【安全加密】工作室识别：批量行为特征与图谱分析

function RiskProfile.update(plr, event)
    local p = profiles[plr.id]
    p.onlineHours = p.onlineHours + event.duration
    p.goldOut = p.goldOut + (event.goldOut or 0)
    p.goldIn = p.goldIn + (event.goldIn or 0)
    p.device = plr.deviceId
    p.ipPrefix = plr.ip:match("^(%d+%.%d+%)")
end

function RiskGraph.cluster(days)
    local edges = {}
    for _, p in pairs(profiles) do
        local key = p.device .. "|" .. p.ipPrefix
        edges[key] = edges[key] or {}
        table.insert(edges[key], p.id)
    end
    for key, members in pairs(edges) do
        if #members >= 20 and RiskGraph.sameCashOut(members) then
            QF_RiskAlarm("工作室集群", key, #members)
        end
    end
end