CN115501612A

CN115501612A - Method and device for detecting plug-in game, storage medium and processor

Info

Publication number: CN115501612A
Application number: CN202211072219.3A
Authority: CN
Inventors: 邬奇
Original assignee: Netease Hangzhou Network Co Ltd
Current assignee: Netease Hangzhou Network Co Ltd
Priority date: 2022-09-02
Filing date: 2022-09-02
Publication date: 2022-12-23

Abstract

The invention discloses a method and a device for detecting plug-in a game, a storage medium and a processor. The method comprises the following steps: acquiring operation data of an account to be detected in a game; extracting feature data associated with the plug-in behavior from the operation data; and sending the characteristic data to a server so that the server performs plug-in detection on the characteristic data to obtain a detection result and receives the detection result from the server. The invention solves the technical problem of low external hanging detection efficiency in games.

Description

Method and device for detecting plug-in game, storage medium and processor

Technical Field

The invention relates to the technical field of games, in particular to a plug-in detection method, a plug-in detection device, a storage medium and a processor in a game.

Background

The game plug-in is also called as plug-in, benefits are consummated for players by modifying game data, and balance and fairness of the game are seriously damaged. With the development of game technology, a large number of clicker script plug-ins appear, and the plug-ins can simulate the operation of normal players to move around, release skills, have higher concealment and have longer duration.

At present, when detecting plug-in of a game, usually only click operation under fixed coordinates can be identified, and sliding operation cannot be identified, so that the detection method for the fixed coordinate point has certain limitation. In addition, the data stream uploaded in the game operation process is large, and the server cannot process the huge data stream in a normal operation state, so that the efficiency of detecting the plug-in the game is low.

In view of the above problems, no effective solution has been proposed.

Disclosure of Invention

At least some embodiments of the present disclosure provide a method, an apparatus, a storage medium, and a processor for detecting a cheating plug-in a game, so as to at least solve a technical problem of low cheating plug-in detection efficiency in the game.

According to an embodiment of the present disclosure, a method for detecting a cheating plug-in a game is provided, including: acquiring operation data of an account to be detected in a game, wherein the operation data is used for determining whether an operation behavior of a virtual game role identified by the account in the game is a plug-in behavior executed by adopting a target script; extracting feature data associated with the plug-in behavior from the operation data, wherein the feature data is used for representing the operation frequency and/or the operation position of the operation behavior; sending the characteristic data to a server to enable the server to perform plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is a plug-in behavior; and receiving the detection result from the server.

According to one embodiment of the disclosure, a method for detecting a cheating plug-in a game is provided, which includes: acquiring feature data of an account to be detected, which is associated with a plug-in behavior in operation data of a game, wherein the operation data is used for determining whether the operation behavior of a virtual game role identified by the account in the game is the plug-in behavior executed by adopting a target script, and the feature data is used for expressing the operation frequency and/or the operation position of the operation behavior; performing plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is a plug-in behavior; and sending the detection result to the client.

According to one embodiment of the disclosure, a device for detecting plug-in a game is also provided. The device includes: the system comprises an acquisition unit, a processing unit and a display unit, wherein the acquisition unit is used for acquiring operation data of an account to be detected in a game, and the operation data is used for determining whether the operation behavior of a virtual game role identified by the account in the game is a plug-in behavior executed by adopting a target script; the extraction unit is used for extracting feature data associated with the plug-in behavior from the operation data, wherein the feature data is used for expressing the operation frequency and/or the operation position of the operation behavior; the sending unit is used for sending the characteristic data to the server so that the server can carry out plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is a plug-in behavior; and the receiving unit is used for receiving the detection result from the server.

According to one embodiment of the disclosure, a device for detecting plug-in a game is also provided. The device includes: the game processing device comprises an acquisition unit, a processing unit and a display unit, wherein the acquisition unit is used for acquiring feature data of an account to be detected, which is associated with a plug-in behavior in operation data of a game, wherein the operation data is used for determining whether the operation behavior of a virtual game role identified by the account in the game is the plug-in behavior executed by adopting a target script, and the feature data is used for expressing the operation frequency and/or the operation position of the operation behavior; the first detection unit is used for carrying out plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is a plug-in behavior; and the sending unit is used for sending the detection result to the client.

According to an embodiment of the present disclosure, there is further provided a computer-readable storage medium having a computer program stored therein, where the computer program is configured to execute the external hanging detection method in the game in any one of the above.

According to an embodiment of the present disclosure, there is also provided an electronic apparatus including a memory and a processor, where the memory stores a computer program, and the processor is configured to execute the computer program to perform the external hanging detection method in a game in any one of the above-mentioned embodiments.

In at least some embodiments of the present disclosure, operation data of an account to be detected in a game may be acquired, feature data associated with a plug-in behavior is extracted from the acquired operation data, and the extracted feature data is sent to a server, so that the server performs plug-in detection on the feature data to obtain a detection result, where the detection result is used to indicate whether the operation behavior is the plug-in behavior, and the plug-in detection on the game may be implemented based on the detection result of the server. That is to say, in the embodiment of the present disclosure, the cheating detection can be performed based on the feature data extracted from the operation data and associated with cheating behavior, and it is not necessary to detect all the operation data, so that data overhead is reduced, cheating detection efficiency in the game is improved, and further, the technical problem of low cheating detection efficiency in the game is solved.

Drawings

The accompanying drawings, which are included to provide a further understanding of the disclosure and are incorporated in and constitute a part of this application, illustrate embodiment(s) of the disclosure and together with the description serve to explain the disclosure and not to limit the disclosure. In the drawings:

fig. 1 is a block diagram of a hardware structure of a mobile terminal of a plug-in detection method in a game according to an embodiment of the present disclosure;

FIG. 2 is a flow chart of a method of detecting a cheating in a game according to one embodiment of the present disclosure;

FIG. 3 is a flow chart of a method of detecting a cheating in a game according to one embodiment of the present disclosure;

FIG. 4 is a flow chart of a method of detecting a cheating in a game according to one embodiment of the present disclosure;

FIG. 5 is a schematic diagram of extracting feature data according to one embodiment of the present disclosure;

FIG. 6 is a schematic diagram of transmission profile data according to one embodiment of the present disclosure;

FIG. 7 is a schematic diagram of processing feature data according to one embodiment of the present disclosure;

FIG. 8 is a schematic diagram of a rocker normal characteristic determination according to one embodiment of the present disclosure;

FIG. 9 is a detection flow diagram of a skill detection module according to one embodiment of the present disclosure;

FIG. 10 is a schematic diagram of rechecking the test results according to one embodiment of the present disclosure;

FIG. 11 is a schematic view of an in-game hang detection apparatus according to an embodiment of the present disclosure;

FIG. 12 is a schematic view of another in-game store detection apparatus according to an embodiment of the present disclosure;

FIG. 13 is a block diagram of an electronic device according to an alternative embodiment of the present disclosure.

Detailed Description

In order to make the technical solutions of the present disclosure better understood by those skilled in the art, the technical solutions of the embodiments of the present disclosure will be clearly and completely described below with reference to the drawings in the embodiments of the present disclosure, and it is obvious that the described embodiments are only some embodiments of the present disclosure, not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments disclosed herein without making any creative effort, shall fall within the protection scope of the present disclosure.

It should be noted that the terms "first," "second," and the like in the description and claims of the present disclosure and in the above-described drawings are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the disclosure described herein are capable of operation in sequences other than those illustrated or otherwise described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.

In a possible implementation manner, aiming at a method for detecting the plug-in of a game by detecting all operation data generated in the game operation process in the game technical field, after practice and careful research, the inventor finds that the detection method has the technical problem of low detection efficiency.

The above method embodiments related to the present disclosure may be executed in a mobile terminal, a computer terminal or a similar computing device. Taking the example of the mobile terminal, the mobile terminal may be a terminal device such as a smart phone, a tablet computer, a palm computer, a mobile internet device, a PAD, a game machine, and the like. Fig. 1 is a block diagram of a hardware structure of a mobile terminal of a plug-in detection method in a game according to an embodiment of the present disclosure. As shown in fig. 1, the mobile terminal may include one or more (only one is shown in fig. 1) processors 102 (the processors 102 may include, but are not limited to, a Central Processing Unit (CPU), a Graphic Processing Unit (GPU), a Digital Signal Processing (DSP) chip, a Microprocessor (MCU), a programmable logic device (FPGA), a neural Network Processor (NPU), a Tensor Processor (TPU), an Artificial Intelligence (AI) type processor, etc.) and a memory 104 for storing data, which in one embodiment of the present disclosure may further include: a transmission device 106 for communication functions, an input-output device 108, and a display device 110.

In some optional game scenario-based embodiments, the device may further provide a human-machine interface with a touch-sensitive surface, the human-machine interface may sense finger contact and/or gestures to perform human-machine interaction with a Graphical User Interface (GUI), and the human-machine interaction function may include the following interactions: executable instructions for creating web pages, drawing, word processing, making electronic documents, games, video conferencing, instant messaging, emailing, call interfacing, playing digital video, playing digital music, and/or web browsing, etc., for performing the above-described human-computer interaction functions, are configured/stored in one or more processor-executable computer program products or readable storage media.

It will be understood by those skilled in the art that the structure shown in fig. 1 is only an illustration, and does not limit the structure of the mobile terminal. For example, the mobile terminal may also include more or fewer components than shown in FIG. 1, or have a different configuration than shown in FIG. 1.

In accordance with one embodiment of the present disclosure, there is provided an embodiment of a method for detecting a cheating in a game, it is noted that the steps illustrated in the flowchart of the accompanying drawings may be executed in a computer system such as a set of computer-executable instructions and that, although a logical order is illustrated in the flowchart, in some cases, the steps illustrated or described may be executed in an order different than that illustrated herein.

In a possible implementation manner, an embodiment of the present disclosure provides a method for detecting a cheating plug-in a game, which is applied to a client. Fig. 2 is a flowchart of a store-in-game detection method according to an embodiment of the present disclosure, as shown in fig. 2, the method includes the following steps:

step S201, obtaining operation data of the account to be detected in the game.

In the technical solution provided in the above step S201 of the present disclosure, the game may include a plurality of virtual game characters, and after the game is logged in through the account to be detected, the corresponding virtual game character may be selected to participate in the game. The client side can acquire operation data of the account to be detected in the game in real time based on the operation data, wherein the operation data is used for determining whether the corresponding operation behavior of the virtual game role represented by the account in the game is a plug-in behavior executed by adopting a target script, and the game can refer to game application and a game client side.

Alternatively, the camera data during the game process can be acquired, and the operation behavior of each virtual game character in the whole game process is recorded in the camera data. After the camera data is acquired, the game operation process can be reproduced in the test environment of the client, and then the operation data is acquired.

For example, the operation data may include three sample data, which are self, move _ rocker = list (), self, sphere _ action = list (), and self, position _ list = list (), where self, move _ rocker may be used to represent the operation data of the joystick of the player, and the position of the joystick relative to the center of the joystick in each frame image may be recorded in the self. In order to avoid excessive repeated data in the recorded operation data, a judgment step can be added in the recording process. For example, in the process of game playing, when the position of the rocker changes relative to the position of the rocker in the previous frame of image after responding to the operation of the player for moving the rocker, the operation data of the rocker is recorded; and after responding to the operation of the player for moving the rocker, if the position of the rocker does not change relative to the position of the rocker in the previous frame of image, not recording the operation data of the rocker. For example, [10, [ x1, z1] ], [100, [ x2, z2] ] is used to indicate that the operation data of the stick at the stage of frame 10 to frame 99 is [ x1, z1], and the operation data of the stick up to frame 100 is [ x2, z2]. The _ project _ action may be used to represent the location, time, and skill number information of releasing the skill, wherein visual _ env.raw _ project _ info = [ x, z ] may be used to represent the location information when releasing the skill. Position _ list can be used to represent the position coordinates [ x, z ] of the player, which are sampled in seconds, controlled by the total duration of the total _ tick _ time game, total _ tick _ time, which is recorded once each time total _ tick _ time increases by 1000 ms. During the game, the data generated in response to the player moving the rocker, dragging the skill wheel or changing the position during the game are recorded in the three sample data.

Optionally, in addition to the three sample data, the operation data may further include a number of a game map used in the game, a type of the game, such as a big shuffle, a ranking game, and the like, an account number of the player, equipment, skills, such as a flash, a penalty, and the like, corresponding to the virtual game character, an identifier (such as an ID) of the virtual game character, a kill number, a death number, an attack number, and the like. The number of the game map can be represented by "map _ guid", the type of the game can be represented by "match _ ID", the account number of the player can be represented by "player _ guid", the equipment can be represented by "eqp", the skill corresponding to the virtual game character can be represented by "summoner _ shell", the ID of the virtual game character can be represented by "hero _ ID", the number of kills can be represented by "k", the number of deaths can be represented by "d", and the number of attacks can be represented by "a". After the game is finished, various operation data are stored under the designated folder path and named according to "match _ id + player _ guid + hero _ id". Based on this, the operation data of the account to be detected in the game may be obtained from the stored data according to the identifier "player _ guid" of the account to be detected, or the operation data of the account to be detected may also be obtained from the stored data by using the identifier "hero _ id" of the virtual game character selected by the account to be detected, which is not limited specifically here.

Step S202, extracting feature data associated with the plug-in behavior from the operation data.

In the technical scheme provided by the above step S202 of the present disclosure, after the operation data of the account to be detected in the game is acquired, feature data associated with the plug-in behavior may also be extracted from the acquired operation data, where the feature data is used to indicate an operation frequency and/or an operation position of the operation behavior.

Optionally, when extracting feature data associated with the plug-in behavior from the acquired operation data, the operation data of the target operation type may be determined from the operation data, and then the feature data associated with the target operation type may be extracted from the operation data of the target operation type. Wherein the operation data of the target operation type includes operation data of a joystick operation type and operation data of a skill operation type.

For example, as can be seen from the foregoing description, various types of data are stored in a specified folder path, and each type of data corresponds to its own identifier, based on which an identifier corresponding to the operation data of the target operation type may be determined first, that is, an identifier corresponding to the operation data of the joystick operation type and an identifier corresponding to the operation data of the skill operation type may be determined first. Then, acquiring operation data of the rocker operation type from the operation data according to the identifier corresponding to the operation data of the rocker operation type, and after the operation data of the rocker operation type is acquired, extracting first frame characteristic data associated with the rocker operation type from the operation data of the rocker operation type, wherein the first frame characteristic data is operation data which changes in the operation data of the rocker operation type and is used for representing the operation frequency of a corresponding rocker operation behavior; similarly, the operation data of the skill operation type may also be acquired from the operation data according to the identifier corresponding to the operation data of the skill operation type, and after the operation data of the skill operation type is acquired, second frame feature data associated with the skill operation type may be extracted from the operation data of the skill operation type, where the second frame feature data is the operation data used for releasing the skill in the operation data of the skill operation type and is used for representing the operation position of the corresponding skill release behavior.

And step S203, sending the characteristic data to a server so that the server can perform plug-in detection on the characteristic data to obtain a detection result.

In the technical solution provided by the above step S203 of the present disclosure, the server may include a game server and an algorithm server, where the game server is configured to relay data, and the algorithm server is configured to perform plug-in detection on the data, and based on this, after the feature data is extracted, the feature data may be sent to the game server, and after the game server relays the feature data, the feature data may be transmitted to the algorithm server, so that the algorithm server performs plug-in detection on the feature data, and obtains a detection result.

Optionally, when the data is transmitted to the algorithm server, the characteristic data may be sent to the algorithm server by means of a message queue or a target request.

For example, the game server may transmit the feature data by passing messages through a message queue based on a publish/subscribe mode (Kafka), thereby achieving asynchronous transmission of data. When the Kafka message queue is used for data transmission, the data transmission can be carried out no matter whether the algorithm server is in a normal working state or not, and the characteristic data can be transmitted only by submitting the characteristic data to the message queue without depending on a service mode supported by the algorithm server.

For example, when the feature data is transmitted by using a target request, the feature data may be uploaded to an algorithm server by a HyperText Transfer Protocol (HTTP), so as to implement synchronous transmission of the feature data.

Step S204, receiving the detection result from the server.

In the technical solution provided by the above step S204 of the present disclosure, after the feature data is transmitted to the algorithm server, the detection result of the algorithm server may also be received.

Optionally, after receiving the feature data, the algorithm server may detect operation data of a rocker operation type and operation data of a skill operation type included in the feature data, and determine whether an operation behavior corresponding to the response operation data is a plug-in behavior. After the detection result is obtained, the detection result can be sent to the game server, after the game server receives the detection result, the game server can send the detection result to the client, and the client can receive the detection result.

In at least some embodiments of the present disclosure, by obtaining operation data of an account to be detected in a game, feature data associated with a plug-in behavior is extracted from the operation data, and then the feature data is sent to a server, so that the server performs plug-in detection on the feature data to obtain a detection result. That is to say, in the embodiment of the present disclosure, the plug-in detection result can be obtained only by performing plug-in detection on the feature data associated with the plug-in behavior in the operation data, that is, it is determined whether the account to be detected is a plug-in player, and it is not necessary to detect all operation data, so that the plug-in detection efficiency in the game is greatly improved, and the technical problem of low plug-in detection efficiency in the game is solved.

The above method of this embodiment is further exemplified below.

As an optional implementation manner, in step S202, extracting feature data associated with the plug-in behavior from the operation data includes: and in response to the operation data being the operation data of the target operation type, extracting feature data associated with the target operation type from the operation data of the target operation type.

In this embodiment, the operation data of the target operation type may include operation data of a joystick operation type and operation data of a skill operation type. When the response data is operation data of a rocker operation type, extracting first frame feature data associated with the rocker operation type from the operation data of the rocker operation type, wherein the first frame feature data is operation data which changes in the operation data of the rocker operation type and is used for representing the operation frequency of a corresponding rocker operation behavior; and when the operation data is the operation data of the skill operation type, extracting second frame feature data associated with the skill operation type from the operation data of the skill operation type, wherein the second frame feature data are the operation data used for releasing the skill in the operation data of the skill operation type and are used for representing the operation position of the corresponding skill release behavior.

Optionally, as can be seen from the foregoing description, each type of data corresponds to its own identifier, based on which, the identifier of the operation data of the joystick operation type and the identifier of the operation data of the skill operation type may be determined first, and then, the operation data of the joystick operation type and the operation data of the skill operation type may be extracted from the operation data based on the identifiers of the operation data. It should be noted that, when extracting the operation data of the joystick operation type and the operation data of the skill operation type, the operation data may be identified first, and when identifying the operation data that changes in the joystick operation type and the operation data of the skill operation type and is used to release the skill operation data, the data may be extracted.

For example, assuming that the extracted operation data of the operation type of the joystick includes 13 frames, wherein the operation data of the joystick in the 1 st frame to the 8 th frame are different, the operation data of the joystick in each frame image in the 1 st frame to the 8 th frame is extracted, and in addition, assuming that the operation data of the joystick does not change in the 9 th frame to the 13 th frame, in this case, only the operation data of the joystick in the 9 th frame is extracted, and the operation data of the joystick in the 10 th frame to the 13 th frame does not need to be extracted, that is, the extracted operation data of the joystick does not have repetition, so that the data volume can be greatly reduced.

For another example, assuming that the extracted operation data of the skill operation type includes 11 frames, where the skill is released from the 1 st frame image, the operation data of the skill operation type in the 1 st frame image is extracted, the operation data of the skill operation type in the 2 nd to 5 th frame images is not extracted if the skill is not released from the 2 nd to 5 th frame images, and the skill is released from the 6 th to 11 th frame images, the operation data of the skill operation type in the 6 th to 11 th frame images is extracted, that is, only the operation data of the release skill is extracted, so that there is no repetition in the extracted operation data of the skill operation type, and the data amount can be greatly reduced.

As an optional implementation manner, in step S203, sending the feature data to the server, so that the server performs plug-in detection on the operation data, and obtaining a detection result, the method includes: and transmitting the characteristic data to the algorithm server through the game server so that the algorithm server performs plug-in detection on the characteristic data to obtain a detection result.

In this embodiment, the server includes a game server and an algorithm server, where the game server is configured to relay data, and the algorithm server is configured to perform plug-in detection on the data, and based on this, the client may first send the feature data to the game server, and after receiving the feature data, the game server may relay the feature data, and then send the feature data after being relayed to the algorithm server, so that the algorithm server performs plug-in detection on the feature data.

Optionally, when the game server sends the feature data to the algorithm server, the feature data may be sent by using a kafka message queue, or may be sent by using an HTTP request. When the characteristic data are sent by using the kafka message queue, the characteristic data can be submitted to the kafka message queue, and then the characteristic data can be sequentially sent to the algorithm server based on the sequence in the message queue to realize asynchronous transmission of the data, and the characteristic data can also be sent to the algorithm server in an HTTP request mode to realize synchronous transmission of the data.

In a possible implementation manner, the embodiment of the disclosure provides another plug-in detection method in a game, which is applied to a server. Fig. 3 is a flowchart of a method for detecting a cheating program in a game according to an embodiment of the present disclosure, as shown in fig. 3, the method may include the following steps:

step S301, acquiring characteristic data of the account to be detected, which is associated with the plug-in behavior in the operation data of the game.

In the technical solution provided in the above step S301 of the present disclosure, as can be seen from the content introduced in the foregoing step S203, the client may send feature data to the server, where the feature data is data associated with a plug-in behavior in the operation data, and based on this, the server may obtain the feature data associated with the plug-in behavior of the account to be detected in the operation data of the game, where the operation data is used to determine whether an operation behavior of a virtual game character identified by the account in the game is the plug-in behavior executed by using a target script, the feature data is used to indicate an operation frequency and/or an operation position of the operation behavior, and the server may be an algorithm server.

And S302, performing plug-in detection on the feature data to obtain a detection result.

In the technical solution provided by the above step S302 in the present disclosure, after the algorithm server acquires the feature data, the algorithm server may perform plug-in detection on the feature data to obtain a detection result, where the detection result is used to indicate whether the operation behavior is a plug-in behavior.

Optionally, the algorithm server may determine, based on the feature data and the target threshold, that the detection result is used to indicate that the operation behavior is a plug-in behavior. Wherein the target threshold may be preset.

Alternatively, as can be seen from the foregoing description of step S203, the feature data may include first frame feature data associated with the type of the joystick operation, the first frame feature data being data that changes in the operation data of the type of the joystick operation and is used for characterizing an operation frequency of a corresponding operation behavior of the joystick, and the target threshold may include a frequency threshold, based on which, when the detection result is determined to represent that the operation behavior is a plug-in behavior based on the feature data and the target threshold, the detection result may be determined to represent that the operation behavior is a plug-in behavior in response to the operation frequency corresponding to the first frame feature data being greater than the frequency threshold.

For example, the algorithm server may determine an operating frequency of the rocker operation behavior in the operation data of the rocker operation type, e.g., the operating frequency of the rocker operation behavior may be determined based on the number of times and the total number of frames of the rocker operation behavior. And then, comparing the operating frequency with a preset frequency threshold, if the operating frequency is greater than the frequency threshold, indicating that the operation behavior of the rocker is a plug-in behavior, and if the operating frequency is not greater than the frequency threshold, indicating that the operation behavior of the rocker is a non-plug-in behavior.

Optionally, as can be seen from the description of the foregoing step S203, the feature data may further include second frame feature data associated with the skill operation type, where the second frame feature data is operation data of the skill operation type, which is used to release the skill, and is used to characterize an operation position of a corresponding skill release behavior, and the target threshold may include an aggregation threshold, based on which, when the detection result is determined to represent that the operation behavior is a plug-in behavior based on the feature data and the target threshold, the multiple operation positions corresponding to the second frame feature data may be aggregated first to obtain an aggregation result, where the aggregation result is used to represent the complexity of the released skill; and in response to the aggregation result being larger than the aggregation threshold, determining that the detection result is used for representing that the operation behavior is the plug-in behavior, and in response to the aggregation result not being larger than the aggregation threshold, determining that the detection result is used for representing that the operation behavior is the non-plug-in behavior.

Step S303, sending the detection result to the client.

In the technical solution provided in the foregoing step S303 of the present disclosure, after the detection result is determined, the detection result may be sent to the client.

Optionally, as can be seen from the foregoing description, the client may first send the feature data to the game server, and the game server may send the feature data to the algorithm server after receiving the feature data. Of course, the algorithm server may also directly send the detection result to the client, which is not limited herein.

In at least some embodiments of the present disclosure, feature data associated with a plug-in behavior of an account to be detected in operation data of a game is obtained, where the operation data is used to determine whether an operation behavior of a virtual game character represented by the account in the game is a plug-in behavior executed by using a script, and then plug-in detection may be performed on the feature data to obtain a detection result, and the detection result is returned to a client. That is to say, in the embodiment of the present disclosure, only the feature data associated with the external hanging behavior may be detected, and it is not necessary to detect all the operation data in the game, so that the data amount is greatly reduced, the detection efficiency is improved, and the technical problem of low external hanging detection efficiency in the game is solved.

The above method of this embodiment is further exemplified below.

As an optional implementation manner, in step S302, performing plug-in detection on the feature data to obtain a detection result, including: and determining the detection result to represent that the operation behavior is the plug-in behavior based on the characteristic data and the target threshold.

In this embodiment, the characteristic data may include first frame characteristic data associated with the type of joystick operation, the first frame characteristic data being operation data in which a change occurs in the operation data of the type of joystick operation and being used to characterize an operating frequency of a corresponding behavior of the joystick operation. In addition, the feature data may further include second frame feature data associated with the skill operation type, where the second frame feature data is operation data of the skill operation type, which is used for releasing the skill and is used for characterizing an operation position of a corresponding skill release behavior. The target threshold may include a frequency threshold and may also include an aggregation threshold. Wherein the frequency threshold and the aggregation threshold may be preset.

Optionally, when detecting the first frame of feature data associated with the operation type of the joystick in the feature data, when the operation frequency corresponding to the first frame of feature data is greater than the frequency threshold, it may be determined that the detection result is used to indicate that the operation behavior is a cheating behavior. And when the operation frequency corresponding to the first frame characteristic data is not larger than the frequency threshold, determining that the detection result is used for representing that the operation behavior is a non-plug-in behavior. The first frame feature data may include the number of operations of the operation behavior of the joystick and the total frame number, and based on this, the operation frequency may be determined by the number of operations and the total frame number.

For example, the ratio of the number of operations of the joystick operation behavior included in the first frame feature data to the total number of frames may be used as the operation frequency corresponding to the first frame feature data. For example, the number of operations of the joystick operation behavior is 40, the total frame number is 50 frames, based on which, the operation frequency corresponding to the first frame feature data may be determined to be 0.8, and if the frequency threshold is 0.5, since 0.8 is greater than 0.5, the operation behavior corresponding to the first frame feature data may be determined to be a plug-in behavior.

Optionally, when detecting second frame feature data associated with the skill operation type in the feature data, the multiple operation positions corresponding to the second frame feature data may be aggregated to obtain an aggregation result, where the aggregation result is used to indicate the complexity of the released skill. Wherein the characteristic data comprises the number of releases of the skill release behavior and the number of different operating positions, based on which the aggregated result can be determined using the number of releases and the number of different operating positions. After the aggregation result is determined, when the response aggregation result is larger than the aggregation threshold, the detection result can be determined to represent that the operation behavior is the plug-in behavior; when the response aggregation result is not larger than the aggregation threshold, the detection result can be determined to represent that the operation behavior is the non-plug-in behavior.

For example, the number of skills included in the whole game may be determined according to the number of different operation positions included in the second frame feature data, wherein each operation position corresponds to one skill. After the number of skills is determined, the complexity of each skill can be calculated according to the position coordinates of the operation position of each skill and the release times of the skill in the whole game, and then the complexity of each skill is added to obtain an aggregation result. For example, the complexity of a skill can be determined by the following formula (1).

Where O9 Spelli) may be used to indicate the complexity of a skill i, size indicates the number of releases of that skill in the game as a whole, d (x) _{spell_i)} And d (r) _{spell_i)} Position coordinates of release point for skill i, where d (x) _{spell_i)} On the abscissa, d (r) _{spell_i)} Is the ordinate. The skill complexity of each skill can be determined according to equation (1) above.

Alternatively, after determining the skill complexity for each skill, the skill complexities of all the skills may be added to obtain the skill complexity of the entire game, which is determined as the aggregated result. Wherein all skill complexities can be calculated by the following formula (2).

O(spell)＝O(spell_1)+O(spell_2)+… (2)

Wherein, O9 scell 1) is the complexity corresponding to skill one, and O9 scell 2) is the complexity corresponding to skill two.

Optionally, after determining the skill complexity of the whole game, determining the skill complexity as an aggregation result, further comparing the aggregation result with an aggregation threshold, and when the value of O (scell) is greater than the aggregation threshold, determining that the detection result is used for indicating that the operation behavior is a plug-in behavior; when the value of O (scell) is not greater than the aggregation threshold, the detection result can be determined to indicate that the operation behavior is a non-plug-in behavior.

Optionally, when it is detected that the operation behavior is a plug-in behavior, the camera data in the game may be rechecked based on the received rechecking operation instruction to obtain a rechecking result, and then the target threshold is adjusted based on the rechecking result, and then plug-in detection is performed on the feature data based on the adjusted target threshold to obtain a secondary detection result, where the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

For example, when the operation behavior is determined to be a plug-in behavior, the detection result may be rechecked to ensure accuracy of the detection result. Specifically, an online video of the entire game may be obtained and reviewed using a review result optimization algorithm. And then, readjusting the target threshold according to the rechecking result and the detection result. For example, the range of the target threshold may be adjusted to be smaller, so as to ensure the accuracy of the detection result. After the target threshold is adjusted, the feature data may be detected again according to the method described above, so as to obtain a detection result, which is not described herein again.

Optionally, when it is detected that the operation behavior is a plug-in behavior, the type of the operation data may be determined, and then plug-in detection is performed on the operation data based on the type to obtain a secondary detection result, where the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

For example, the types of the operation data may be divided according to the virtual game characters, for example, the operation data corresponding to one virtual game character may be used as one type of operation data, and then, the plug-in detection may be performed on the operation data corresponding to each virtual game character to obtain a secondary detection result.

Optionally, when it is detected that the operation behavior is a plug-in behavior, the operation data may be converted into a target matrix, and then plug-in detection is performed on the target matrix to obtain a secondary detection result, where the secondary detection result is used to indicate whether the operation behavior is a plug-in behavior.

Optionally, when it is detected that the operation behavior is a plug-in behavior, an attribute value of the account may be adjusted, where the attribute value is used to represent a reputation degree of the account, and the reputation degree corresponding to the adjusted attribute value is lower than the reputation degree corresponding to the attribute value before adjustment.

For example, when the operation behavior of the account to be detected is detected to be a plug-in behavior, the attribute value of the account can be adjusted to limit the authority of the account to be detected, so as to alarm. For example, the value of the account to be checked may be deducted, and a low value may be prohibited to participate in the ranking game, and a low value may also reduce the money profit obtained during the battle.

In at least some embodiments of the present disclosure, only feature data associated with a plug-in behavior may be detected without detecting all operation data in a game, so that data amount is greatly reduced, and detection efficiency is improved.

The technical solutions of the embodiments of the present invention are further described below with reference to preferred embodiments.

In the related art, when detecting a plug-in operation in a game, a click operation under a fixed coordinate is usually identified, and in a game operation process, not only the click operation but also a drag operation are usually identified, and the detection mode cannot identify the drag operation and is single. In addition, when the operation data is detected, all the operation data generated in the whole game is usually detected, because the data volume generated in the game process is large, the detection mode needs to process huge data volume, the detection efficiency is low, in the detection process, when a certain operation behavior is abnormal, a corresponding account is determined as the account used by the script player, and penalty is given to the account, and the detection mode possibly judges a normal player as the script player by mistake to a great extent, and the detection accuracy is low.

However, the embodiment of the present disclosure provides a method for detecting a cheating plug-in a game, which is further described in the next step. Fig. 4 is a flowchart of a store-in-game detection method according to an embodiment of the present disclosure, and as shown in fig. 4, the method may include the following steps:

step S401, obtaining original sample data.

In this embodiment, before starting the whole detection process, sample data may be collected, where the sample data is negative sample data, and the negative sample data is used to indicate that a script player exists in the game corresponding to the sample data. Sample data can be acquired through two methods, one is writing an automatic script to generate negative sample data. Optionally, according to the script player operation video of the outer clothing stream, an automatic script is written through AirTest to simulate the operation behavior of the script player in the inner clothing, sample data is obtained, and the obtained sample data is compared with the data generated by using the mobile interface and the skill releasing interface. The other is to contact the operation to obtain the information of the reported player, optionally, to contact the operation to obtain the list of the reported players as the "hang-up script", and to recheck the video of the reported field of the players, to list the players meeting the behavior characteristics of the hang-up script as the users in the white list, and to collect the operation data.

Step S402, extracting characteristic data from the original sample data.

In this embodiment, after the operational data is acquired, feature data may be extracted from the operational data, the feature data including operational data associated with the left rocker control walk and operational data associated with the right skill button release skill.

Alternatively, the game is composed of a large number of frames of images, one game is about 30 minutes, 1s contains about 20 frames of images, one minute contains 1200 frames, and 30 minutes contains 36000 frames, based on which, if each frame of image is recorded, taking 10 players as an example of one game, about ten million-order data is expected to be generated for a single game, based on which, in order to reduce overhead, the acquired operation data can be reduced. Specifically, fig. 5 is a schematic diagram of extracting feature data according to an embodiment of the present disclosure, as shown in fig. 5, when recording operation data, the operation data may be recorded only at a change point with respect to operation data associated with a left joystick operation, where the operation data may be recorded in a minimum unit of frame number, that is, if the joystick operation information of a player is unchanged between the P-th frame and the Q-th frame, the operation data of only the frame of the Q-th frame may be recorded with respect to the left joystick operation information between the P-th frame and the Q-th frame. For the skill operation data, only the operation data of the release point can be recorded, namely, the skill operation data of the player at certain frame number can be recorded in the unit time of tens of thousands of frames of the whole game. The data volume acquired based on the mode is only about 1/4 of the preset data volume, and the data volume is greatly reduced.

Step S403, transmitting the feature data.

Optionally, fig. 6 is a schematic diagram of transmission of feature data according to an embodiment of the present disclosure, as shown in fig. 6, after obtaining the feature data, the client 601 may send the feature data to the game server 602, after the game server 602 relays the feature data, the relayed feature data may be sent to the algorithm server 603, and the algorithm server 603 may receive the feature data sent by the game server 602.

And S404, identifying the behavior of the plug-in based on a detection algorithm.

In this embodiment, the algorithm server may perform algorithm identification on the feature data after receiving the feature data. Fig. 7 is a schematic diagram of processing feature data according to an embodiment of the present disclosure. The algorithm server 700 comprises a rocker detection module 701 and a skill detection module 702, and the characteristic data can be comprehensively analyzed through the rocker detection module 701 and the skill detection module 702 to obtain an on-hook conclusion.

For example, the rocker detection module 701 may compare the overall operating frequency f1 and the sliding window maximum operating frequency f2 with threshold values of set threshold values, respectively, to determine whether the rocker is in the normal feature. The overall operation frequency f1 can be calculated by the number of operations by the player and the total number of battle frames. The maximum operating frequency f2 of the sliding window can be obtained by calculating the average value of the dislocation difference values in each window to obtain the operating frequency in a single kernel, and then averaging the obtained data to obtain the final operating frequency f2. Wherein the calculation process depends on the selection of the appropriate window length win _ size and jump win _ step. Fig. 8 is a schematic diagram of determining a normal characteristic of a joystick according to an embodiment of the present disclosure, and as shown in fig. 8, when the overall operating frequency f1 is greater than a threshold α 1 and the maximum operating frequency f2 of the sliding window is greater than a threshold α 2, it is determined that the joystick is a normal characteristic, otherwise, it is determined that the joystick is an abnormal characteristic, that is, a click characteristic hits.

For example, fig. 9 is a detection flow chart of a skill detection module according to an embodiment of the present disclosure, as shown in fig. 9, for different skills, the skill detection module may classify the different skills according to skill types, and then calculate the complexity O (scell) of skill release, where the skill release complexity may be calculated by the following formula (3).

Wherein d (x) _k ) As the abscissa of each skill release point, d (r) _k ) For each skill release point ordinate, size is the number of releases of the corresponding skill in the game as a whole. Wherein when the complexity O (scell) of skill release is greater than a threshold, determining the skill as a skill of hit clicker script.

Step S405, detecting algorithm scheme optimization.

In this embodiment, in order to ensure the accuracy of the detection result, the whole detection scheme may be optimized to ensure that the false alarm rate is reduced to 1/100000 and lower. Fig. 10 is a schematic diagram of rechecking a detection result according to an embodiment of the present disclosure. The sample data hit by the algorithm can be classified and analyzed, for example, a specially-assigned person is asked to pull the online combat video of the player for rechecking, the algorithm is optimized according to the rechecking result, and the optimized algorithm is used for carrying out secondary detection on the false-reported sample data, so that the steps are repeated.

And step S406, setting the authority of the account to be detected based on the detection result.

In this embodiment, the algorithm server may return the detection result to the game client after obtaining the detection result, alternatively, as shown in fig. 6, the algorithm server 603 may first send the detection result to the game server 602 for relaying, and the game server 602 may send the detection result to the game client 601 after receiving the detection result. After receiving the detection result, the game client 601 may perform permission setting on the account to be detected based on the detection result, for example, the personal value of the account to be detected may be deducted. The player is influenced in two aspects by deducting the personal value of the account to be detected, and firstly, the player is prohibited to participate in the ranking game if the personal value is too low; second, the money return obtained while participating in the battle may be reduced by an excessively low value of the personal.

Step S407, evaluating the play-out result.

In this embodiment, after the detection scheme comes online, the impact effect of the detection scheme on the actual external hanging behavior needs to be evaluated. Optionally, tracking analysis, operational feedback may be performed on the one-month online player data. If the effect is in accordance with the expectation, the detection scheme is indicated to solve the problem of the clicker type plug-in script.

Alternatively, the detection scheme is applicable to other games involving user information input. For example, left rocker + right plunging or skill + others: shooting games, multiplayer online tactical economy games (MOBA), sports games, racing games, action games, and Action Role Playing Games (ARPG); click/drag: card-type games, strategy-type games, etc.

Through the above description of the embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by software plus a necessary general hardware platform, and certainly can also be implemented by hardware, but the former is a better implementation mode in many cases. Based on such understanding, the technical solutions of the present disclosure may be embodied in the form of a software product, which is stored in a storage medium (e.g., ROM/RAM, magnetic disk, optical disk) and includes instructions for enabling a terminal device (e.g., a mobile phone, a computer, a server, or a network device) to execute the method according to the embodiments of the present disclosure.

The embodiment also provides a plug-in detection device in a game, which is used for implementing the above embodiments and preferred embodiments, and the description of the device is omitted. As used hereinafter, the terms "unit", "module" and "modules" may be a combination of software and/or hardware that implements a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.

Fig. 11 is a schematic diagram of an in-game hang-up detection apparatus according to an embodiment of the present disclosure, and as shown in fig. 11, the in-game hang-up detection apparatus 1100 includes: acquisition unit 1101, extraction unit 1102, transmission unit 1103, and reception unit 1104.

An obtaining unit 1101, configured to obtain operation data of an account to be detected in a game, where the operation data is used to determine whether an operation behavior, in the game, of a virtual game character identified by the account is a plug-in behavior executed by using a target script;

an extracting unit 1102, configured to extract feature data associated with the plug-in behavior from the operation data, where the feature data is used to indicate an operation frequency and/or an operation position of the operation behavior;

a sending unit 1103, configured to send the feature data to the server, so that the server performs plug-in detection on the feature data to obtain a detection result, where the detection result is used to indicate whether the operation behavior is a plug-in behavior;

a receiving unit 1104, configured to receive a detection result from the server.

Optionally, the extracting unit 1102 includes: and the extraction module is used for responding to the operation data of which the operation data is the target operation type, and extracting the characteristic data associated with the target operation type from the operation data of the target operation type.

Optionally, the extracting module is configured to, in response to that the operation data is of a joystick operation type, extract first frame feature data associated with the joystick operation type from the operation data of the joystick operation type, where the first frame feature data is operation data that changes in the operation data of the joystick operation type and is used to represent an operation frequency of a corresponding joystick operation behavior; and/or in response to the operation data being the skill operation type, extracting second frame feature data associated with the skill operation type from the operation data of the skill operation type, wherein the second frame feature data is the operation data used for releasing the skill in the operation data of the skill operation type and is used for representing the operation position of the corresponding skill release behavior.

Optionally, the server includes a game server and an algorithm server, wherein the sending unit 1103 includes: and the transmission module is used for transmitting the characteristic data to the algorithm server through the game server so that the algorithm server performs plug-in detection on the characteristic data to obtain a detection result.

Optionally, the transmission module is configured to send the feature data to a game server, so that the game server sends the feature data to the algorithm server through a message queue; or the characteristic data is sent to the game server, so that the game server sends the characteristic data to the algorithm server through the target request.

Optionally, the acquisition unit 1101 is configured to acquire camera data of an account in a game; and reproducing the operation behavior based on the camera data to obtain operation data.

In the plug-in detection device in the game of the embodiment, the acquisition unit is used for acquiring operation data of an account to be detected in the game; the extraction unit is used for extracting feature data associated with the plug-in behavior from the operation data; the sending unit is used for sending the characteristic data to the server so that the server can carry out plug-in detection on the characteristic data to obtain a detection result; and the receiving unit is used for receiving the detection result from the server. In the embodiment of the invention, the plug-in detection can be carried out based on the feature data which is extracted from the operation data and is associated with the plug-in behavior, and all the operation data are not required to be detected, so that the data overhead is reduced, the plug-in detection efficiency in the game is improved, and the technical problem of low plug-in detection efficiency in the game is solved.

Fig. 12 is a schematic view of another plug-in detection device in a game according to an embodiment of the present disclosure, and as shown in fig. 12, the plug-in detection device 1200 in the game includes: an acquisition unit 1201, a first detection unit 1202, and a transmission unit 1203.

The acquisition unit 1201 is used for acquiring feature data of an account to be detected, which is associated with a plug-in behavior in operation data of a game, wherein the operation data is used for determining whether an operation behavior of a virtual game character identified by the account in the game is the plug-in behavior executed by adopting a target script, and the feature data is used for representing an operation frequency and/or an operation position of the operation behavior;

the first detection unit 1202 is configured to perform plug-in detection on the feature data to obtain a detection result, where the detection result is used to indicate whether the operation behavior is a plug-in behavior;

a sending unit 1203, configured to send the detection result to the client.

Optionally, the first detection unit 1202 includes: and the determining module is used for determining the detection result to represent that the operation behavior is the plug-in behavior based on the characteristic data and the target threshold.

Optionally, the feature data includes first frame feature data associated with the operation type of the joystick, the first frame feature data is operation data that changes in the operation data of the operation type of the joystick and is used for characterizing an operation frequency of a corresponding operation behavior of the joystick, and the target threshold includes a frequency threshold, where the determining module is further configured to determine, in response to the operation frequency corresponding to the first frame feature data being greater than the frequency threshold, that the detection result is used for indicating that the operation behavior is a plug-in behavior.

Optionally, the first frame characteristic data includes a total number of frames and a number of operations of the joystick operation behavior, and the apparatus 1200 is further configured to determine an operation frequency based on the total number of frames and the number of operations.

Optionally, the feature data includes second frame feature data associated with the skill operation type, the second frame feature data is operation data used for releasing the skill in the operation data of the skill operation type and is used for characterizing an operation position of a corresponding skill release behavior, the target threshold includes an aggregation threshold, wherein the determining module further includes: the aggregation sub-module is used for aggregating a plurality of operation positions corresponding to the second frame feature data to obtain an aggregation result, wherein the aggregation result is used for representing the complexity of the released skill; and the determining submodule is used for responding to the aggregation result which is larger than the aggregation threshold value, and determining the detection result to represent that the operation behavior is the plug-in behavior.

Optionally, the characteristic data includes a number of releases of the skill release behavior and a number of different operation positions, and the aggregation sub-module is configured to determine the aggregation result based on the number of releases and the number of different operation positions.

Optionally, the apparatus 1200 further comprises: the rechecking unit is used for rechecking the camera shooting data in the game based on the received rechecking operation instruction to obtain a rechecking result; a first adjusting unit for adjusting the target threshold based on the rechecking result; and the second detection unit is used for carrying out plug-in detection on the characteristic data based on the adjusted target threshold value to obtain a secondary detection result, wherein the secondary detection result is used for indicating whether the operation behavior is the plug-in behavior.

Optionally, the apparatus 1200 further comprises: the determining unit is used for detecting that the operation behavior is a plug-in behavior and determining the type of the operation data; and the third detection unit is used for performing plug-in detection on the operation data based on the type to obtain a secondary detection result, wherein the secondary detection result is used for indicating whether the operation behavior is the plug-in behavior.

Optionally, the apparatus 1200 further comprises: the conversion unit is used for detecting that the operation behavior is a plug-in behavior and converting the operation data into a target matrix; and the fourth detection unit is used for performing plug-in detection on the target matrix to obtain a secondary detection result, wherein the secondary detection result is used for indicating whether the operation behavior is the plug-in behavior.

Optionally, the apparatus 1200 further comprises: and the second adjusting unit is used for detecting that the operation behavior is a plug-in behavior and adjusting the attribute value of the account, wherein the attribute value is used for representing the credit degree of the account, and the credit degree corresponding to the adjusted attribute value is lower than the credit degree corresponding to the attribute value before adjustment.

In the plug-in detection device in the game of the embodiment, the acquisition unit is used for acquiring feature data of the account to be detected, which is associated with the plug-in behavior in the operation data of the game; the detection unit is used for carrying out plug-in detection on the characteristic data to obtain a detection result; and the sending unit is used for sending the detection result to the client. In the embodiment of the invention, the characteristic data associated with the plug-in behavior can be detected only, and all operation data in the game do not need to be detected, so that the data volume is greatly reduced, the detection efficiency is improved, and the technical problem of low plug-in detection efficiency in the game is solved.

It should be noted that, the above units and modules may be implemented by software or hardware, and for the latter, the following may be implemented, but not limited to: the units and the modules are all positioned in the same processor; alternatively, the units and modules may be located in different processors in any combination.

Embodiments of the present disclosure also provide a computer-readable storage medium having a computer program stored therein, wherein the computer program is configured to perform the steps in any of the above method embodiments when executed.

Optionally, in this embodiment, the computer-readable storage medium may include, but is not limited to: various media capable of storing computer programs, such as a usb disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic disk, or an optical disk.

Optionally, in this embodiment, the computer-readable storage medium may be located in any one of a group of computer terminals in a computer network, or in any one of a group of mobile terminals.

Alternatively, in the present embodiment, the above-mentioned computer-readable storage medium may be configured to store a computer program for executing the steps of:

s1, acquiring operation data of an account to be detected in a game, wherein the operation data is used for determining whether an operation behavior of a virtual game role identified by the account in the game is a plug-in behavior executed by adopting a target script;

s2, extracting feature data associated with the plug-in behavior from the operation data, wherein the feature data is used for expressing the operation frequency and/or the operation position of the operation behavior;

s3, sending the characteristic data to a server to enable the server to perform plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is a plug-in behavior;

and S4, receiving the detection result from the server.

As an optional example, in the present embodiment, the computer-readable storage medium may be further configured to store a computer program for performing the following steps:

the method comprises the steps of S1, obtaining characteristic data of an account to be detected, which is associated with a plug-in behavior in operation data of a game, wherein the operation data are used for determining whether the operation behavior of a virtual game role identified by the account in the game is the plug-in behavior executed by adopting a target script, and the characteristic data are used for expressing the operation frequency and/or the operation position of the operation behavior;

s2, performing plug-in detection on the feature data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is a plug-in behavior;

and S3, sending the detection result to the client.

In the computer-readable storage medium of this embodiment, the plug-in detection can be performed based on the feature data associated with the plug-in behavior extracted from the operation data, and it is not necessary to detect all the operation data, so that data overhead is reduced, plug-in detection efficiency in the game is improved, and further the technical problem of low plug-in detection efficiency in the game is solved.

Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein may be implemented by software, and may also be implemented by software in combination with necessary hardware. Therefore, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a computer-readable storage medium (which may be a CD-ROM, a usb disk, a removable hard disk, etc.) or on a network, and includes several instructions to enable a computing device (which may be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the embodiments of the present disclosure.

In an exemplary embodiment of the present application, a computer-readable storage medium has stored thereon a program product capable of implementing the above-described method of the present embodiment. In some possible implementations, various aspects of the embodiments of the present disclosure may also be implemented in the form of a program product including program code for causing a terminal device to perform the steps according to various exemplary implementations of the present disclosure described in the above section "exemplary method" of this embodiment, when the program product is run on the terminal device.

According to the program product for implementing the above method of the embodiments of the present disclosure, it may employ a portable compact disc read only memory (CD-ROM) and include program codes, and may be run on a terminal device, such as a personal computer. However, the program product of the disclosed embodiments is not limited in this respect, and in the disclosed embodiments, the computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.

The program product described above may employ any combination of one or more computer-readable media. The computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

It should be noted that the program code embodied on the computer readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Embodiments of the present disclosure also provide an electronic device, including a memory having a computer program stored therein and a processor configured to execute the computer program to perform the steps in any of the method embodiments described above.

Optionally, the electronic apparatus may further include a transmission device and an input/output device, wherein the transmission device is connected to the processor, and the input/output device is connected to the processor.

Optionally, in this embodiment, the processor may be configured to execute the following steps by a computer program:

and S4, receiving the detection result from the server.

As an optional example, in this embodiment, the processor may be further configured to execute the following steps by a computer program:

the method comprises the steps of S1, obtaining characteristic data of an account to be detected, which is associated with a plug-in behavior in operation data of a game, wherein the operation data is used for determining whether the operation behavior of a virtual game role identified by the account in the game is the plug-in behavior executed by adopting a target script, and the characteristic data is used for expressing the operation frequency and/or the operation position of the operation behavior;

and S3, sending the detection result to the client.

In the electronic device of the embodiment, the plug-in detection can be performed based on the feature data which is extracted from the operation data and is associated with the plug-in behavior, and all the operation data do not need to be detected, so that the data overhead is reduced, the plug-in detection efficiency in the game is improved, and the technical problem of low plug-in detection efficiency in the game is solved.

Fig. 13 is a schematic diagram of an electronic device according to an embodiment of the disclosure. As shown in fig. 13, the electronic device 1300 is only an example and should not bring any limitation to the functions and the scope of use of the embodiments of the present disclosure.

As shown in fig. 13, the electronic apparatus 1300 is embodied in the form of a general purpose computing device. The components of electronic device 1300 may include, but are not limited to: the at least one processor 1310, the at least one memory 1320, the bus 1330 connecting the various system components (including the memory 1320 and the processor 1310), and the display 1340.

The memory 1320, among other things, stores program code that is executable by the processor 1310 to cause the processor 1310 to perform the steps according to the various exemplary embodiments of the present disclosure described in the method section above of the embodiments of the present application.

The memory 1320 may include readable media in the form of volatile memory units, such as a random access memory unit (RAM) 13201 and/or a cache memory unit 13202, may further include a read-only memory unit (ROM) 13203, and may also include non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory.

In some examples, memory 1320 may also include a program/utility 13204 having a set (at least one) of program modules 13205, such program modules 13205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which, or some combination thereof, may comprise an implementation of a network environment. The memory 1320 may further include memory located remotely from the processor 1310, which may be connected to the electronic device 1300 via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.

Bus 1330 may be any bus representing one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processor 1310, or a local bus using any of a variety of bus architectures.

Display 1340 may be, for example, a touch-screen Liquid Crystal Display (LCD) that may enable a user to interact with a user interface of electronic device 1300.

Optionally, the electronic apparatus 1300 may also communicate with one or more external devices 1400 (e.g., keyboard, pointing device, bluetooth device, etc.), with one or more devices that enable a user to interact with the electronic apparatus 1300, and/or with any devices (e.g., router, modem, etc.) that enable the electronic apparatus 1300 to communicate with one or more other computing devices. Such communication may occur via input/output (I/O) interfaces 1350. Also, the electronic device 1300 may communicate with one or more networks (e.g., a Local Area Network (LAN), a Wide Area Network (WAN), and/or a public network, such as the internet) through the network adapter 1360. As shown in FIG. 13, the network adapter 1360 communicates with other modules of the electronic device 1300 via the bus 1330. It should be appreciated that although not shown in FIG. 13, other hardware and/or software modules may be used in conjunction with the electronic device 1300, which may include but are not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, among others.

The electronic device 1300 may further include: a keyboard, a cursor control device (e.g., a mouse), an input/output interface (I/O interface), a network interface, a power source, and/or a camera.

It will be understood by those skilled in the art that the structure shown in fig. 13 is only an illustration and is not intended to limit the structure of the electronic device. For example, electronic device 1300 may also include more or fewer components than shown in FIG. 13, or have a different configuration than shown in FIG. 1. The memory 1320 may be used to store a computer program and corresponding data, such as a computer program and corresponding data corresponding to the external hanging detection method in the game in the embodiment of the disclosure. The processor 1310 executes various functional applications and data processing by running a computer program stored in the memory 1320, so as to implement the above-described external hanging detection method in the game.

The above-mentioned serial numbers of the embodiments of the present disclosure are merely for description, and do not represent the advantages or disadvantages of the embodiments.

In the above embodiments of the present disclosure, the descriptions of the respective embodiments have respective emphasis, and for parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

In the embodiments provided in the present application, it should be understood that the disclosed technology can be implemented in other ways. The above-described embodiments of the apparatus are merely illustrative, and for example, the division of the units may be a logical division, and in actual implementation, there may be another division, for example, multiple units or components may be combined or integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, units or modules, and may be in an electrical or other form.

The units described as separate parts may or may not be physically separate, and parts displayed as units may or may not be physical units, may be located in one place, or may be distributed on a plurality of units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of the embodiment.

In addition, functional units in the embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist alone physically, or two or more units are integrated into one unit. The integrated unit can be realized in a form of hardware, and can also be realized in a form of a software functional unit.

The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solutions of the present disclosure may be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the methods according to the embodiments of the present disclosure. And the aforementioned storage medium includes: a U-disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a removable hard disk, a magnetic or optical disk, and other various media capable of storing program codes.

The foregoing is merely a preferred embodiment of the present disclosure, and it should be noted that modifications and embellishments could be made by those skilled in the art without departing from the principle of the present disclosure, and these should also be considered as the protection scope of the present disclosure.

Claims

1. A method for detecting a cheating plug-in a game, comprising:

acquiring operation data of an account to be detected in a game, wherein the operation data is used for determining whether an operation behavior of a virtual game role identified by the account in the game is a plug-in behavior executed by adopting a target script;

extracting feature data associated with the plug-in behavior from the operation data, wherein the feature data is used for representing the operation frequency and/or the operation position of the operation behavior;

sending the characteristic data to a server to enable the server to perform plug-in detection on the characteristic data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is the plug-in behavior;

receiving the detection result from the server.

2. The method of claim 1, wherein extracting feature data associated with the plug-in behavior from the operational data comprises:

and in response to the operation data being the operation data of the target operation type, extracting the feature data associated with the target operation type from the operation data of the target operation type.

3. The method according to claim 2, wherein in response to the operation data being operation data of a target operation type, extracting the feature data associated with the target operation type from the operation data of the target operation type comprises:

responding to the operating data which is of a rocker operating type, extracting first frame characteristic data which is associated with the rocker operating type from the operating data of the rocker operating type, wherein the first frame characteristic data is the operating data which changes in the operating data of the rocker operating type and is used for representing the operating frequency of a corresponding rocker operating behavior; and/or

And in response to the operation data being operation data of a skill operation type, extracting second frame feature data associated with the skill operation type from the operation data of the skill operation type, wherein the second frame feature data is the operation data used for releasing the skill in the operation data of the skill operation type and is used for representing the operation position of the corresponding skill release behavior.

4. The method according to claim 1, wherein the server comprises a game server and an algorithm server, wherein the step of sending the feature data to the server so that the server performs plug-in detection on the operation data to obtain a detection result comprises the steps of:

and transmitting the characteristic data to the algorithm server through the game server so that the algorithm server performs plug-in detection on the characteristic data to obtain the detection result.

5. The method of claim 4, wherein transmitting the characterization data to the algorithm server via a game server comprises:

sending the characteristic data to the game server so that the game server sends the characteristic data to the algorithm server through a message queue; or

And sending the characteristic data to the game server so that the game server sends the characteristic data to the algorithm server through a target request.

6. The method according to any one of claims 1 to 5, wherein the acquiring of the operation data of the account to be detected in the game comprises:

acquiring camera data of the account in the game;

and reproducing the operation behavior based on the camera shooting data to obtain the operation data.

7. A method for detecting a cheating plug-in a game, comprising:

acquiring feature data of an account to be detected, which is associated with a plug-in behavior in operation data of a game, wherein the operation data is used for determining whether an operation behavior of a virtual game character identified by the account in the game is the plug-in behavior executed by adopting a target script, and the feature data is used for expressing an operation frequency and/or an operation position of the operation behavior;

performing plug-in detection on the feature data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is the plug-in behavior;

and sending the detection result to a client.

8. The method according to claim 7, wherein detecting the cheating on the feature data to obtain a detection result comprises:

and determining that the detection result is used for representing that the operation behavior is the plug-in behavior based on the feature data and a target threshold.

9. The method of claim 8, wherein the characteristic data comprises first frame characteristic data associated with a type of joystick operation, the first frame characteristic data being operation data that changes in the operation data of the type of joystick operation and being used to characterize the operating frequency of a corresponding joystick operation behavior, the target threshold comprising a frequency threshold, wherein determining the detection result to represent the operation behavior as the external hanging behavior based on the characteristic data and a target threshold comprises:

and determining that the detection result is used for representing that the operation behavior is the plug-in behavior in response to the fact that the operation frequency corresponding to the first frame feature data is larger than the frequency threshold.

10. The method of claim 9, wherein the first frame characteristic data comprises a total number of frames and a number of operations of the rocker operation behavior, the method further comprising:

and determining the operation frequency based on the operation times and the total frame number.

11. The method according to claim 8, wherein the feature data comprises second frame feature data associated with a skill operation type, the second frame feature data is operation data for releasing skill in the operation data of the skill operation type and is used for characterizing the operation position of a corresponding skill release behavior, the target threshold comprises an aggregation threshold, wherein determining the detection result is used for representing that the operation behavior is the plug-in behavior based on the feature data and the target threshold comprises:

aggregating the plurality of operation positions corresponding to the second frame feature data to obtain an aggregation result, wherein the aggregation result is used for representing the complexity of the released technology;

and in response to the aggregation result being larger than the aggregation threshold, determining that the detection result is used for representing that the operation behavior is the plug-in behavior.

12. The method according to claim 11, wherein the feature data includes the number of times of release of the skill release behavior and the number of different operation positions, and the aggregating the plurality of operation positions corresponding to the second frame feature data to obtain an aggregated result includes:

determining the aggregated result based on the number of releases and the number of different operating positions.

13. The method of claim 8, further comprising:

detecting that the operation behavior is the plug-in behavior, and rechecking the camera shooting data in the game based on the received rechecking operation instruction to obtain a rechecking result;

adjusting the target threshold based on the review result;

and performing plug-in detection on the characteristic data based on the adjusted target threshold to obtain a secondary detection result, wherein the secondary detection result is used for indicating whether the operation behavior is the plug-in behavior.

14. The method of claim 7, further comprising:

detecting that the operation behavior is the plug-in behavior, and determining the type of the operation data;

and performing plug-in detection on the operation data based on the type to obtain a secondary detection result, wherein the secondary detection result is used for indicating whether the operation behavior is the plug-in behavior.

15. The method of claim 7, further comprising:

detecting that the operation behavior is the plug-in behavior, and converting the operation data into a target matrix;

and performing plug-in detection on the target matrix to obtain a secondary detection result, wherein the secondary detection result is used for indicating whether the operation behavior is the plug-in behavior.

16. The method according to any one of claims 7-15, further comprising:

and detecting that the operation behavior is the plug-in behavior, and adjusting an attribute value of the account, wherein the attribute value is used for representing the credit degree of the account, and the credit degree corresponding to the adjusted attribute value is lower than the credit degree corresponding to the attribute value before adjustment.

17. An external hanging detection device in a game, comprising:

the game processing device comprises an acquisition unit, a processing unit and a processing unit, wherein the acquisition unit is used for acquiring operation data of an account to be detected in a game, and the operation data is used for determining whether an operation behavior of a virtual game role identified by the account in the game is a plug-in behavior executed by adopting a target script;

the extraction unit is used for extracting feature data associated with the plug-in behavior from the operation data, wherein the feature data is used for representing the operation frequency and/or the operation position of the operation behavior;

the sending unit is used for sending the feature data to a server so that the server can perform plug-in detection on the feature data to obtain a detection result, wherein the detection result is used for indicating whether the operation behavior is the plug-in behavior;

a receiving unit, configured to receive the detection result from the server.

18. A computer-readable storage medium, in which a computer program is stored, wherein the computer program is arranged to, when executed by a processor, perform the method of any one of claims 1 to 16.

19. An electronic device comprising a memory and a processor, wherein the memory has stored therein a computer program, and wherein the processor is arranged to execute the computer program to perform the method of any of claims 1 to 16.