Graph Algorithm Practices for Anti‑Cheat on the Douyu Live‑Streaming Platform

Guest: Wang Lu, Algorithm Expert at Douyu Editor: Lou Zhengyu Platform: DataFunTalk

Introduction: Douyu, a personal live‑streaming platform, suffers from both gray‑black market activities and massive fake traffic, which are major challenges for its risk‑control system. The article introduces how graph algorithms are applied to combat these issues.

01. Douyu Traffic Risk‑Control Scenario

Most of the risk‑control targets are streamers who may generate fake views, followers, or experience points to boost their rankings and earnings. These fraudulent activities form a heavy‑hit area for the platform, alongside typical marketing and acquisition campaigns.

02. Douyu Graph Algorithm System

The overall framework consists of low‑level graph operators (neighbor sampling, random walk, sub‑graph extraction), followed by standard graph algorithms such as knowledge‑graph‑based construction, behavior‑synchrony graphs, K‑NN graphs, label propagation, graph partitioning, and embedding methods (Node2Vec, EGES, graph clipping). These are primarily used for anti‑cheat risk‑control, with extensions to recommendation via graph‑based vector retrieval.

2. Evolution of Douyu Graph Algorithms

Started in 2018 with basic graph segmentation (connected components, label propagation). Limitations such as over‑reliance on graph construction and coarse partitioning led to enhancements in 2019: richer graph construction via knowledge‑graph inference and similarity‑based edges, and graph representation learning to incorporate node attributes. In 2020, a full‑scene gang‑mining algorithm was introduced to link multiple scenarios, reduce false positives, and improve interpretability.

03. Graph‑Based Risk‑Control Modeling

Advantages of Graph Algorithms for Anti‑Cheat

Graph structures naturally capture the clustered, coordinated behavior of black‑market gangs, provide robustness against evolving attacks, and efficiently model relational data that traditional statistical features cannot.

Modeling Workflow

1. Graph Construction : Define nodes (accounts, devices, virtual entities) and generate edges via direct behavior, knowledge‑graph inference, temporal synchrony, or ANN‑based similarity on embeddings.

2. Graph Tasks : Apply supervised or unsupervised learning; unsupervised methods (e.g., community detection) are preferred for gang discovery, while node embeddings become features for downstream risk scoring.

3. Interpretability : Use statistical gang metrics, neighbor‑based feature aggregation, and clustering characteristics to explain why a group is flagged.

4. Business Applications : Pre‑emptive gang interception, post‑incident handling, and risk scoring using graph‑derived embeddings.

04. Practical Cases

Case 1: Sequence‑Graph Gang Identification

Events are concatenated into sequences per streamer, embedded via Word2Vec or EGES, aggregated with SIF, and then treated as nodes in a graph built with ANN. Connected sub‑graphs reveal coordinated fake‑view gangs across multiple rooms.

Case 2: Full‑Scene Gang Mining

Features are defined, distances computed per feature, and single‑feature gangs are generated as nodes. Metric learning merges similar gangs, builds gang portraits, and filters out outlier accounts, achieving extensible features, self‑learning graph construction, false‑positive reduction, and weighted metric learning.

05. Summary

By integrating all scenario data into a unified model, Douyu eliminates the need for per‑scenario models. Self‑learning and anti‑false‑positive mechanisms ensure accurate gang detection, while feature‑based gang portraits provide rapid interpretability, delivering significant improvements in anti‑cheat performance.

Thank you for reading.