【安全加密】盗号特征库：盗号行为的模式识别库

-- 盗号特征库：规则与打分
local player = class(actor)
local RULES = {
    {desc = "快速清理背包", check = function(p) return getBagOpCnt(p, 300) > 20 end, score = 30},
    {desc = "集中转移装备", check = function(p) return getTradeCnt(p, 600) > 3 end, score = 40},
    {desc = "修改密码", check = function(p) return isPwChanged(p) end, score = 30},
}
local function scoreAccount(player)
    local total = 0
    for _, rule in ipairs(RULES) do
        if rule.check(player) then
            total = total + rule.score
        end
    end
    setplayvar(player, "HUMAN", "TheftScore", total, true)
    return total
end

-- 自动响应：冻结与通知
local player = class(actor)
local function autoRespond(player, score)
    if score >= 70 then
        setplayvar(player, "HUMAN", "TradeFrozen", 1, true)
        sendmail("#" .. (getbaseinfo(player, 3) or ""), 8061, "安全冻结通知",
            "检测到异常操作，交易与仓库已冻结。如非本人操作请立即修改密码并联系客服。", "")
        sendmsg(player, 1, 0, "检测到异常行为，交易功能已临时冻结。")
    end
end