characteristics of a section of data including the simulated behavior data among behavior data arranged in a certain order are suddenly changed, the characteristic of the sudden change of the data distribution characteristics of the continuously arranged behavior data is called as a data mutation characteristic, and a section of data including the simulated behavior data intercepted from the behavior data arranged in a certain order is called as a data mutation section.

The following explains the concept of the present application.

Because a game player can adopt cheating abnormal operation behaviors to simulate operation data of normal game operation in a game to help the game player realize target operation in the game, for example, an automatic aiming function is used in a shooting game, the automatic aiming function usually realizes automatic aiming at a shooting object in the game through the operation data of the simulated normal game operation of the game player and then kills the shooting object so as to help the game player pass a stage in the shooting game, because the capability of aiming at the shooting object is exactly one of keys of different game players in the shooting game compared with spelling skills, and other game players aim the shooting object through self skills, the behavior of using the automatic aiming function seriously influences the fairness of other game players in the game.

The abnormal operation behavior detection is realized based on detecting whether the game code is falsified or not in the normal game operation simulation process, but the game code of the game is not modified in the process of simulating the operation data of the normal game operation, and the game code of the shooting game is not modified in the process of helping the game player to automatically aim at the shooting object by the automatic aiming function, so the abnormal operation behavior is concealed, the abnormal operation behavior cannot be detected by detecting the game code, and the accuracy of detecting the abnormal operation behavior in the game is reduced.

In order to detect abnormal operation behavior of operation data simulating normal game operation, the inventors devised an abnormal operation behavior detection method, apparatus, device, and storage medium. Generally, behavior data triggered before and after a game player performs normal game operation generally changes smoothly, adjacent behavior data does not change too much suddenly, such as suddenly increasing or suddenly decreasing, and the change trend of adjacent behavior data does not change suddenly, such as suddenly increasing the variable of the adjacent behavior data, and the like, namely, the data distribution characteristic of the behavior data associated with normal game operation does not change suddenly; however, when the game player realizes the target operation by using the behavior data of the abnormal operation behavior simulation normal game operation such as plug-in, the simulated behavior data is likely to be inconsistent with the distribution characteristics of the behavior data before and after the normal game operation, for example, the simulated behavior data before and after the target operation may have a sudden change, so that the behavior data associated with the target operation by the game player can be acquired from the game screen frame containing the target operation, and then whether the abnormal operation behavior exists by the game player can be judged according to the data distribution characteristics of the behavior data associated with the target operation, wherein the target operation is one or more operations of the game operation in the game.

And the data mutation characteristics of the behavior data can be determined in advance according to the behavior data of the abnormal operation behavior associated with the target operation, the data distribution characteristics of the behavior data associated with the game player and the target operation are matched with the data mutation characteristics, and whether the game player has the abnormal behavior operation or not is judged according to the matching result.

Further, in this embodiment of the present Application, behavior data associated with a target operation is obtained by modifying a code execution logic of an Application Programming Interface (API) corresponding to a game, specifically, when a game player plays a game before modifying the code execution logic, a window message processing function (getrawninputdata function) of the API is used to obtain the game operation in real time to obtain operation data in a corresponding game frame, and a target operation detection function of the API is used to detect the target operation in real time; after the code execution logic is modified, when a GetRawInputData function is called in the API, a second proxy function is executed firstly, and the operation data in the corresponding game picture frame when a game player performs game operation is acquired in real time through the second proxy function; and calling the first proxy function after the target operation is detected through the target operation detection function of the API, and determining behavior data associated with the detected target operation from the operation data obtained through the second proxy function.

It should be noted that the detection method provided by the embodiment of the present application can detect abnormal operation behaviors in various types of games, and the type of the applied game is not limited too much, for example, the detection method provided by the embodiment of the present application is applied to any type of games as follows:

Role-Playing games (RPG), massively Multiplayer Online Role-Playing games (MMORPG), adventure games (Adventure games), shooting games (Shooting), fighting games (FTG), strategy games (SLG), racing games (RACG, RAC/RCG), chess games (TAble games, TAB), music games (Music games, MUG/MSC), and the like.

The shooting game belongs to a branch of action games (ACT), and comprises a First-person shooting game, a third-person shooting game and the like, wherein the FPS game plays the shooting game from a subjective perspective of a game player, and the game players do not operate virtual characters in a screen to play like other games, but experience visual impact brought by the game in the scene, so that the initiative and the sense of reality of the game are enhanced, and the game is gradually favored by the game players.

Further, when the detection method provided by the embodiment of the present application is applied to a certain type of game, the target operation may be a game operation in the certain type of game, may be a game operation in a specified scene in the certain type of game, or may be a game operation in a specified game in the certain type of game; when the provided detection method is applied to a plurality of types of games, the above-described target operation may be the same game operation among the different types of games.

Still further, the above-described target operation may include, but is not limited to, one or more of the following: the operation of killing a target object in the game, the operation of aiming at the target object in the game, the operation of preempting a target resource in the game, the operation of changing the game orientation of the game, and the operation of defeating a game opponent in a game battle.

It should be noted that the above-mentioned game orientation may be, but is not limited to, the viewing direction of the game player in the FPS game, or the viewing direction of the game player in the third person-named shooting-type game.

The abnormal operation behavior detection method provided by the present application is described in detail below with reference to the accompanying drawings.

Fig. 1 is a schematic view of an application scenario of abnormal operation behavior detection provided in the embodiment of the present application. The application scenario includes a game player 10, a terminal device 11, a server 12, and a server 13. The terminal device 11 is installed with a game client, and the server 12 is a server for a game player to log in through the game client.

The game player 10 logs in the game through the game client and performs game operation; the game client and the server are matched to control the game player to the game role. The terminal device 11 and the server 12 send the behavior data triggered by the game player to the server 13, the server 13 analyzes the data distribution characteristics of the behavior data, then the server 13 matches the data distribution characteristics of the acquired behavior data with the data mutation characteristics, and determines whether the game player has abnormal operation behaviors according to the matching result.

As an example, when it is determined that the game player has the abnormal operation behavior, the server 13 may further notify the server 12 to punish the corresponding game player, for example, to limit the corresponding game player to be unable to perform the game operation within a set time period, or to log in the game client.

Fig. 2 is a schematic view of another application scenario of abnormal operation behavior detection according to an embodiment of the present application. The application scenario includes a game player 10, a terminal device 11, and a server 22. The terminal device 11 is installed with a game client, and the server 22 is a server for a game player to log in through the game client.

The game player 10 logs in the game via the game client and performs a game operation. The game client and server 22 cooperate to accomplish the game player's control of the game character. The terminal device 11 may obtain behavior data triggered by the game player, match the data distribution characteristics of the obtained behavior data with the data mutation characteristics, and determine whether the game player has an abnormal operation behavior according to the matching result.

As an embodiment, when the terminal device 11 determines that the game player has the abnormal operation behavior, the terminal device 11 notifies the server 22 that the corresponding game player has the abnormal operation behavior, and after receiving the notification, the server 22 penalizes the corresponding game player, for example, the corresponding game player is limited to be unable to perform the game operation within a set time length, unable to log in the game client, and the like.

The terminal device 11 may be, but is not limited to, a device supporting running of a game client, such as a mobile phone, a tablet computer, a notebook computer, and a PC; the server 12 and the server 13 may be the same server or different servers, and the server 12, the server 13, and the server 22 may be, but are not limited to, a cloud server or a server in a blockchain system.

The following describes in detail the method for detecting abnormal operation behavior provided in the embodiment of the present application with reference to the above two scenarios.

Referring to fig. 3, an embodiment of the present application provides a method for detecting an abnormal operation behavior, which may be applied to the application scenario shown in fig. 1 or fig. 2, but is not limited to the application scenario, and specifically includes the following steps:

in step S301, behavior data associated with a target operation by a game player is acquired from a set number of game screen frames including the target operation.

Specifically, when the input device is a mouse, the above-mentioned behavior data may include, but is not limited to, one or a combination of a plurality of information including a cursor position of the mouse in the corresponding game screen frame, a key operation of the mouse in the corresponding game screen frame, a movement value of the cursor position of the mouse in the corresponding game screen frame and a cursor position in a game screen frame before the corresponding game screen frame, and the like.

As an example, the set number of game screen frames may include: a first set number of game frame before a target game frame corresponding to the target operation; or the set number of game frame includes: the number of game frames is set from a second set number of game frames before the target game frame to a third set number of game frames after the target game frame.

In the embodiment of the present application, in consideration of data volume requirements and data processing efficiency, the set number may be set to 500 frames, 600 frames, and the like, but is not limited to, the first set number may be set to 600 frames, and the sum of the second set number and the third set number may be set to 600 frames, and the like. In addition, considering that if the game player achieves the target operation by the abnormal operation behavior of the operation data simulating the normal game operation, the possibility that the behavior data suddenly changes before the target operation is performed is relatively high, when setting the specific numerical values of the above-mentioned second set number and third set number, the numerical value of the second set number may be set to a numerical value larger than the third set number, such as setting the second set number to 500 frames, setting the third set number to 100 frames, and the like.

It should be noted that the specific values of the set number, the first set number, the second set number and the third set number are only values set for easy understanding, and are not limited thereto, and those skilled in the art can flexibly set the specific values of the set numbers in consideration of the data amount requirement and the data processing efficiency requirement.

Step S302, matching the data distribution characteristics of the behavior data with data mutation characteristics, which are determined in advance according to the behavior data of the abnormal operation behavior associated with the target operation, to determine whether the game player has an abnormal operation behavior.

According to the data analysis, the distribution characteristics of a plurality of behavior data triggered by a game player during normal game operation generally change uniformly and smoothly according to the sequence or triggering time sequence of the corresponding game picture frames, that is, the behavior data continuously triggered by the game player in the game does not have obvious mutation, so that when the data distribution characteristics of the behavior data are analyzed, the acquired behavior data can be sequenced according to the sequence of the corresponding game picture frames, and the data distribution characteristics of the sequenced behavior data are analyzed, wherein the sequence of the game picture frames corresponding to the behavior data in the game can be the sequence of the triggering time of the behavior data.

As an embodiment, when the data distribution characteristics of the behavior data are matched with the data mutation characteristics, the acquired behavior data may be analyzed as a whole; in consideration of data analysis efficiency and resource consumption during data analysis, the acquired behavior data may be divided into a plurality of behavior data groups, and then data distribution characteristics of each behavior data group may be analyzed, which will be described in detail below:

the first data analysis mode is as follows: the obtained behavior data are analyzed as a whole.

When the game player performs normal game operation, the triggered behavior data does not change continuously and suddenly, so that whether abnormal operation behaviors exist in the game player can be determined according to the quantity of the sudden change data segments in the behavior data.

Specifically, the acquired behavior data may be sorted according to the sequence of the game picture frames corresponding to the acquired behavior data; further determining abrupt change data segments of the behavior data, wherein the data distribution characteristics of the data segments are matched with the abrupt change characteristics of the data segments, and each abrupt change data segment comprises behavior data obtained from at least two continuous frames of game picture frames;

and if the quantity of the mutation data segments in the behavior data meets a first threshold value, determining that abnormal operation behaviors exist in the game player.

The first threshold is not limited, and one skilled in the art can set it according to actual requirements, such as setting it to 5 or 10.

The second data analysis mode is as follows: and analyzing the obtained behavior data groups.

In the same way, the behavior data triggered by the game player during normal game operation can not be continuously and suddenly changed, and meanwhile, the behavior data is grouped and analyzed whether a sudden change data set exists or not in consideration of the data processing efficiency and the time requirement.

Specifically, the behavior data may be sorted according to the sequence of the game frame corresponding to the behavior data, and the sorted behavior data may be divided into different behavior data groups based on the sorting of the behavior data;

aiming at each behavior data group, determining mutation data segments of which the data distribution characteristics in the behavior data group are matched with the data mutation characteristics, wherein each mutation data segment comprises behavior data obtained from at least two continuous frames of game picture frames;

and if the quantity of the behavior data groups with the mutation data segments meets a second threshold value, determining that the game player has abnormal operation behaviors.

Furthermore, in consideration of the resource occupation situation during data analysis, the mutation data segments in each behavior data group can be determined in sequence according to the specified sequence of the behavior data groups; in consideration of time efficiency of data analysis, at least two behavior data sets may be analyzed in parallel at a time to determine the mutation data segment in each behavior data set, and mutation data sets in all behavior data sets may be determined in parallel.

In the embodiment of the application, the quantity of the behavior data in each behavior data group can be the same or different; and the number of the behavior data groups is not limited, and a person skilled in the art can divide the sorted behavior data into a certain number of behavior data groups according to actual requirements.

It should be noted that after the behavior data group is obtained, the behavior data of the behavior data group may be stored according to a specific data structure, for example, when the behavior data group includes k behavior data, the behavior data of the behavior data group may be stored by gap _ deltax [ i ], where i is an arrangement order of the ith behavior data in the k behavior data.

As an embodiment, when the methods provided in steps S301 to S302 are applied to a game server, the behavior data is obtained and sent to the game server after the game client detects the target operation; when the methods provided in steps S301 to S302 are applied to a game client, the behavior data is obtained after the game client detects that a game player performs the target operation.

Further, after determining that the game player has an abnormal operation behavior in step S302, the game server may punish the game player, and limit that the game player cannot perform a game operation within a set duration, or cannot log in to a game client; after determining that the game player has an abnormal operation behavior in 302, the game client may notify the game server of punishing the game player, where the punishing manner may refer to the above.

As an embodiment, the following provides a process of a game client detecting a target operation and acquiring behavior data:

in general, a window message processing function in an API corresponding to a game monitors a window INPUT (VM _ INPUT) message, and after the VM _ INPUT is monitored, the VM _ INPUT message is processed, and the processing process needs to call a getrawninputdata function in the API to obtain behavior data of an INPUT device.

Modifying code execution logic in the API, and acquiring behavior data through the proxy function, specifically, when a target operation is detected by a target operation detection function of the API corresponding to the game, calling a first proxy function, and determining behavior data corresponding to the target operation from operation data obtained through a second proxy function, wherein the second proxy function is used for acquiring operation data of the target operation in a corresponding game picture frame in real time;

and after determining the behavior data corresponding to the target operation, calling the target operation detection function to detect the target operation.

In the embodiment of the present application, the calling order of the getrawninputdata function in the API is modified by modifying the instruction code at the head of the getrawninputdata function in the API, please refer to fig. 4, first register the input device using the register rawninputdevices function in the master function of the game code, then when the game or game engine calls the getrawninputdata function of the API, according to the modified code execution logic, first call the second proxy function (mygetrawninputdata function), that is, the second proxy function and the getrawninputdata function are called in a loop, in the process of being called in a loop, first execute the second proxy function, collect behavior data from the game frame in real time, jump the getrawninputdata function after the collection of the behavior data is finished, and continue to execute the code logic before the API modification; and similarly, after the target operation is detected through a target operation detection function in the API, calling a first proxy function, and determining behavior data corresponding to the target operation from the operation data obtained through a second proxy function.

Referring to fig. 5, before a code execution logic of the API is not modified, each instruction is sequentially executed according to an order of an original instruction 1, an original instruction 2, and an original instruction 3, after the code execution logic of the API is modified, a first step is executed through the jump instruction after the original instruction 1 is executed, and then a second step is executed through the function call instruction, a user-defined stub function is called, where the user-defined stub function may be the first proxy function or the second proxy function; and after the execution of the user-defined stub function is finished, executing a register reduction instruction, then executing a third step back to the original instruction 2 through another jump instruction, executing a fourth step through the jump instruction after the execution of the original instruction 2 is finished, and jumping back to the original instruction 3 for execution.

In order to facilitate the first processing function to obtain the required behavior data, the behavior data collected by the second proxy function may be temporarily stored in a specific storage structure or a memory, and after the target operation detection function detects the target operation, the behavior data associated with the target operation may be directly obtained from the specific storage structure or the memory through the first proxy function, as shown in fig. 6, in order to improve the efficiency of detecting the abnormal operation behavior, an embodiment of the present application further provides a circular queue storage structure, where the circular queue storage structure may store the behavior data obtained from a set number of game frame associated with the target operation, where the circular queue storage structure may store a certain amount of behavior data, for example, the circular queue storage structure is set as a storage structure storing 600 behavior data, and the behavior data collected from 600 game frame may store behavior data triggered by an input device for 6 seconds according to the FPS value of the game being 100, where the data amount is sufficient for analyzing the data distribution characteristics of the behavior data, where the FPS value refers to the number of game frame transmitted per second.

As an example, the behavior data in the embodiment of the present application may include operation position information of the target operation in the corresponding target game screen frame, where the operation position information may be a cursor position of the input device in the target game screen frame corresponding to the target operation, or a position movement value of a cursor position of the input device in the target game screen frame corresponding to the target operation and a cursor position in a game screen frame previous to the target game screen frame.

The position movement value may include one or more of the following movement values:

a composite movement value, i.e., a difference between a cursor position of the input device in the target game frame and a cursor position in a game frame previous to the target game frame;

a lateral movement value, i.e. the difference between the lateral position of the cursor position in the target game frame and the lateral position of the cursor position in the previous game frame of the target game frame by the input device;

the vertical movement value is the difference between the vertical position of the cursor position in the target game frame and the vertical position of the cursor position in the previous game frame of the target game frame.

It should be noted that, since the getrawninputdata function generally directly obtains one or more information combinations of the lateral movement value and the lateral movement value, when the position movement value includes the lateral movement value or the vertical movement value, the second proxy function may be designed to directly obtain the lateral movement value or the vertical movement value; when the position movement value is the comprehensive movement value, a second proxy function can be designed to directly obtain the comprehensive movement value, and also can be designed to directly obtain the transverse movement value and the longitudinal movement value, and then the corresponding comprehensive movement value is obtained by calculating the transverse movement value and the longitudinal movement value through a set algorithm.

The target operation is an operation of killing a target object in a game, when the behavior data includes operation position information, the abnormal operation behavior may be that a game player performs the target operation using a plug-in, the operation position information of the behavior data does not change suddenly in a normal game operation process, but when the game player performs the target operation using the plug-in, the operation position information of the behavior data adjacent to a trigger time may change suddenly, in which case, the data mutation characteristic may include one or more of a first device operation position mutation, a device movement trend mutation, and a device key operation abnormality, so that a mutation data segment in the first data analysis manner or the second data analysis manner may be determined according to the operation position information in the acquired behavior data, based on which, the embodiment of the present application provides several mutation determination manners for determining a mutation data segment, which are specifically as follows:

(first), the first mutation determination method: the data mutation characteristic comprises a first device operation position mutation

In this case, the mutation data section includes a first data group in which a position change characteristic determined based on operation position information of the behavior data in the first data group matches a first device operation position mutation, the first data group including behavior data sorted in first sequential order bits.

Further, the position change feature may include a first displacement amount determined based on the position shift value of the behavior data arranged in series, and the abrupt change data segment may include a first data group in which the first displacement amount determined based on the position shift value of the behavior data is not less than a first displacement amount threshold value.

Specifically, the difference between the position movement values of two behavior data that are consecutively arranged in the first data group may be sequentially determined as the first displacement amount in the order of arrangement of the behavior data; and

for any one first data group, if all first displacement amounts determined based on the behavior data in the first data group are not smaller than a first displacement amount threshold value, determining the first data group as a mutation data section; or, if, in the first displacement amounts determined based on the behavior data in the first data group, the number of the first displacement amounts not smaller than the first displacement amount threshold is greater than a fourth set number, the first data group is determined as a sudden change data segment, where the fourth set number is not limited, and those skilled in the art may set the data segment according to actual requirements.

When determining the first displacement amount, a difference value of the integrated displacement values of two pieces of behavior data arranged in series may be determined as the first displacement amount, a difference value of the lateral displacement values of two pieces of behavior data arranged in series may be determined as the first displacement amount, or a difference value of the longitudinal displacement values of two pieces of behavior data arranged in series may be determined as the first displacement amount.

An example of determining the data mutation segment based on the first displacement amount is given below.

In this example, the first sequential bits may be any three sequential positions in the arrangement order of the behavior data or three designated sequential positions, and the first data group includes three sequentially arranged behavior data, and for convenience of understanding, the three sequentially arranged behavior data are respectively denoted as first behavior data, second behavior data, and third behavior data according to the arrangement order of the behavior data.

Determining a first difference value of the position shift values of the second behavior data and the first behavior data as a first shift amount; and determining a second difference value of the position shift values of the third behavior data and the second behavior data as a first shift amount; and if the absolute values of the two first displacement quantities are not less than the first displacement quantity threshold value, determining a first data group consisting of the first behavior data, the second behavior data and the third behavior data as a sudden change data section.

That is, if behavior data is stored in a data structure of gap _ delta [ i ], if | gap _ delta [ i +1]. Deltax-gap _ delta [ i +1]. Detal | > B and | gap _ delta [ i +2]. Deltax-gap _ delta [ i ]. Detal | > B are established, the first data group consisting of the first behavior data, the second behavior data, and the third behavior data is determined to be one abrupt data segment, and the first data segment consisting of the behavior data arranged in the i-th, i + 1-th, and i + 2-th order is determined to be one first data group, where i is the arrangement order of the behavior data and B is the first displacement threshold.

Referring to fig. 7, a lateral movement value of the behavior data is taken as an example for description, when a game player performs a normal game operation, a data distribution of the lateral movement value of the behavior data is shown as a line 701, when the game player performs an abnormal operation behavior, a data distribution of the lateral movement value of the behavior data is shown as a line 702, in the figure, horizontally arranged numbers 1 to 14 are an arrangement sequence of the behavior data, the arrangement sequence may be an arrangement sequence of game screen frames corresponding to the behavior data, and vertically arranged numbers 1 to 7 are schematic values of the lateral movement value of the behavior data; taking 3 first shift thresholds as an example, the above process is to find the behavior data that matches the mutation feature 703.

Further, on the basis of the above, whether the data group is a sudden change data segment or not can be judged according to the position movement speed characteristics represented by the first difference and the second difference, and if the data symbol of the first difference is positive, the position movement value representing the first behavior data is larger than the position movement value representing the second behavior data, which indicates that the relative speed of the cursor position movement of the mobile device is slowed down; when the data sign of the first difference value is negative, the position movement value representing the first behavior data is smaller than the position movement value representing the second behavior data, specifically, when the absolute value of the first difference value and the absolute value of the second difference value are not smaller than the first position quantity threshold, the relative speed representing the movement of the cursor position of the mobile device is faster, so that the mutation data group can be determined based on the position movement speed characteristics reflected by the data sign of the first difference value and the data sign of the second difference value.

Specifically, if the absolute value of the first displacement corresponding to the first difference is not less than the first displacement threshold, and the absolute value of the first displacement corresponding to the second difference is not less than the first displacement threshold, and the data sign of the first difference is opposite to the data sign of the second difference, the first data group consisting of the first behavior data, the second behavior data, and the third behavior data is determined as a mutation data segment.

That is, when the behavior data is stored in a data structure of gap _ delta [ i ], if | gap _ delta [ i +1]. Delta-gap _ delta [ i +1]. Delta | = B, and | gap _ delta [ i +2]. Delta-gap _ delta [ i ]. Delta | = B, and the data symbol of (gap _ delta [ i +1]. Delta-gap _ delta [ i +1]. Delta) is opposite to that of (gap _ delta [ i +2]. Delta [ i +1]. Delta) and (gap _ delta [ i ]. Delta-gap _ delta [ i ]. Delta ]), the behavior data at the arrangement positions of i, i +1 and i +2 is a data mutation segment, where i is the arrangement order of the behavior data, and B is the first displacement threshold value.

Please refer to fig. 8, which still takes the lateral movement value of the behavior data as an example for description, the data distribution of the lateral movement value of the behavior data when the game player performs normal game operation is shown as a line 701, the data distribution of the lateral movement value of the behavior data when the game player performs abnormal operation behavior is shown as a line 802, the numbers 1 to 14 arranged laterally in the figure are the arrangement sequence of the behavior data, the arrangement sequence may be the arrangement sequence of the game frame corresponding to the behavior data, and the numbers 1 to 4 arranged vertically are schematic values of the lateral movement value of the behavior data; taking the example of 3 first displacement thresholds, the above process is to determine the behavior data corresponding to the sharp corner feature 803 in the figure.

In addition, the horizontal movement value may be replaced by a vertical movement value or a composite movement value, and the rest of the process may refer to the above description and will not be repeated.

(II), a second mutation determination method: the data abrupt change characteristics comprise abrupt change of equipment motion trend

In this case, the abrupt change data segment includes a second data group in which the device movement trend characteristic is abruptly matched with the device movement trend, the second data group includes behavior data sorted in a second consecutive rank, and the device movement trend characteristic is determined based on the operation position information of the behavior data in the second data group;

in general, when a game player performs normal game operation, the movement trend of the input device does not change suddenly, that is, the position change trend between operation position information between continuous behavior data does not change suddenly, so that whether the game player has abnormal operation behavior can be judged by judging whether the position change trend in the continuous behavior data changes suddenly.

The above-mentioned device motion tendency may include abnormal operation data determined based on the position movement values of the behavior data arranged in series, and the abrupt change data piece may include a second data group in which the number of abnormal operation data determined based on the position movement values of the behavior data is not more than the abnormal data threshold value.

Specifically, the difference between the position movement values of two behavior data that are continuously arranged in the second data group may be sequentially determined as a second displacement amount according to the arrangement order of the behavior data, and the different second displacement amounts correspond to different behavior data;

for any second data group, determining a second displacement which is not less than a second displacement threshold, sequencing the determined second displacement according to the arrangement position of the corresponding behavior data, and determining the behavior data between the behavior data corresponding to two adjacent second displacement after sequencing to be the abnormal operation data;

and if the quantity of abnormal operation data between behavior data corresponding to two adjacent second displacement quantities in the second data group is not larger than the set abnormal quantity threshold value, determining the second data group as a mutation data segment.

When the second displacement amount is determined, the difference between the integrated displacement values of the two pieces of behavior data that are arranged in series may be determined as the second displacement amount, the difference between the lateral displacement values of the two pieces of behavior data that are arranged in series may also be determined as the second displacement amount, and the difference between the longitudinal displacement values of the two pieces of behavior data that are arranged in series may also be determined as the second displacement amount.

An example of determining the data mutation segment based on the second displacement amount is given below.

In this example, the threshold value of the number of anomalies is 5, the second consecutive ordinal position may be any 10 consecutive positions or 10 consecutive positions specified in the arrangement order of the behavior data, and the second data group contains 10 consecutive behavior data.

Referring to fig. 9, the lateral movement value of the behavior data is still used as an example for description, and for the sake of understanding, the first 10 consecutively arranged behavior data shown by a line 902 in the figure is used as the second data set in this example, where the data distribution of the lateral movement value of the behavior data when the game player performs normal game operation is shown by a line 701, and the data distribution of the lateral movement value of the behavior data when the game player performs abnormal operation behavior is shown by a line 902; in the figure, the numbers 1 to 14 arranged horizontally are the arrangement sequence of the behavior data, the arrangement sequence can be the arrangement position of the game picture frame corresponding to the behavior data, and the numbers 1 to 4 arranged vertically are schematic values of the horizontal movement value of the behavior data; the process in this example is to determine the behavior data that matches the abrupt change feature 903 of the device motion trend in the graph.

Specifically, for the second data group, a third difference of the lateral shift values in the 1 st behavior data and the 2 nd behavior data is determined as a second shift amount, a fourth difference of the lateral shift values in the 3 rd behavior data and the 4 th behavior data is determined as a second shift amount, a fifth difference of the lateral shift values in the 5 th behavior data and the 6 th behavior data is determined as a second shift amount, a sixth difference of the lateral shift values in the 7 th behavior data and the 8 th behavior data is determined as a second shift amount, and a seventh difference of the lateral shift values in the 9 th behavior data and the 10 th behavior data is determined as a second shift amount.

Here, taking the example that the second displacement threshold is 3 and the anomaly number threshold is 5, the second displacement not smaller than the second displacement threshold includes: a second displacement amount corresponding to the third difference value and a second displacement amount corresponding to the fourth difference value; and if no behavior data exists between the 2 nd behavior data corresponding to the third difference and the 3 rd behavior data corresponding to the fourth difference, the quantity of abnormal operation data between the 2 nd behavior data and the 3 rd behavior data is 0, and if the quantity of abnormal operation data is smaller than a set abnormal quantity threshold, the second data group is determined as a mutation data section.

(III), third mutation determination: the behavior data includes key operation instruction information of the input device.

In this case, the data mutation characteristic includes a device key operation abnormality, and the mutation data segment includes a third data group having key operation instruction information as set operation information in behavior data determined based on the third data group, where the third data group includes behavior data sorted in a third consecutive order in which a position change characteristic matches a second device operation position mutation.

In general, when a game player performs normal game operation, the key operation triggered by the input device does not change suddenly, that is, the key operation indication between consecutive behavior data does not change suddenly, so that whether the game player has abnormal operation behavior can be determined by the key operation represented by the key operation indication in the consecutive behavior data.

Taking a mouse as an input device for explanation, the key operation indication information may be mouse key values, different mouse key values correspond to different mouse key operations, and the following correspondence between the mouse key values and the mouse key operations is given: when the key value of the mouse is 1, correspondingly pressing the left mouse button; when the key value of the mouse is 2, the operation corresponding to the lifting of the left mouse button is performed, namely the operation of restoring the left mouse button from the pressed position to the default position of the left mouse button; when the key value of the mouse is 4, the operation of pressing the right mouse button is correspondingly carried out; when the mouse button value is 8, the operation of lifting the right mouse button is corresponded, namely the operation of returning the right mouse button from the pressed position to the default position.

Specifically, the third data group is first determined by the following method: a fourth data group, of which the third displacement amount determined based on the operation position information of the behavior data is not less than the third displacement amount threshold, is determined as the third data group, wherein the fourth data group includes the behavior data sorted in a fourth consecutive ordinal order.

Wherein the third displacement amount in the fourth data set may be determined with reference to the manner of determining the first displacement amount in the first mutation determination manner, which will not be described repeatedly herein; for any fourth data group, if all the corresponding third displacement quantities are not less than the third displacement quantity threshold value, determining the fourth data group as a third data group; or, if in the third displacement determined according to the behavior data in the fourth data set, if

And if the number of the third displacement amounts which are not less than the third displacement amount threshold value is greater than a fifth set number, determining the fourth data group as a third data group.

Determining a sixth set amount of behavior data before the first behavior data of the third data group as behavior data determined based on the third data group according to the arrangement sequence of the behavior data; if the key operation indication information is a mouse key value and the operation information is set to be 1 or 4, the third data group is determined as a sudden change data section if the behavior data with the mouse key value of 1 or 4 exists in the behavior data determined based on the third data group.

An example of determining the data mutation segment based on the key operation instruction information is given below.

In this example, if the fourth sequential order is any three sequential positions or three specified sequential positions in the arrangement order of the behavior data, the fourth data set may be regarded as the first data set in the first mutation determination manner, the fourth data set may be determined by replacing the first displacement threshold in the first mutation determination manner with the third displacement threshold, and if the fourth data set is determined to be a mutation data segment in the first mutation determination manner, the fourth data set may be determined as one third data set.

Referring to fig. 10, the horizontal movement value of the behavior data is still used as an example for description here, the data distribution of the horizontal movement value of the behavior data when the game player performs a normal game operation is shown as a line 701, the data distribution of the horizontal movement value of the behavior data when the game player performs an abnormal operation behavior is shown as a line 1002, the numbers 1 to 14 arranged horizontally in the figure are the arrangement order of the behavior data, the arrangement order may be the arrangement order of the game screen frames corresponding to the behavior data, and the numbers 1 to 4 arranged vertically are schematic values of the horizontal movement value of the behavior data.

Assuming that a fourth data set composed of the 10 th behavior data, the 12 th behavior data, and the 13 th behavior data in the graph is a third data set, and the sixth set number is 9 as an example, the behavior data determined based on the third data set includes the 1 st behavior data to the 9 th behavior data in the graph; if the behavior data with the mouse key value of 1 or 4 exists in the 1 st behavior data to the 9 th behavior data, determining a third data group consisting of the 10 th behavior data, the 12 th behavior data and the 13 th behavior data as a sudden change data section; further, assuming that the mouse button value of the 3 rd behavior data is 4, a third data group consisting of the 10 th behavior data, the 12 th behavior data and the 13 th behavior data is determined as a mutation data segment.

As an example, when determining the mutation data segment in the sorted behavior data or the behavior data group, only any one of the first mutation determination method to the third mutation determination method may be adopted, or a plurality of mutation determination methods may be used in combination, and an example in which the first mutation determination method to the second mutation determination method are simultaneously used in the second data analysis method is provided below.

A first combination of: the method comprises the following four processes.

The first process is as follows: firstly, the behavior data in each behavior data group are simultaneously analyzed through a first mutation determining mode, and the behavior data group with a mutation data segment and the behavior data group without the mutation data segment are determined.

The second process: and analyzing the behavior data in the behavior data group which is determined to have no mutation data section in the first process through a second mutation determination mode, and determining the behavior data group which has the mutation data section in the behavior data groups and the behavior data group which has no mutation data section in the behavior data groups.

A third process: and analyzing the behavior data in the behavior data group determined to have no mutation data section in the second process simultaneously through a third mutation determination mode to determine the behavior data group having the mutation data section and the behavior data group having no mutation data section in the behavior data groups.

A fourth process: and determining the number of the behavior groups with the mutation data segments determined in the first process to the third process, and determining that the game player has abnormal operation behaviors if the number of the behavior groups with the mutation data segments meets a second threshold value.

The second combination case: the method comprises the following four processes.

The method comprises the following steps of firstly, simultaneously analyzing behavior data in each behavior data group through a first mutation determining mode, and determining mutation data sections in each behavior data group;

a second process, analyzing the behavior data in each behavior data group simultaneously through a second mutation determining mode, and determining mutation data sections in each behavior data group;

the third process: and simultaneously analyzing the behavior data in each behavior data group through a third mutation determining mode, and determining mutation data sections in each behavior data group.

A fourth process: and determining the number of the behavior data groups with the mutation data segments through the mutation data segments determined in the first process to the second process, and determining that the abnormal operation behaviors exist in the game player if the number of the behavior data groups with the mutation data segments meets a second threshold value.

An example of detecting abnormal operation behavior in an FPS game is provided below.

Referring to fig. 11, a diagram of a game screen frame of an FPS game is provided, in which the position of the shooting tool of the game player is shown at 1101, and in which other game player 1102, other game player 1103, and other game player 1104 are displayed.

The detected abnormal operation behavior is taken as automatic aiming operation, the target event is killing operation, the input device is a mouse, and the game server identifies the automatic aiming operation as an example for explanation; the game player can simulate the key operation of the game player in normal game operation by using a plug-in mode through technical means such as an API (application programming interface) corresponding to the game or a simulation equipment driver and the like, and realize automatic aiming operation so as to realize killing operation aiming at a game target.

Referring to fig. 12, the specific interaction between the game client and the game server in the detection process is as follows:

step S1201, when the game server detects that the game player logs in the game through the game client, the modified code execution logic is sent to the game client.

It should be noted that the modified code logic herein refers to code execution logic that calls the first proxy function and the second proxy function described above.

Step S1202, the game client obtains behavior data from the game frame in real time through the second proxy function, and detects killing operations through the killing event processing function.

The second proxy function obtains behavior data triggered by the mouse through game picture frames in a RawInput or DirectInput mode.

Here, the behavior data may include the following 4 pieces of information:

the lateral movement value DeltaX of the mouse;

the longitudinal movement value DeltaY of the mouse;

a mouse Button value Button;

and the frame number CurrentFrame of the game picture frame corresponding to the behavior data triggered by the mouse is used for sequencing the acquired behavior data.

In step S1203, after the game client detects the killing operation through the killing event processing function, the game client calls the first proxy function, and obtains behavior data associated with the killing operation from the second proxy function and sends the behavior data to the game server.

In this example, the behavior data acquired from 600 frames of game frames before the killing operation occurs is determined as the behavior data associated with the killing operation, please refer to fig. 13, and if the target game frame corresponding to the killing operation is the game frame of 602 th frame, the behavior data acquired from 3 rd frame to 602 th frame is acquired and sent to the game server.

Step S1204, the game server receives the behavior data associated with the killing operation, matches the data distribution characteristics of the behavior data associated with the killing operation with the data mutation characteristics, and determines whether the game player has abnormal operation behavior.

The specific determination process of this step can be referred to above, and will not be described repeatedly here.

In step S1205, after the game server determines that the game player has an abnormal operation behavior, the game server sends a punishment operation instruction for the game player to the game client.

The embodiment of the application provides a scheme for detecting abnormal operation behaviors according to behavior data triggered by input equipment, and the abnormal operation behaviors of the operation data simulating normal game operation can be detected according to whether the data distribution characteristics of the behavior data associated with target operation are mutated, so that the accuracy of detecting the abnormal operation behaviors in a game is improved.

Referring to fig. 14, based on the same inventive concept, an embodiment of the present application provides an abnormality detection apparatus 1400, including:

behavior data acquiring means 1401 for acquiring behavior data of a game player with respect to a target operation from a set number of game screen frames associated with the target operation;

an operation behavior determination unit 1402, configured to match a data distribution characteristic of the behavior data with a data mutation characteristic, which is determined in advance from behavior data of an abnormal operation behavior with respect to the target operation, and determine whether the game player has an abnormal operation behavior.

As an embodiment, the set number of game frame includes: a first set number of game frame before the target game frame corresponding to the target operation; or

The game frame of the set number includes: the number of game frames is set from a second set number of game frames before the target game frame to a third set number of game frames after the target game frame.

As an embodiment, the operation behavior determining unit 1402 is specifically configured to:

sequencing the behavior data according to the sequence of the game picture frames corresponding to the behavior data;

determining abrupt change data segments of the behavior data, wherein the data distribution characteristics of the abrupt change data segments are matched with the data abrupt change characteristics, and each abrupt change data segment comprises behavior data obtained from at least two continuous frames of game picture frames;

and if the quantity of the mutation data segments meets a first threshold value, determining that abnormal operation behaviors exist in the game player.

the behavior data are sorted according to the sequence of the game picture frames corresponding to the behavior data, and the sorted behavior data are divided into different behavior data groups based on the sorting of the behavior data;

and if the number of the behavior data sets with the mutation data segments meets a second threshold value, determining that abnormal operation behaviors exist in the game player.

As an example, the above-mentioned target operation includes one or more of the following operations: the operation of killing the target object in the game; an operation of aiming at a target object in the game; preempting the operation of target resources in the game; an operation of changing a game orientation of the game; the game play defeats the operation of the game opponent.

As an embodiment, the target operation is an operation of killing a target object in a game, the behavior data includes operation position information of the target operation in a corresponding target game screen frame, the abnormal operation behavior includes executing the target operation by using a plug-in, and the data mutation characteristic includes one or more of a first device operation position mutation, a device movement trend mutation and a device key operation abnormality, where:

when the data mutation characteristic comprises a first device operation position mutation, the mutation data segment comprises a first data set of which the position change characteristic is matched with the first device operation position mutation, the first data set comprises behavior data which are sequenced in a first continuous sequence, and the position change characteristic is determined based on operation position information of the behavior data in the first data set;

the abrupt change data characteristic comprises an abrupt change of equipment movement trend, the abrupt change data segment comprises a second data group of which the equipment movement trend characteristic is matched with the abrupt change of the equipment movement trend, the second data group comprises behavior data which are ordered in a second continuous ordinal order, and the equipment movement trend characteristic is determined based on the operation position information of the behavior data in the second data group;

the behavior data includes key operation instruction information of the input device, the data mutation characteristic includes device key operation abnormality, and the mutation data segment includes a third data group having key operation instruction information as set operation information among behavior data determined based on a third data group including behavior data sorted in a third sequential order having position change characteristics matching with second device operation position mutation.

As an embodiment, the behavior data acquiring unit 1401 is specifically configured to:

when the target operation is detected by a target operation detection function of an application program interface API corresponding to the game, calling a first proxy function, and determining behavior data associated with the target operation from operation data obtained by a second proxy function, wherein: the second proxy function is used for acquiring operation data of the target operation in a corresponding game picture frame in real time;

As an embodiment, the anomaly detection device 1400 is a game server device, and the behavior data is obtained and sent by the game client after detecting the target operation;

as an example, the anomaly detection device 1400 is a game client device, and the behavior data is acquired after detecting that the game player performs the target operation.

The anomaly detection apparatus 1400 is a computer device shown in fig. 15 as an example of a hardware entity, and the computer device includes a processor 1501, a storage medium 1502, and at least one external communication interface 1503; the processor 1501, the storage medium 1502, and the external communication interface 1503 are connected by a bus 1504.

The storage medium 1502 stores therein a computer program;

the processor 1501 implements the method of navigation of the mobile device discussed earlier when executing the computer program.

Fig. 15 illustrates an example of one processor 1501, but the number of processors 1501 is not limited in practice.

The storage medium 1502 may be a volatile storage medium (volatile memory), such as a random-access memory (RAM); the storage medium 1502 may also be a non-volatile storage medium (non-volatile memory), such as a read-only storage medium, a flash memory (flash memory), a hard disk (HDD) or solid-state drive (SSD), or the storage medium 1502 may be any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited to such. The storage medium 1502 may be a combination of the storage media described above.

The functions of the various modules of the anomaly detection apparatus 1400 in FIG. 14 can be implemented by the processor 1501 in FIG. 15, as an example.

The abnormality detection apparatus 1400 is another example of a hardware entity, such as a terminal device shown in fig. 16, and the terminal device is described below.

Referring to fig. 16, the terminal device 11 includes a display unit 1640, a processor 1680 and a memory 1620, where the display unit 1640 includes a display panel 1641 for displaying game frame and information input by a game player, and is mainly used for displaying each game frame, shortcut window, and the like of a game client installed in the terminal device 11 in the embodiment of the present application.

Alternatively, the Display panel 1641 may be configured in the form of a Liquid Crystal Display (LCD), an Organic Light-Emitting Diode (OLED), or the like.

The processor 1680 is used to read the computer program and then execute a method defined by the computer program, for example, the processor 1680 reads various kinds of data of the game client and the like, thereby running an application on the terminal device 11 and displaying a game screen frame of the game on the display unit 1640. The Processor 1680 may include one or more general-purpose processors, and may further include one or more DSPs (Digital Signal processors) for performing related operations to implement the technical solutions provided by the embodiments of the present application.

Memory 1620 generally includes both internal and external memory, which may be Random Access Memory (RAM), read Only Memory (ROM), and CACHE (CACHE). The external memory can be a hard disk, an optical disk, a USB disk, a floppy disk or a tape drive. The memory 1620 is used for storing computer programs including application programs corresponding to clients and the like, and other data which may include data generated after an operating system or an application program is executed, including system data (such as configuration parameters of the operating system) and data of game players. In the embodiment of the present application, the program instructions are stored in the memory 1620, and the processor 1680 executes the program instructions stored in the memory 1620 to implement any one of the methods for detecting abnormal operation behavior discussed in the previous figures.

Further, the terminal device 11 may further include a display unit 1640 for receiving numerical information, character information, or contact touch operation/non-contact gesture input by a game player through an input device, and generating signal input related to user setting and function control of the terminal device 11, and the like. Specifically, in the embodiment of the present application, the display unit 1640 may include a display panel 1641. Display panel 1641, such as a touch screen, can collect touch operations of a game player on or near the display panel 1641 (e.g., operations of a game player on display panel 1641 or on display panel 1641 using any suitable object or accessory such as a finger, a stylus, etc.) and drive corresponding connected devices according to a predetermined program. Alternatively, the display panel 1641 may include two portions of a touch detection device and a touch controller. The touch detection device detects the touch direction of a player, detects a signal brought by touch operation and transmits the signal to the touch controller; the touch controller receives touch information from the touch sensing device, converts the touch information into touch point coordinates, and sends the touch point coordinates to the processor 1680, and can receive and execute commands sent by the processor 1680. In the embodiment of the present application, if a game player clicks a game client, a touch detection device in the display panel 1641 detects a touch operation, and a touch controller transmits a signal corresponding to the detected touch operation, the touch controller converts the signal into a touch point coordinate and transmits the touch point coordinate to the processor 1680, and the processor 1680 determines operation information of the game player according to the received touch point coordinate.

The display panel 1641 may be implemented by various types, such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the display unit 1640, the terminal device 11 may further include an input unit 1630, and the input unit 1630 may include, but is not limited to, one or more of a physical keyboard, function keys (such as volume control keys, switch keys, etc.), a trackball, a mouse, a joystick, and the like.

In addition to the above, the terminal device 11 may further include a power supply 1690 for supplying power to other modules, an audio circuit 1660, a near field communication module 1670, and an RF circuit 1610. The terminal device 11 may also include one or more sensors 1650, such as acceleration sensors, light sensors, pressure sensors, and the like. The audio circuit 1660 specifically includes a speaker 1661 and a microphone 1662, for example, the terminal device 11 can collect the voice of the game player through the microphone 1662 to perform corresponding game operations, etc.

For example, the number of the processors 1680 may be one or more, and the processors 1680 and the memory 1620 may be in a coupled configuration or may be in a relatively independent configuration.

As an embodiment, the processor 1680 in fig. 16 may be used to implement the functions of the behavior data acquiring unit 1401 and the operation behavior determining unit 1402 in fig. 14.

Based on the same technical concept, the embodiment of the present application also provides a computer-readable storage medium, which stores computer instructions that, when executed on a computer, cause the computer to execute the objective function determination method as discussed above.

As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.

It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.

Claims

1. A method for detecting abnormal operating behavior, comprising:

acquiring behavior data associated with target operations by a game player from a set number of game picture frames containing the target operations, wherein the target operations are operations for killing target objects in a game, and the behavior data comprises operation position information of the target operations in the corresponding target game picture frames and key operation indication information of an input device;

matching data distribution characteristics of the behavior data with data mutation characteristics to determine whether abnormal operation behaviors exist in the game player, wherein the data mutation characteristics are determined in advance according to behavior data of the abnormal operation behaviors related to the target operation, the data mutation characteristics comprise a first device operation position mutation, a device movement trend mutation and a device key operation abnormality, a data mutation section comprises a first data group of which the position change characteristics are matched with the first device operation position mutation, a second data group of which the device movement trend characteristics are matched with the device movement trend mutation, and a third data group of which key operation indication information is set operation information is present in the behavior data determined based on the third data group, the first data group comprises behavior data sorted in a first continuous sequence, the position change characteristics are determined based on operation position information of the behavior data in the first data group, the device movement trend characteristics are determined based on operation position information of the behavior data in the second data group, and the third data group comprises operation target operation data sorted in a third sequence matched with the second device operation position, and the abnormal operation behaviors are determined by using the third data sorted in the continuous sequence.

2. The method of claim 1, wherein the set number of game frame includes: a first set number of game frame frames before a target game frame corresponding to the target operation; or

The set number of game frame includes: the number of game picture frames is set from the second set number of game picture frames before the target game picture frame to the third set number of game picture frames after the target game picture frame.

3. The method of claim 1, wherein said matching the data distribution characteristics of the behavior data with the data mutation characteristics to determine whether the game player has abnormal operation behavior comprises:

4. The method of claim 1, wherein the matching the data distribution characteristics of the behavior data with data mutation characteristics and determining whether the game player has abnormal operation behavior according to the matching result comprises:

sequencing the behavior data according to the sequence of the game picture frames corresponding to the behavior data, and dividing the sequenced behavior data into different behavior data groups based on the sequencing of the behavior data;

for each behavior data group, determining mutation data segments of which the data distribution characteristics in the behavior data group are matched with the data mutation characteristics, wherein each mutation data segment comprises behavior data obtained from at least two continuous game picture frames;

5. The method of any of claims 1-4, wherein the target operation further comprises one or more of:

an operation of aiming at a target object in the game;

preempting the operation of target resources in the game;

an operation of changing a game orientation of the game;

the game against defeats the operation of the game opponent.

6. The method of any one of claims 1-4, wherein the obtaining behavior data corresponding to a target operation of a game player in a game comprises:

when a target operation detection function of an application program interface API corresponding to the game detects the target operation, calling a first proxy function, and determining behavior data associated with the target operation from operation data obtained through a second proxy function, wherein: the second proxy function is used for acquiring operation data of the target operation in a corresponding game picture frame in real time;

7. An apparatus for detecting abnormal operation behavior, comprising:

a behavior data acquisition unit configured to acquire, from a set number of game screen frames including a target operation that is an operation of killing a target object in a game, behavior data associated with the target operation by a game player, the behavior data including operation position information of the target operation in the corresponding target game screen frame and key operation instruction information of an input device;

an operation behavior determination unit, configured to match a data distribution feature of the behavior data with a data mutation feature, and determine whether an abnormal operation behavior exists in the game player, where the data mutation feature is determined in advance according to behavior data of the abnormal operation behavior associated with the target operation, the data mutation feature includes a first device operation position mutation, a device movement trend mutation, and a device key operation abnormality, a data mutation segment includes a first data group whose position change feature matches the first device operation position mutation, a second data group whose device movement trend feature matches the device movement trend mutation, and the third data group whose operation indication information is set operation information is present in behavior data determined based on a third data group, the first data group includes behavior data sorted in a first continuous order bit, the position change feature is determined based on operation position information of behavior data in the first data group, the device movement feature is determined based on operation position information of behavior data in the second data group, and the third data group includes a third data group whose position change feature matches the second device movement trend mutation position information, and the operation position information of the abnormal operation behavior data is determined based on operation position information of the second data, and the abnormal operation behavior data includes a target operation behavior data.

8. The apparatus of claim 7, wherein the set number of game frame includes: a first set number of game frame frames before a target game frame corresponding to the target operation; or

9. The apparatus as claimed in claim 7, wherein said operation behavior determination unit is specifically configured to:

determining abrupt change data segments of which the data distribution characteristics are matched with the data abrupt change characteristics in the behavior data, wherein each abrupt change data segment comprises behavior data obtained from at least two continuous frames of game picture frames;

10. The apparatus as claimed in claim 7, wherein said operation behavior determination unit is specifically configured to:

11. The apparatus of any of claims 7-10, wherein the target operation further comprises one or more of:

an operation of aiming at a target object in the game;

preempting the operation of target resources in the game;

an operation of changing a game orientation of the game;

the game against defeats the operation of the game opponent.

12. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the steps of the method of any of claims 1-6 are implemented when the program is executed by the processor.

13. A computer-readable storage medium having stored thereon computer instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1-6.