Applying Graph Neural Networks for Anti‑Cheat in Activity Scenarios

Introduction – With the escalating arms race between anti‑cheat systems and black‑market cheating, new cheating methods emerge constantly. In activity‑driven user growth (e.g., invitation‑for‑rewards), large numbers of fraudulent accounts form tightly‑connected groups, making detection difficult.

Challenges – (1) Existing models (tree, DNN, traditional ML) focus on individual user features and ignore relational information between users, which is crucial for identifying “clan‑type” cheating. (2) Sample purity is low because randomly sampled negative data may contain undiscovered cheats, limiting supervised learning performance.

Graph Modeling Solution – Graph neural networks (GNNs) can jointly learn node attributes and graph topology, and as semi‑supervised models they can leverage abundant unlabeled data to boost recall. Two GNN variants are explored: a standard GCN on a single graph and a multi‑graph concatenation model (SCGCN).

GCN Basics – GCN aggregates first‑order neighbor information in each layer; stacking layers propagates multi‑hop information. The propagation rule uses the normalized adjacency matrix (with self‑loops) and a learnable weight matrix, enabling simultaneous learning of node features and edge‑based relationships.

Application to Invitation Activity – Users are modeled as nodes; edges represent shared attributes such as “city + device model” or “IP + device model”. Edge weights below a threshold are pruned to reduce noise. This graph captures the master‑apprentice relationships that cheating groups exploit.

Model Variants

GCN – single‑graph training.

edge_union – merges edges from multiple graphs into one unified graph.

scgcn‑split – uses embeddings from a trained graph as features for a second graph.

scgcn – concatenates two graphs and trains them jointly (serial fusion).

Experimental Results – The GCN model increased cheat‑sample recall by 42.97 %. The serial fusion SCGCN achieved the highest absolute recall, while edge_union performed worse than single‑graph GCN due to loss of edge type information.

Conclusion & Outlook – Graph models enrich anti‑cheat systems by exploiting relational data, achieving a 50 % lift in recalled cheating samples for invitation activities. Future work includes learning edge weights, incorporating attention‑based GAT, and deeper GCN variants such as DeepGCN to further improve detection sensitivity.