【安全加密】脚本特征建模：行为间隔的统计分布

---addbag: 物品进包触发，记录拾取间隔
function addbag(actor, item)
    local uid = actor:GetUserId()
    local now = os.time()
    local s = Behavior.profile[uid]
    if not s then
        s = { last = now, gaps = {}, n = 0 }
        Behavior.profile[uid] = s
    end
    local gap = now - s.last
    s.last = now
    if gap > 0 and gap < 600 then
        local idx = s.n % 500 + 1
        s.gaps[idx] = gap
        s.n = s.n + 1
    end
end

---间隔的均值与标准差：钟表性判定
function Behavior.analyze(uid)
    local s = Behavior.profile[uid]
    if not s or s.n < 500 then return nil end
    local sum, sumSq = 0, 0
    for _, g in pairs(s.gaps) do
        sum = sum + g
        sumSq = sumSq + g * g
    end
    local mean = sum / s.n
    local sigma = math.sqrt(sumSq / s.n - mean * mean)
    -- 人为操作 sigma 通常大于 2 秒，脚本常低于 0.1 秒
    if sigma < 0.1 then
        return "script", mean, sigma
    end
    return "human", mean, sigma
end