CN118526798A

CN118526798A - Data acquisition method, device, terminal and storage medium

Info

Publication number: CN118526798A
Application number: CN202310206562.0A
Authority: CN
Inventors: 石铭宇; 胡和君; 伍谦; 马雅从; 杨鹏; 赵继豪
Original assignee: Shenzhen Tencent Network Information Technology Co Ltd
Current assignee: Shenzhen Tencent Network Information Technology Co Ltd
Priority date: 2023-02-23
Filing date: 2023-02-23
Publication date: 2024-08-23

Abstract

The application discloses a data acquisition method, a data acquisition device, a terminal and a storage medium, and belongs to the technical field of computers. The method is executed by a terminal, a game client on the terminal is configured with a hook function, and the game client comprises a filtering function and a processing function provided by a game engine; the method comprises the following steps: calling a filtering function to acquire original operation data executed in the game client, and filtering the original operation data to acquire target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client; invoking a processing function, acquiring target operation data output by a filtering function, and determining instruction data triggered by the target operation data; and calling a hook function to acquire target operation data and instruction data obtained by the processing function. Because the execution frequency of the target operation data is consistent with the game frame rate, the target operation data is effective operation data capable of generating game performance, and the obtained target operation data is more accurate.

Description

Data acquisition method, device, terminal and storage medium

Technical Field

The embodiment of the application relates to the technical field of computers, in particular to a data acquisition method, a data acquisition device, a terminal and a storage medium.

Background

With the rapid development of computer technology, electronic games, in which a user wins a game by competition, are becoming an increasingly popular entertainment mode. However, in order to win the game, some users use the plug-in program to cheat, which affects the fairness of the electronic game. To avoid this problem, it is generally possible to collect operation data of the user, and identify abnormal operation behavior by detecting the operation data.

In the related art, a collection function provided by an operating system detects operation data executed in a game, and the operation data can be obtained by hooking the collection function. However, since the operation data detected by the collection function is all the operation data executed by the user, and one frame of the game screen is affected by only one operation data, invalid operation data which does not produce the game performance exists in the operation data, the operation data acquired by the method is not accurate enough.

Disclosure of Invention

The embodiment of the application provides a data acquisition method, a data acquisition device, a terminal and a storage medium, which can improve the accuracy of acquired operation data. The technical scheme is as follows:

In one aspect, a method for obtaining data is provided, the method is executed by a terminal, a game client on the terminal is configured with a hooking function, the game client comprises a filtering function and a processing function provided by a game engine, and the hooking function is used for hooking the processing function; the method comprises the following steps:

In the process of running the game client, calling the filtering function, acquiring original operation data executed in the game client, and filtering the original operation data to obtain target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client;

Invoking the processing function, acquiring the target operation data output by the filtering function, and determining instruction data triggered by the target operation data;

And calling the hook function to acquire the target operation data and the instruction data which are obtained by the processing function.

In another aspect, a data acquisition device is provided and is arranged in a terminal, a game client on the terminal is configured with a hooking function, the game client comprises a filtering function and a processing function provided by a game engine, and the hooking function is used for hooking the processing function; the device comprises:

The data filtering module is used for calling the filtering function in the process of running the game client, acquiring original operation data executed in the game client, filtering the original operation data to obtain target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client;

The data processing module is used for calling the processing function, acquiring the target operation data output by the filtering function and determining instruction data triggered by the target operation data;

And the data acquisition module is used for calling the hook function and acquiring the target operation data and the instruction data which are obtained by the processing function.

Optionally, the hooking function includes a first hooking function and a second hooking function, and the processing function includes a processing input function and a processing instruction function;

The first hooking function is used for hooking the processing input function, and the processing input function is used for acquiring the target operation data;

The second hooking function is used for hooking the processing instruction function, and the processing instruction function is used for determining instruction data triggered by the target operation data.

Optionally, the data acquisition module is configured to:

Calling the first hook function to acquire input data of the processing input function, and acquiring the target operation data;

and calling the second hook function to acquire output data of the processing instruction function, and acquiring the instruction data.

Optionally, the processing input function includes a key input function and a shaft input function, and the target operation data includes key operation data and shaft operation data; the data processing module is used for:

Invoking the key input function to acquire the key operation data output by the filter function, wherein the key operation data comprises at least one of click operation data of a keyboard, click operation data of a mouse, click operation data of a handle or click operation data of a virtual button;

And calling the shaft input function to acquire the shaft operation data output by the filtering function, wherein the shaft operation data comprises at least one of dragging operation data of a mouse, shaking operation data of the mouse or sliding operation data on a screen.

Optionally, the data processing module is configured to:

and calling the processing instruction function, and inquiring the instruction data corresponding to the target operation data in a first mapping relation table, wherein the first mapping relation table is used for storing any operation data and the corresponding instruction data.

Optionally, the apparatus further comprises:

a first storage module for adding the target operation data to an operation data queue;

The second storage module is used for correspondingly storing the target operation data and the instruction data into a second mapping relation table, and the second mapping relation table is used for storing the acquired operation data and the corresponding instruction data.

Optionally, the apparatus further comprises:

The query module is used for clearing the occurrence times of the target instruction data under the condition that the occurrence times of the target instruction data reach the target times in the second mapping relation table, inputting the operation data queue into a behavior recognition model, and the target instruction data is any instruction data in the second mapping relation table;

And the identification module is used for calling the behavior identification model and identifying abnormal operation behaviors based on the operation data queue.

Optionally, the first storage module is configured to:

Deleting the operation data with the earliest acquisition time point in the operation data queue, and adding the target operation data to the operation data queue.

Optionally, the data filtering module is configured to:

Invoking a collection function provided by an operating system, detecting the raw operational data executing in the game client;

And calling the filtering function to acquire the original operation data output by the collecting function.

Optionally, the apparatus further comprises:

And the rendering module is used for calling a game function provided by the game server, acquiring the instruction data output by the processing function and rendering a game picture based on the instruction data.

In another aspect, a terminal is provided, the terminal comprising a processor and a memory, the memory storing at least one computer program, the at least one computer program being loaded and executed by the processor to implement the operations performed by the data acquisition method as described in the above aspects.

In another aspect, there is provided a computer readable storage medium having stored therein at least one computer program loaded and executed by a processor to implement the operations performed by the data acquisition method as described in the above aspects.

In another aspect, a computer program product is provided, comprising a computer program loaded and executed by a processor to implement the operations performed by the data acquisition method as described in the above aspects.

According to the scheme provided by the embodiment of the application, the filtering function provided by the game engine can filter the original operation data to obtain the target operation data with the execution frequency consistent with the game frame rate, and the processing function provided by the game engine can receive the target operation data provided by the filtering function and determine the instruction data triggered by the target operation data. Therefore, the target operation data and the corresponding instruction data after filtering can be obtained by hooking the processing function by adopting the hooking function, and because the execution frequency of the target operation data is consistent with the game frame rate, each target operation data is effective operation data capable of generating game expression, the target operation data obtained by hooking by adopting the mode is more accurate.

Drawings

In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings that are needed in the description of the embodiments will be briefly described below, and it is obvious that the drawings in the following description are only some embodiments of the present application, and other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

FIG. 1 is a schematic illustration of an implementation environment provided by an embodiment of the present application;

FIG. 2 is a flow chart of a method for data acquisition according to an embodiment of the present application;

FIG. 3 is a flowchart of another data acquisition method according to an embodiment of the present application;

FIG. 4 is a schematic diagram of filtering operation data according to an embodiment of the present application;

FIG. 5 is a flowchart of another data acquisition method according to an embodiment of the present application;

FIG. 6 is a system architecture diagram of a data acquisition method according to an embodiment of the present application;

fig. 7 is a schematic structural diagram of a data acquisition device according to an embodiment of the present application;

FIG. 8 is a schematic diagram of another data acquisition device according to an embodiment of the present application;

Fig. 9 is a schematic structural diagram of a terminal according to an embodiment of the present application.

Detailed Description

For the purpose of making the objects, technical solutions and advantages of the embodiments of the present application more apparent, the following detailed description of the embodiments of the present application will be given with reference to the accompanying drawings.

It is to be understood that the terms "first," "second," and the like, as used herein, may be used to describe various concepts, but are not limited by these terms unless otherwise specified. These terms are only used to distinguish one concept from another. For example, a first hooking function may be referred to as a second hooking function, and similarly, a second hooking function may be referred to as a first hooking function, without departing from the scope of the application.

Wherein at least one means one or more, for example, at least one function may be any integer number of functions greater than or equal to one, such as one function, two functions, three functions, and the like. The plurality means two or more, and for example, the plurality of functions may be any integer number of functions equal to or greater than two, such as two functions, three functions, and the like. Each refers to each of at least one, e.g., each function refers to each of a plurality of functions, and if the plurality of functions is 3 functions, each function refers to each of the 3 functions.

It will be appreciated that in embodiments of the present application, where relevant data such as user information is involved, when the above embodiments of the present application are applied to a particular product or technology, user approval or consent is required, and the collection, use and processing of relevant data is required to comply with relevant laws and regulations and standards of the relevant country and region.

The data acquisition method provided by the embodiment of the application can be used in the terminal. Optionally, the terminal is a smart phone, tablet computer, notebook computer, desktop computer, smart speaker, smart watch, smart terminal, etc., but is not limited thereto.

FIG. 1 is a schematic diagram of an implementation environment provided by an embodiment of the present application, referring to FIG. 1, the implementation environment includes: a terminal 101 and a server 102. The terminal 101 and the server 102 are connected by a wireless or wired network.

The embodiment of the application is applied to the field of electronic games. The server 102 sends an installation package of the game client to the terminal 101, wherein the installation package of the game client comprises a filtering function and a processing function provided by a game engine, the terminal 101 calls the filtering function and the processing function to process after installing the game client, the filtering function is used for acquiring original operation data executed in the game client, filtering the original operation data to obtain target operation data with the execution frequency consistent with the game frame rate, and the processing function is used for acquiring the target operation data output by the filtering function, determining instruction data triggered by the target operation data and rendering a game picture based on the instruction data.

In one possible implementation, the server 102 sends an installation package of the game client to the terminal 101 further includes a hooking function that is configured when the game client is installed. Or after the terminal 101 installs the game client, the server 102 transmits the hooking function to the game client, the terminal 101 updates the game client, and the hooking function is configured in the game client. The hooking function is used for hooking the processing function to acquire target operation data and instruction data obtained by the processing function, so that the operation data and the instruction data generated in the game process are collected.

The data acquisition method provided by the embodiment of the application can be applied to any scene in which operation data or instruction data need to be collected in an electronic game.

In one possible implementation, the embodiment of the application is applied to a scene of anti-cheating of a game, and the game can be a shooting game, a fighting game or a strategy simulation game. Taking shooting game as an example, the proposal of the processing function provided by the hook game engine provided by the embodiment of the application is adopted to collect the operation data executed by the player in the game process. After the operation data of the player are collected, the operation data are synchronized to a behavior recognition model of the local client at a specific time point, the behavior recognition model is called, and abnormal operation behaviors of the player are recognized based on the operation data.

For example, the abnormal operation behavior includes a game hole triggered by the use of a mouse macro, which refers to an operation or a set of operations for automatically performing a task, an on-hook behavior, or by performing a specific operation, etc., and the mouse macro refers to a macro operation implemented by a mouse.

Fig. 2 is a flowchart of a data acquisition method provided by an embodiment of the present application, where the embodiment of the present application is executed by a terminal, and referring to fig. 2, the method includes:

201. And the terminal calls a filtering function in the process of running the game client, acquires the original operation data executed in the game client, and filters the original operation data to obtain target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client.

The terminal is provided with a game client which is provided with a hooking function, and the game client also comprises a filtering function and a processing function which are provided by a game engine, wherein the hooking function is used for hooking the processing function. Wherein the hooking function is used to add new processing logic without changing the original execution effect by modifying the original code. The filtering function is used for filtering the collected original operation data, and the processing function is used for receiving the filtered operation data and determining instruction data triggered by the operation data.

It should be noted that the filter function and the processing function are provided by a game engine, and the game engine is applicable to a plurality of games, so that the filter function and the processing function are applicable to a plurality of games, and the filter function and the processing function belong to logic functions of a game engine layer. The logic function of the game engine layer is based on the codes developed by the game engine and is suitable for different games. That is, the filter function and the processing function may be configured in the game client for a game using the game engine.

In the embodiment of the application, the terminal calls the filtering function in the process of running the game client to acquire the original operation data executed in the game client. The original operation data is operation data executed by a user, and the user can execute operations for a plurality of times per second, so that operation data generated by the operations for a plurality of times per second can be obtained. Multiple frames of game pictures can be generated in the game client per second, one frame of game picture can correspond to operation data generated by multiple operations, so that the game picture and the operation data are not in one-to-one correspondence, some operation data can influence the game picture, and some operation data cannot influence the game picture, namely redundant operation data exist. Therefore, the terminal calls the filtering function to filter the original operation data to obtain target operation data with the execution frequency consistent with the game frame rate of the game client, so that the target operation data is consistent with the game picture, the target operation data is ensured to be effective operation data, and redundant operation data does not exist.

202. The terminal calls a processing function, acquires target operation data output by the filtering function, and determines instruction data triggered by the target operation data.

The output data of the filtering function is used for being transmitted into the processing function and used as the input data of the processing function. And the terminal calls the processing function, acquires target operation data output by the filtering function, and determines instruction data triggered by the target operation data. For example, if the target operation data is sliding the mouse leftwards, the instruction data triggered by the target operation data is controlling the virtual object to move leftwards.

203. And the terminal calls a hook function to acquire target operation data and instruction data obtained by processing the function.

The hooking function is used for hooking the processing function, so that the target operation data and instruction data obtained by the processing function can be obtained by calling the hooking function. For example, the hooking function acquires the input data and the output data of the processing function by hooking the processing function, the target operation data is the input data of the processing function, and the instruction data is the output data of the processing function, so that the hooking function can acquire the target operation data and the instruction data.

According to the method provided by the embodiment of the application, the filtering function provided by the game engine can filter the original operation data to obtain the target operation data with the execution frequency consistent with the game frame rate, and the processing function provided by the game engine can receive the target operation data provided by the filtering function and determine the instruction data triggered by the target operation data. Therefore, the target operation data and the corresponding instruction data after filtering can be obtained by hooking the processing function by adopting the hooking function, and because the execution frequency of the target operation data is consistent with the game frame rate, each target operation data is effective operation data capable of generating game expression, the target operation data obtained by hooking by adopting the mode is more accurate.

In addition, as the hooking function is hooked with the processing function provided by the game engine, and the game engine is suitable for various games, the processing function is also suitable for various games, and therefore, only the hooking function suitable for the processing function needs to be developed, and the hooking function can be suitable for various games, so that the applicability is improved.

The embodiment shown in fig. 2 described above briefly illustrates the process of acquiring operation data and instruction data. On the basis of the embodiment shown in fig. 2, the hooking function may be divided into a first hooking function and a second hooking function, and the processing function may be divided into a processing input function and a processing instruction function, and the detailed process of acquiring the operation data and the instruction data is described in the embodiment shown in fig. 3 below. Fig. 3 is a flowchart of a data acquisition method provided by an embodiment of the present application, where the embodiment of the present application is executed by a terminal, and referring to fig. 3, the method includes:

301. The terminal runs the game client.

The terminal is provided with a game client which is provided with a hooking function, and the game client also comprises a filtering function and a processing function which are provided by a game engine, wherein the hooking function is used for hooking the processing function. In an embodiment of the present application, the hooking function includes a first hooking function and a second hooking function, and the processing function includes a processing input function and a processing instruction function. The first hooking function is used for hooking the processing input function, and the processing input function is used for acquiring target operation data. The second hooking function is used for hooking the processing instruction function, and the processing instruction function is used for determining instruction data triggered by the target operation data.

It should be noted that, in the embodiment of the present application, the types of the processing input function and the processing instruction function are not limited, and the hook positions of the first hook function and the second hook function are not limited. The processing input function may be, for example, inputAxis (input axis) function in Unreal Engine (phantom engine), getAxis (fetch axis) function in Unity (a game engine), or the like.

In one possible implementation, a terminal downloads an installation package of a game client, the installation package including the hooking function, the filtering function, and the processing function, and installs the game client through the installation package, thereby configuring the filtering function, the processing function, and the hooking function in the game client, and hooking the hooking function to the processing function.

In another possible implementation, the terminal downloads an installation package of the game client, the installation package including the filter function and the processing function, and installs the game client through the installation package, thereby configuring the filter function and the processing function in the game client. The subsequent terminal can independently download the hooking function in the game server through the game client, configure the hooking function in the game client, and hook the hooking function in the processing function. The hooking function is a section of dynamic code, and can be issued to the game client in real time, so that the hooking function can be conveniently adjusted or modified.

302. And the terminal calls a filtering function in the process of running the game client, acquires the original operation data executed in the game client, and filters the original operation data to obtain target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client.

And the terminal calls the filtering function in the process of running the game client, acquires the original operation data executed in the game client, filters the original operation data to acquire target operation data with the execution frequency consistent with the game frame rate of the game client, ensures that the target operation data are consistent with the game picture, ensures that the target operation data are effective operation data, and has no redundant operation data.

In one possible implementation, the operating system of the terminal is provided with a collection function that belongs to the logical functions of the operating system layer, which is the code provided by the operating system on which the game client is running. The terminal, in the process of running the game client, calls the collection function, and detects original operation data executed in the game client, wherein the original operation data is operation data generated by any operation which is executed by a user and is associated with the game client. And the terminal calls the filtering function to acquire the original operation data output by the collecting function. Wherein the output data of the collection function is used for being input into the filter function as the input data of the filter function.

The collection function is located in the operating system of the terminal, and raw operation data collected by the collection function may be transferred to any application running on the operating system, for example, windows (an operating system) may be transferred to the currently selected window. In the embodiment of the application, when the terminal runs the game client, the game window corresponding to the game client is selected, and then the original operation data collected by the collection function is transmitted into the filtering function in the game client.

Fig. 4 is a schematic diagram of filtering operation data provided by an embodiment of the present application, where, as shown in fig. 4, a collection function provided by an operating system collects original operation data, and fig. 4 is an example in which the original operation data includes original operation data 1-6, and a filtering function provided by a game engine filters the original operation data, so that the execution frequency of the remaining operation data is consistent with the game frame rate. Taking the filtering of the original operation 1, the original operation data 3, the original operation data 4 and the original operation data 6 as examples, the remaining original operation data 2 and original operation data 5 are used as target operation data, the triggered instruction data is determined based on the target operation data, and then the game picture is rendered according to the instruction data, so that the target operation data is more similar to the finally presented game performance. For example, the original operation data 1-6 are used for dragging the mouse downwards to perform gun pressing, and a plurality of operation data dragging the mouse downwards are detected in the duration corresponding to one frame of game picture, and finally the original operation data 2 and the original operation data 5 have influence on game performance by filtering the operation data.

303. And the terminal calls the processing input function to acquire target operation data output by the filtering function.

The target operation data output by the filtering function is transmitted to the processing input function, and the terminal calls the processing input function to acquire the target operation data output by the filtering function.

In one possible implementation, the process input function includes a key input function and a shaft input function, and the target operation data includes key operation data and shaft operation data. The terminal calls the processing function to acquire the target operation data output by the filtering function, including the following two cases.

First case: the terminal calls a key input function to acquire key operation data output by the filter function, wherein the key operation data comprises at least one of click operation data of a keyboard, click operation data of a mouse, click operation data of a handle or click operation data of a virtual button. The key input function is used for collecting filtered key operation data, the keyboard, the mouse and the handle are different types of input devices connected with the terminal, and the virtual buttons are virtual buttons displayed on a screen of the terminal.

Optionally, the button on the mouse is regarded as an axis, and the clicking operation on the mouse is performed when the axis is pushed to the maximum angle (i.e. pushed to the bottom), and the clicking operation on the mouse is performed circularly, i.e. if the button on the mouse is pushed to the bottom continuously for a period of time, the clicking operation is recognized circularly as being performed for a plurality of times. The clicking operation on the key in the keyboard is not performed in a circulating manner, that is, no matter how long the key in the keyboard is pressed, the clicking operation is recognized as being performed once, and when the key is released and pressed again, the clicking operation is recognized as being performed for the second time.

Optionally, the click operation data of the keyboard, the mouse, the handle and the virtual buttons comprise key values, key duration and the like, and each key on the keyboard, the mouse and the handle and each virtual button on the terminal correspond to one key value.

Second case: the terminal calls an axis input function to acquire axis operation data output by the filter function, wherein the axis operation data comprises at least one of dragging operation data of a mouse, shaking operation data of the mouse or sliding operation data on a screen.

Wherein, the dragging operation data of the mouse, the shaking operation data of the mouse or the sliding operation data on the screen comprise movement displacement, movement duration and the like. The automatic hook macro, the gun pressing macro, and the like can be identified by detecting the shaft operation data.

Taking the drag operation data of the mouse as an example, the mouse is simulated by the game engine into a device with two input axes, namely an X axis and a Y axis, and the drag operation data comprises the drag operation data of the mouse on the X axis and the drag operation data on the Y axis.

304. And the terminal calls a first hook function to acquire input data of the input function to obtain target operation data.

The first hooking function is used for hooking the processing input function, before the processing input function is called to acquire target operation data, the first hooking function is called to acquire the target operation data to be transmitted into the processing input function, and after the first hooking function acquires the target operation data, the processing input function is called to acquire the target operation data. The method is equivalent to calling the first hook function, input data of a processing input function is obtained, the input data of the processing input function is the target operation data, and therefore the target operation data is obtained by calling the first hook function.

305. And the terminal calls a processing instruction function to determine instruction data triggered by the target operation data.

The target operation data is also transmitted into a processing instruction function, the terminal calls the processing input function, processes the instruction function, and determines instruction data triggered by the target operation data.

Wherein different operation data are used for triggering different instruction data, such as the click operation data of a gun-opening button are used for triggering gun-opening instruction data, the click operation data of the gun-opening button are used for triggering the jump instruction data, the click operation data of the squatting button are used for triggering squatting instruction data, the left-sliding operation data of a mouse are used for triggering instruction data for moving the visual angle leftwards, the method comprises the steps of enabling right-sliding operation data of a mouse to be used for triggering instruction data for enabling a visual angle to move rightwards, enabling downslide operation data of the mouse to be used for triggering instruction data for enabling the visual angle to move downwards, enabling upslide operation data of the mouse to be used for triggering instruction data for enabling the visual angle to move upwards, enabling click operation data of w keys on a keyboard to be used for triggering instruction data for controlling a virtual object to move forwards and the like.

In one possible implementation, the game client stores a first mapping relation table, where the first mapping relation table is used to store any operation data and corresponding instruction data. The terminal calls a processing instruction function, and inquires instruction data corresponding to target operation data in a first mapping relation table.

306. And the terminal calls a second hook function to acquire output data of the processing instruction function, and instruction data is acquired.

The second hooking function is used for hooking the processing instruction function, and after the processing instruction function is called to obtain instruction data, the second hooking function is called to obtain the output data of the processing instruction function, and the output data of the processing instruction function is the instruction data, so that the target instruction data is obtained by calling the second hooking function.

In the embodiment of the application, the hooking function and the processing function provided by the game engine are hooked, and as the processing function obtains the filtered target operation data, the execution frequency of the target operation data is consistent with the game frame rate, the operation data obtained by hooking in the mode can be effective operation data for generating game expression, and the accuracy is improved.

And the hooking function and the processing function provided by the game engine are hooked, so that the instruction data determined by the game engine can be directly acquired, and the instruction data triggered by each target operation data can be definitely acquired. The game engine is suitable for various games, so that the method is also suitable for various games, the universality of the data acquisition method is improved, different hook functions are not required to be developed for different games to sense instructions generated in the games, the actual meaning of each target operation data is further confirmed in an auxiliary mode, and the workload of game adaptation is effectively reduced.

By executing the steps 303-304, the terminal is enabled to call the processing function, obtain the target operation data output by the filtering function, determine the instruction data triggered by the target operation data, call the hooking function, and obtain the target operation data and the instruction data obtained by the processing function.

On the basis of the embodiments shown in fig. 2 and 3, after the target operation data and the instruction data are acquired, abnormal operation behaviors can be identified based on the target operation data and the instruction data, and the detailed process is described in the embodiment shown in fig. 5 below. Fig. 5 is a flowchart of another data acquisition method provided in an embodiment of the present application, where the embodiment of the present application is executed by a terminal, and referring to fig. 5, the method includes:

501. The terminal runs the game client.

The game client on the terminal is configured with a hooking function, the game client comprises a filtering function and a processing function provided by the game engine, and the hooking function is used for hooking the processing function. The process of step 501 is the same as that of step 301, and will not be described again.

502. And the terminal calls a filtering function in the process of running the game client, acquires the original operation data executed in the game client, and filters the original operation data to obtain target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client.

The process of step 502 is the same as the processes of step 201 and step 301, and will not be described again.

503. The terminal calls a processing function, acquires target operation data output by the filtering function, and determines instruction data triggered by the target operation data.

The process of step 503 is the same as the processes of step 202, step 303 and step 305 described above, and will not be described again.

504. And the terminal calls a hook function to acquire target operation data and instruction data obtained by processing the function.

The process of step 504 is the same as the processes of step 203, step 304 and step 306 described above, and will not be described again.

505. The terminal calls a game function provided by the game server, obtains instruction data output by the processing function, and renders a game picture based on the instruction data.

The game client also comprises game functions provided by the game server, wherein the game functions belong to logic functions of a game layer, the logic functions of the game layer are code logic written by game developers, and the games are different. The game function is used for rendering game pictures based on instruction data. The terminal calls the game function, processes the instruction data output by the function, and then renders a game picture matched with the instruction data according to the instruction of the instruction data, for example, the instruction data instructs to control the virtual object to move leftwards, and the game picture rendered based on the instruction data is a game picture for controlling the virtual object to move leftwards.

Because the execution frequency of the target operation data is consistent with the game frame rate, redundant data is filtered, the instruction data is triggered by the target operation data, and the game picture is rendered based on the instruction data, so that the target operation data is more similar to game performance generated based on the instruction data, and therefore, the target operation data acquired in the embodiment of the application are all effective operation data.

506. The terminal adds the target operation data to the operation data queue.

After the terminal calls the hooking function to acquire the target operation data, the hooking function is continuously called to add the target operation data to an operation data queue, and the operation data queue is used for storing the acquired operation data. Optionally, the hooking function includes a first hooking function, the first hooking function is used for acquiring the target operation data, and the terminal calls the first hooking function to add the target operation data to the operation data queue.

In one possible implementation, the terminal deletes the operation data with the earliest acquisition time point in the operation data queue, and adds the target operation data to the operation data queue. In the embodiment of the application, each time new operation data is added into the operation data queue, old operation data in the operation data queue is deleted, so that the operation data queue can be a queue with a fixed length, thereby ensuring that the latest operation data is recorded with minimum memory loss.

Optionally, the operation data queue is a circular queue, the operation data in the circular queue are arranged according to the order of the acquisition time points, the terminal deletes the last operation data in the operation data queue, and the target operation data is added to the operation data queue as the first operation data.

Optionally, the target operation data includes key operation data and axis operation data, the operation data queue includes a key operation data queue and an axis operation data queue, the terminal deletes key operation data with earliest acquisition time point in the key operation data queue, adds currently acquired key operation data to the key operation data queue, deletes axis operation data with earliest acquisition time point in the axis operation data queue, and adds currently acquired axis operation data to the axis operation data queue.

507. The terminal correspondingly stores the target operation data and the instruction data into a second mapping relation table, wherein the second mapping relation table is used for storing the acquired operation data and the corresponding instruction data.

After the terminal calls the hooking function to acquire the target operation data and the instruction data, the terminal continues to call the hooking function to correspondingly store the target operation data and the instruction data into the second mapping relation table. Optionally, the hooking function includes a second hooking function, the second hooking function obtains instruction data triggered by the target operation data, and the terminal calls the second hooking function to store the target operation data and the instruction data in a second mapping relation table correspondingly.

In one possible implementation manner, the second mapping relation table is a key-value (key-value pair) hash table, and because the query logic of the hash table is simpler, the mapping relation is stored by adopting the hash table, so that the influence of the newly added logic corresponding to the hook function on the game performance can be reduced. The hash table is shown in table 1 below.

TABLE 1

key	value
		Operation data 1	Instruction data 1
Operation data 2	Instruction data 2
		Operation data 3	Instruction data 3
……	……

As shown in table 1, the operation data is used as a key, the instruction data is stored as a value in the hash table, and the operation data and the instruction data are stored in one-to-one correspondence.

508. And under the condition that the terminal inquires that the occurrence times of the target instruction data reach the target times in the second mapping relation table, clearing the occurrence times of the target instruction data, inputting the operation data queue into the behavior recognition model, wherein the target instruction data is any instruction data in the second mapping relation table.

The terminal periodically inquires the occurrence times of each instruction data in the second mapping relation table, when the terminal inquires that the occurrence times of the target instruction data reach the target times, the occurrence times of the target instruction data are cleared, and the operation data queue is input into the behavior recognition model.

The target instruction data may be any instruction data in the second mapping table, for example, the target number of times is N (N is a positive integer), and the target instruction data is an instruction for controlling the virtual object to fire, and when the number of times of fire of the virtual object reaches N, the operation data queue is input to the behavior recognition model. Or the target instruction data is an instruction of the virtual object to defeat the enemy, and when the number of the virtual object to defeat the enemy reaches N, the operation data queue is input into the behavior recognition model. Or the target instruction data is used for making target actions for the virtual object, and when the number of times of making target actions for the virtual object reaches N, the operation data queue is input into the behavior recognition model.

The behavior recognition model is used for recognizing abnormal operation behaviors based on the operation data queue. Optionally, the behavior recognition model is stored in the game client, and the terminal directly inputs the operation data queue to the behavior recognition model. Optionally, the behavior recognition model is stored in the game server, and the terminal reports the operation data queue to the game server, and inputs the operation data queue to the behavior recognition model through the game server.

In one possible implementation manner, the game client further includes a data reporting function, where the data reporting function and the hooking function are issued together and configured in the game client, and when the terminal invokes the data reporting function to query that the number of occurrences of the target instruction data in the second mapping relationship table reaches the target number, the terminal clears the number of occurrences of the target instruction data, and inputs the operation data queue to the behavior recognition model.

In the embodiment of the application, the data reporting function and the hooking function are dynamic codes issued to the game client, the data reporting function circularly traverses the operation data queue maintained by the first hooking function, inquires the occurrence times of all instruction data according to the second mapping relation table maintained by the second hooking function, if the occurrence times reach the target times, the current operation data queue is sent to the behavior recognition model, the occurrence times of the instruction data are synchronously cleared, and when the occurrence times of the instruction data reach the target times again, the current operation data queue is sent to the behavior recognition model again.

It should be noted that, the execution logic of the step 506, the step 507 and the step 508 are asynchronous, that is, independent, and the execution sequence among the step 506, the step 507 and the step 508 is not limited in the embodiment of the present application.

509. The terminal calls a behavior recognition model to recognize abnormal operation behaviors based on the operation data queue.

The terminal calls the behavior recognition model to recognize the operation data in the operation data queue, so as to recognize whether the current operation data is generated by abnormal operation behavior. The abnormal operation behavior includes a game vulnerability triggered by using a mouse macro, an on-hook behavior, or by performing a specific operation, etc.

In one possible implementation manner, the training data of the behavior recognition model is also obtained by adopting the data acquisition method provided by the embodiment of the application. The redundant operation data can cause the difference of the characteristic distribution of the original operation data samples, under the condition of limited sample number, the behavior recognition model can learn the characteristic change caused by capturing the redundant data, but the characteristic change of the part is not caused by abnormal operation behaviors, so that the behavior recognition model is excessively fitted with meaningless data to classify, and the judgment precision is affected. However, since the operation data obtained by the embodiment of the application are all effective operation data and affect the game performance, the operation data obtained by the data acquisition method provided by the embodiment of the application is used for training the behavior recognition model, so that the behavior recognition model can be prevented from being on invalid operation data, and the judgment precision of the behavior recognition model is improved. The behavior recognition model is subsequently called to recognize the effective operation data obtained by the embodiment of the application, so that the accuracy of recognizing abnormal operation behaviors can be improved.

Fig. 6 is a system architecture diagram of a data acquisition method according to an embodiment of the present application, where, as shown in fig. 6, a game server downloads a dynamic code to a game client, where the dynamic code includes a first hooking function, a second hooking function, and a data reporting function, where the first hooking function and the second hooking function are used to hook a logic function of a game engine layer, the first hooking function acquires an operation data queue, where the operation data queue is used to store acquired operation data, and the second hooking function acquires a second mapping relation table, where the second mapping relation table is used to store the acquired operation data and corresponding instruction data. And the data reporting function periodically queries the second mapping relation table, when the occurrence times of the target instruction data are queried in the second mapping relation table to reach the target times, the operation data queue maintained by the first hook function is reported to the game server, and the game server invokes the behavior recognition model to recognize abnormal behavior data based on the operation data queue.

According to the method provided by the embodiment of the application, the acquisition logic of the operation data is switched from the operation system layer to the game engine layer, and the filtered operation data is acquired, so that the acquired operation data is more attached to the game performance. The acquisition logic of the instruction data is switched from the game layer to the game engine layer, so that different acquisition logic does not need to be developed for different games, and the workload of game adaptation is reduced.

In addition, through the processing instruction function provided by the hook game engine, not only the instruction data generated in the game can be perceived, but also the operation data triggering each instruction data, namely the corresponding relation between the operation data and the instruction data, is perceived, and the abnormal operation behavior of the user can be analyzed through the operation data and the corresponding instruction data.

In order to verify the effectiveness of the embodiment of the present application, experiments are performed by using the method provided by the related technology and the operation data obtained by the method provided by the present application, so as to identify the mouse macro in the shooting game, where the operation data obtained by the method of the related technology is the operation data obtained from the operation system layer, the execution frequency of the operation data is higher than the game frame rate, and the operation data obtained by the method provided by the embodiment of the present application is the operation data obtained from the game engine layer, and the execution frequency of the operation data is consistent with the game frame rate.

The recognition amount of the operation data obtained by the related art method and the recognition amount of the operation data obtained by the method according to the embodiment of the present application are shown in table 2 below.

TABLE 2

	The daily average identification quantity of the embodiment of the application	Daily average identification of related art
			Continuous point mouse macro	73	38
Gun pressing mouse macro	147	33
			Total amount of	220	71

As shown in table 2, the average daily recognition amount of the embodiment of the present application is significantly higher than that of the related art.

The game adaptation time length of the related art method and the game adaptation time length of the method of the embodiment of the present application are shown in table 3 below.

TABLE 3 Table 3

Since the game 1 and the game 2 are developed based on the same game engine, after the game 1 completes the adaptation of the game engine, only a small amount of time is needed to be invested for verification when the game 2 is first adapted. With the method provided by the related art, both game 1 and game 2 need to use a longer time to complete the first adaptation. In addition, in the game updating and adapting process, as the related technology hooks the logic function of the game layer, more time is required to update the hook position for each update, and the proposal hooks the logic function of the game engine layer, the game update can not cause the change of the logic function of the game engine layer, thus the hook position is not required to be updated, and only a small amount of time is required to confirm that the proposal is feasible.

Fig. 7 is a schematic structural diagram of a data acquisition device according to an embodiment of the present application. Referring to fig. 7, the apparatus is provided in a terminal, and a game client on the terminal is configured with a hooking function, the game client includes a filtering function and a processing function provided by a game engine, and the hooking function is used for hooking the processing function; the device comprises:

The data filtering module 701 is configured to call the filtering function in the process of running the game client, obtain original operation data executed in the game client, and filter the original operation data to obtain target operation data, where the execution frequency of the target operation data is consistent with the game frame rate in the game client;

The data processing module 702 is configured to call the processing function, obtain the target operation data output by the filtering function, and determine instruction data triggered by the target operation data;

The data acquisition module 703 is configured to call the hooking function and acquire the target operation data and the instruction data obtained by the processing function.

According to the data acquisition device provided by the embodiment of the application, the filtering function provided by the game engine can filter the original operation data to obtain the target operation data with the execution frequency consistent with the game frame rate, and the processing function provided by the game engine can receive the target operation data provided by the filtering function and determine the instruction data triggered by the target operation data. Therefore, the target operation data and the corresponding instruction data after filtering can be obtained by hooking the processing function by adopting the hooking function, and because the execution frequency of the target operation data is consistent with the game frame rate, each target operation data is effective operation data capable of generating game expression, the target operation data obtained by hooking by adopting the mode is more accurate.

Optionally, referring to fig. 8, the hooking function includes a first hooking function and a second hooking function, and the processing function includes a processing input function and a processing instruction function;

Optionally, referring to fig. 8, the data acquisition module 703 is configured to:

Alternatively, referring to fig. 8, the process input function includes a key input function and a shaft input function, and the target operation data includes key operation data and shaft operation data; the data processing module 702 is configured to:

Optionally, referring to fig. 8, the data processing module 702 is configured to:

Optionally, referring to fig. 8, the apparatus further includes:

a first storage module 704 for adding the target operation data to an operation data queue;

the second storage module 705 is configured to store the target operation data and the instruction data in a second mapping relationship table, where the second mapping relationship table is configured to store the obtained operation data and the corresponding instruction data.

Optionally, referring to fig. 8, the apparatus further includes:

the query module 706 is configured to clear the number of occurrences of the target instruction data, input the operation data queue to the behavior recognition model, and determine that the target instruction data is any instruction data in the second mapping relationship table when the number of occurrences of the target instruction data is queried in the second mapping relationship table to reach the target number;

And the identification module 707 is used for calling the behavior identification model and identifying abnormal operation behaviors based on the operation data queue.

Optionally, referring to fig. 8, the first storage module 704 is configured to:

Optionally, referring to fig. 8, the data filtering module 701 is configured to:

Optionally, referring to fig. 8, the apparatus further includes:

and the rendering module 708 is used for calling a game function provided by the game server, acquiring the instruction data output by the processing function, and rendering a game picture based on the instruction data.

It should be noted that: the data acquisition device provided in the above embodiment is only exemplified by the division of the above functional modules, and in practical application, the above functional allocation may be performed by different functional modules according to needs, that is, the internal structure of the terminal is divided into different functional modules, so as to complete all or part of the functions described above. In addition, the data acquisition device and the data acquisition method provided in the foregoing embodiments belong to the same concept, and specific implementation processes of the data acquisition device and the data acquisition method are detailed in the method embodiments and are not repeated herein.

The embodiment of the application also provides a terminal, which comprises a processor and a memory, wherein at least one computer program is stored in the memory, and the at least one computer program is loaded and executed by the processor to realize the operations executed in the data acquisition method of the embodiment.

Fig. 9 illustrates a schematic structure of a terminal 900 according to an exemplary embodiment of the present application.

The terminal 900 includes: a processor 901 and a memory 902.

Processor 901 may include one or more processing cores, such as a 4-core processor, an 8-core processor, and the like. The processor 901 may be implemented in at least one hardware form of DSP (DIGITAL SIGNAL Processing), FPGA (Field Programmable GATE ARRAY ), PLA (Programmable Logic Array, programmable logic array). Processor 901 may also include a main processor, which is a processor for processing data in an awake state, also referred to as a CPU (Central Processing Unit ), and a coprocessor; a coprocessor is a low-power processor for processing data in a standby state. In some embodiments, the processor 901 may integrate a GPU (Graphics Processing Unit, an image processing interactor) for rendering and drawing of content required to be displayed by the display screen. In some embodiments, the processor 901 may also include an AI (ARTIFICIAL INTELLIGENCE ) processor for processing computing operations related to machine learning.

The memory 902 may include one or more computer-readable storage media, which may be non-transitory. The memory 902 may also include high-speed random access memory, as well as non-volatile memory, such as one or more magnetic disk storage devices, flash memory storage devices. In some embodiments, a non-transitory computer readable storage medium in memory 902 is used to store at least one computer program for being possessed by processor 901 to implement the data acquisition methods provided by the method embodiments of the present application.

In some embodiments, the terminal 900 may further optionally include: a peripheral interface 903, and at least one peripheral. The processor 901, memory 902, and peripheral interface 903 may be connected by a bus or signal line. The individual peripheral devices may be connected to the peripheral device interface 903 via buses, signal lines, or circuit boards. Optionally, the peripheral device comprises: at least one of radio frequency circuitry 904, a display 905, a camera assembly 906, audio circuitry 907, and a power source 908.

The peripheral interface 903 may be used to connect at least one peripheral device associated with an I/O (Input/Output) to the processor 901 and the memory 902. In some embodiments, the processor 901, memory 902, and peripheral interface 903 are integrated on the same chip or circuit board; in some other embodiments, either or both of the processor 901, the memory 902, and the peripheral interface 903 may be implemented on separate chips or circuit boards, which is not limited in this embodiment.

The Radio Frequency circuit 904 is configured to receive and transmit RF (Radio Frequency) signals, also known as electromagnetic signals. The radio frequency circuit 904 communicates with a communication network and other communication devices via electromagnetic signals. The radio frequency circuit 904 converts an electrical signal into an electromagnetic signal for transmission, or converts a received electromagnetic signal into an electrical signal. Optionally, the radio frequency circuit 904 includes: antenna systems, RF transceivers, one or more amplifiers, tuners, oscillators, digital signal processors, codec chipsets, subscriber identity module cards, and so forth. The radio frequency circuitry 904 may communicate with other devices via at least one wireless communication protocol. The wireless communication protocol includes, but is not limited to: metropolitan area networks, various generations of mobile communication networks (2G, 3G, 4G, and 5G), wireless local area networks, and/or WiFi (WIRELESS FIDELITY ) networks. In some embodiments, the radio frequency circuit 904 may further include NFC (NEAR FIELD Communication) related circuits, which is not limited by the present application.

The display 905 is used to display a UI (User Interface). The UI may include graphics, text, icons, video, and any combination thereof. When the display 905 is a touch display, the display 905 also has the ability to capture touch signals at or above the surface of the display 905. The touch signal may be input as a control signal to the processor 901 for processing. At this time, the display 905 may also be used to provide virtual buttons and/or a virtual keyboard, also referred to as soft buttons and/or a soft keyboard. In some embodiments, the display 905 may be one and disposed on the front panel of the terminal 900; in other embodiments, the display 905 may be at least two, respectively disposed on different surfaces of the terminal 900 or in a folded design; in other embodiments, the display 905 may be a flexible display disposed on a curved surface or a folded surface of the terminal 900. Even more, the display 905 may be arranged in an irregular pattern other than rectangular, i.e., a shaped screen. The display 905 may be made of LCD (Liquid CRYSTAL DISPLAY), OLED (Organic Light-Emitting Diode) or other materials.

The camera assembly 906 is used to capture images or video. Optionally, the camera assembly 906 includes a front camera and a rear camera. The front camera is disposed on the front panel of the terminal 900, and the rear camera is disposed on the rear surface of the terminal 900. In some embodiments, the at least two rear cameras are any one of a main camera, a depth camera, a wide-angle camera and a tele camera, so as to realize that the main camera and the depth camera are fused to realize a background blurring function, and the main camera and the wide-angle camera are fused to realize a panoramic shooting and Virtual Reality (VR) shooting function or other fusion shooting functions. In some embodiments, camera assembly 906 may also include a flash. The flash lamp can be a single-color temperature flash lamp or a double-color temperature flash lamp. The dual-color temperature flash lamp refers to a combination of a warm light flash lamp and a cold light flash lamp, and can be used for light compensation under different color temperatures.

The audio circuit 907 may include a microphone and a speaker. The microphone is used for collecting sound waves of users and the environment, converting the sound waves into electric signals, and inputting the electric signals to the processor 901 for processing, or inputting the electric signals to the radio frequency circuit 904 for voice communication. For purposes of stereo acquisition or noise reduction, the microphone may be plural and disposed at different portions of the terminal 900. The microphone may also be an array microphone or an omni-directional pickup microphone. The speaker is used to convert electrical signals from the processor 901 or the radio frequency circuit 904 into sound waves. The speaker may be a conventional thin film speaker or a piezoelectric ceramic speaker. When the speaker is a piezoelectric ceramic speaker, not only the electric signal can be converted into a sound wave audible to humans, but also the electric signal can be converted into a sound wave inaudible to humans for ranging and other purposes. In some embodiments, the audio circuit 907 may also include a headphone jack.

A power supply 908 is used to power the various components in the terminal 900. The power source 908 may be alternating current, direct current, disposable or rechargeable. When the power source 908 comprises a rechargeable battery, the rechargeable battery may support wired or wireless charging. The rechargeable battery may also be used to support fast charge technology.

In some embodiments, terminal 900 can further include one or more sensors 909. The one or more sensors 909 include, but are not limited to: acceleration sensor 910, gyroscope sensor 911, pressure sensor 912, optical sensor 913, and proximity sensor 914.

The acceleration sensor 910 may detect the magnitudes of accelerations on three coordinate axes of a coordinate system established with the terminal 900. For example, the acceleration sensor 910 may be used to detect components of gravitational acceleration in three coordinate axes. The processor 901 may control the display 905 to display the user interface in a landscape view or a portrait view according to the gravitational acceleration signal acquired by the acceleration sensor 910. The acceleration sensor 910 may also be used for the acquisition of motion data of a game or a user.

The gyro sensor 911 may detect the body direction and the rotation angle of the terminal 900, and the gyro sensor 911 may collect the 3D motion of the user to the terminal 900 in cooperation with the acceleration sensor 910. The processor 901 may implement the following functions based on the data collected by the gyro sensor 911: motion sensing (e.g., changing UI according to a tilting operation by a user), image stabilization at shooting, game control, and inertial navigation.

Pressure sensor 912 may be disposed on a side frame of terminal 900 and/or on an underside of display 905. When the pressure sensor 912 is disposed at a side frame of the terminal 900, a grip signal of the user to the terminal 900 may be detected, and the processor 901 performs a left-right hand recognition or a shortcut operation according to the grip signal collected by the pressure sensor 912. When the pressure sensor 912 is disposed at the lower layer of the display 905, the processor 901 performs control of an operability control on the UI interface according to the pressure operation of the user on the display 905. The operability controls include at least one of a button control, a scroll bar control, an icon control, and a menu control.

The optical sensor 913 is used to collect the intensity of the ambient light. In one embodiment, the processor 901 may control the display brightness of the display panel 905 based on the intensity of ambient light collected by the optical sensor 913. Optionally, when the ambient light intensity is high, the display brightness of the display 905 is turned up; when the ambient light intensity is low, the display luminance of the display panel 905 is turned down. In another embodiment, the processor 901 may also dynamically adjust the shooting parameters of the camera assembly 906 according to the ambient light intensity collected by the optical sensor 913.

A proximity sensor 914, also referred to as a distance sensor, is provided on the front panel of the terminal 900. The proximity sensor 914 is used to collect the distance between the user and the front of the terminal 900. In one embodiment, when the proximity sensor 914 detects that the distance between the user and the front face of the terminal 900 is gradually decreasing, the processor 901 controls the display 905 to switch from the bright screen state to the off screen state; when the proximity sensor 914 detects that the distance between the user and the front surface of the terminal 900 gradually increases, the processor 901 controls the display 905 to switch from the off-screen state to the on-screen state.

Those skilled in the art will appreciate that the structure shown in fig. 9 is not limiting and that more or fewer components than shown may be included or certain components may be combined or a different arrangement of components may be employed.

The embodiment of the application also provides a computer readable storage medium, in which at least one computer program is stored, and the at least one computer program is loaded and executed by a processor to implement the operations performed by the data acquisition method of the above embodiment.

The embodiment of the application also provides a computer program product, which comprises a computer program, wherein the computer program is loaded and executed by a processor to realize the operations executed by the data acquisition method of the embodiment.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by a program for instructing relevant hardware, where the program may be stored in a computer readable storage medium, and the storage medium may be a read-only memory, a magnetic disk or an optical disk, etc.

The foregoing description of the embodiments of the application is merely illustrative of the principles of the embodiments of the present application, and various modifications, equivalents, improvements, etc. may be made without departing from the spirit and principles of the embodiments of the application.

Claims

1. A data acquisition method, characterized in that it is executed by a terminal, a game client on the terminal is configured with a hook function, the game client includes a filter function and a processing function provided by a game engine, and the hook function is used to hook the processing function; the method comprises:

In the process of running the game client, calling the filtering function, obtaining original operation data executed in the game client, filtering the original operation data to obtain target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client;

Calling the processing function, obtaining the target operation data output by the filtering function, and determining the instruction data triggered by the target operation data;

The hook function is called to obtain the target operation data and the instruction data obtained by the processing function.

2. The method according to claim 1, characterized in that the hook function includes a first hook function and a second hook function, and the processing function includes a processing input function and a processing instruction function;

The first hook function is used to hook the processing input function, and the processing input function is used to obtain the target operation data;

The second hook function is used to hook the processing instruction function, and the processing instruction function is used to determine the instruction data triggered by the target operation data.

3. The method according to claim 2, characterized in that the calling of the hook function to obtain the target operation data and the instruction data obtained by the processing function comprises:

Calling the first hook function, acquiring the input data of the processing input function, and obtaining the target operation data;

The second hook function is called to obtain the output data of the processing instruction function to obtain the instruction data.

4. The method according to claim 2, characterized in that the processing input function includes a key input function and an axis input function, and the target operation data includes key operation data and axis operation data; calling the processing function to obtain the target operation data output by the filtering function comprises:

Calling the key input function to obtain the key operation data output by the filtering function, wherein the key operation data includes at least one of keyboard click operation data, mouse click operation data, handle click operation data, and virtual button click operation data;

The axis input function is called to obtain the axis operation data output by the filter function, wherein the axis operation data includes at least one of dragging operation data of a mouse, shaking operation data of a handle, or sliding operation data on a screen.

5. The method according to claim 2, wherein determining the instruction data triggered by the target operation data comprises:

The processing instruction function is called to query the instruction data corresponding to the target operation data in a first mapping relationship table, wherein the first mapping relationship table is used to store any operation data and the corresponding instruction data.

6. The method according to claim 1, characterized in that after calling the hook function and obtaining the target operation data and the instruction data obtained by the processing function, the method further comprises:

Adding the target operation data to an operation data queue;

The target operation data and the instruction data are stored in a second mapping relationship table correspondingly, and the second mapping relationship table is used to store the acquired operation data and the corresponding instruction data.

7. The method according to claim 6, characterized in that the method further comprises:

When the number of occurrences of the target instruction data in the second mapping relationship table reaches the target number, the number of occurrences of the target instruction data is cleared, and the operation data queue is input into the behavior recognition model, and the target instruction data is any instruction data in the second mapping relationship table;

The behavior recognition model is called to identify abnormal operation behavior based on the operation data queue.

8. The method according to claim 6, wherein adding the target operation data to the operation data queue comprises:

The operation data with the earliest acquisition time point in the operation data queue is deleted, and the target operation data is added to the operation data queue.

9. The method according to any one of claims 1 to 8, characterized in that the calling of the filter function to obtain the original operation data executed in the game client comprises:

Calling a collection function provided by the operating system to detect the original operation data executed in the game client;

The filtering function is called to obtain the original operation data output by the collecting function.

10. The method according to any one of claims 1 to 8, characterized in that after calling the processing function, obtaining the target operation data output by the filtering function, and determining the instruction data triggered by the target operation data, the method further comprises:

Call the game function provided by the game server, obtain the instruction data output by the processing function, and render the game screen based on the instruction data.

11. A data acquisition device, characterized in that it is arranged in a terminal, a game client on the terminal is configured with a hook function, the game client includes a filter function and a processing function provided by a game engine, and the hook function is used to hook the processing function; the device comprises:

A data filtering module, used to call the filtering function during the running of the game client, obtain the original operation data executed in the game client, filter the original operation data, and obtain target operation data, wherein the execution frequency of the target operation data is consistent with the game frame rate in the game client;

A data processing module, used to call the processing function, obtain the target operation data output by the filtering function, and determine the instruction data triggered by the target operation data;

The data acquisition module is used to call the hook function to acquire the target operation data and the instruction data obtained by the processing function.

12. A terminal, characterized in that the terminal comprises a processor and a memory, wherein the memory stores at least one computer program, and the at least one computer program is loaded and executed by the processor to implement the operations performed by the data acquisition method according to any one of claims 1 to 10.

13. A computer-readable storage medium, characterized in that at least one computer program is stored in the computer-readable storage medium, and the at least one computer program is loaded and executed by a processor to implement the operations performed by the data acquisition method according to any one of claims 1 to 10.

14. A computer program product, comprising a computer program, wherein the computer program is loaded and executed by a processor to implement the operations performed by the data acquisition method according to any one of claims 1 to 10.