Anti-cheating method and system for network security competition

Abstract

The invention relates to an anti-cheating method and an anti-cheating system for a network security competition, which are used for maintaining competition fairness. Through a fixed period and random time point mixed interception mechanism, interactive data such as network flow, logs and system calling of an operator and a game question node are collected in real time, and data integrity and randomness are balanced; after data cleaning, features such as abnormal instructions and sensitive commands are extracted, and team member trust values are quantitatively calculated from dimensions such as abnormal operation frequency, sensitive operation proportion and operation concentration degree based on a machine learning model. High, medium and low intervals are divided according to trust values, a security Flag generation strategy is dynamically adapted, and a differential encryption algorithm is adopted. And finally, determining cheating by comparing the consistency of the submitted Flag and the Flag extracted by the system, thereby effectively improving the accuracy, efficiency and scene adaptability of the anti-cheating system.

Description

Technical Field

[0001] The present invention relates to the field of network technologies, and particularly to an anti-cheating method and system for network security competitions. Background Art

[0002] CTF, which is usually translated as Capture The Flag in Chinese, represents a competition mode for technical competitions among network security technicians. After years of development, CTF has become a highly favored competition form in the global network security field. In a CTF competition, participating team members access the network on-site and are ranked according to the scores and time taken to solve network security technical challenge questions. Each participating team member needs to obtain a string of specific format, i.e., Flag, from the competition environment set by the organizer and submit it to the organizer to obtain corresponding scores. A series of questions of different types and difficulties are set in the competition. By solving the questions to obtain the Flag and submitting the scores, at the end of the competition, the teams are ranked according to the total scores of each team.

[0003] The Chinese invention patent with the patent application number 202010984461.2 discloses an anti-cheating system and method for network security CTF competitions: The system mainly includes a CTF test paper module, a question management module, an operation machine management module, a Flag session module, and a Flag security module. The CTF test paper module is used to synthesize a competition test paper and generate Flags for all questions; the question management module is used to generate a question environment and write the Flag into it; the operation machine management module is used to generate participating operation machines for participating team members to connect to the question environment; the Flag session module is used to save the session records within the session validity period; the Flag security module is used to perform security Flag information replacement on the intercepted packets; the CTF test paper module determines whether there is cheating or an anomaly according to the Flag session records. The present invention can improve the security of the competition platform, as well as the platform's resistance and detection capabilities against cheating behaviors, and can be applicable to application scenarios where various protocols access questions.

[0004] In the prior art, although corresponding security Flags are set for further verification, relying only on IP addresses, timestamps, and signature encryption with a fixed algorithm, it is easy to discover patterns during multiple question-solving processes and thus be cracked. Summary of the Invention

[0005] In view of the technical problems existing in the prior art, the present invention quantifies the trust value by mixing and intercepting interaction data and accurately determines competition cheating through an adaptation strategy.

[0006] The technical solution for the present invention to solve the above technical problems is as follows: An anti-cheating method for network security competitions, including: S1, recording all operations of participating team members on the operation machine in real time, and randomly intercepting the interaction data between the question node and the operation machine at a fixed period; S2. Calculate the trust value based on the intercepted interaction data; break the competition questions into a multi-stage chained question group with logical associations; after the participating team members submit the security Flag information of the previous stage and complete the team identity verification, bind it to the Flag information of the current stage, trigger the generation of dynamically encrypted Flag information, and predict the security Flag information of the next stage; compare the predicted security Flag information with the dynamically encrypted Flag information to verify the current security Flag information, and dynamically update the trust values of each team member; S3. Extract the security Flag according to the preset rules of the trust value and sign and encrypt it; S4. Compare the submitted security Flag information with the intercepted security Flag information, and if they do not match, determine cheating.

[0007] Preferably, the randomly intercepting the interaction data of the competition question nodes and the operating machine at fixed intervals includes: Determine a fixed time period As the benchmark frequency of data interception, regularly intercept the interaction data between the competition question nodes and the operating machine according to this period; within each fixed interception time period Through a random interception mechanism, randomly select multiple time intervals within this period for data interception; that is, at each random interception, randomly select multiple time points from the range to form a set of randomly intercepted time points .

[0008] Preferably, the randomly selecting multiple time intervals within this period for data interception includes: Calculate the number of sensitive operations within the randomly intercepted time points for the intercepted data respectively , the proportion of sensitive operations in all operations at the randomly intercepted time points (sensitive operation ratio) , the density of operations within the randomly intercepted time points ; Based on the historically labeled normal / abnormal behavior samples, use a machine learning model to train the weight coefficients , and calculate the trust value according to the trained output weight coefficients; the formula is as follows: .

[0009] Preferably, the calculating the trust value based on the intercepted interaction data includes: Based on the historically labeled normal / abnormal behavior samples, use a machine learning model to train the weight coefficients , and calculate the trust value according to the trained output weight coefficients; the formula is as follows: .

[0010] Preferably, the trigger generates dynamic encryption Flag information and predicts the security Flag information in the next stage, specifically including: When constructing multi-stage chained competition questions, it is necessary to first clarify the overall goal of the competition questions, break them down into logically independent but dependent subtasks, and then further divide them into N stages. Each stage focuses on a specific task and has a globally unique identifier, and the stage dependency relationship is defined; after the participating team members submit the security Flag and team identity characteristics of the previous stage, the system queries the database for verification. If it has not been reused, it is bound and encrypted with the current Flag, otherwise cheating is determined; collect the security Flag information data of historical stages, train using a time series model, input the security Flag information of the previous stage to predict the security Flag information of the next stage, and compare it with the decrypted security Flag information of the current stage to verify whether there are any abnormalities in the security Flag information of the current stage.

[0011] Preferably, the dynamic update of the trust value of each team member includes: Record the trust value calculation results of the same operating machine, generate a time series fluctuation curve, and store historical trend data; analyze the mutation points and high-frequency fluctuation intervals of the fluctuation curve to locate the early points of abnormal trust values; inject forged Flags at the precursor points of abnormal trust values to verify whether the participating team members submit abnormally or cheat.

[0012] Preferably, the injection of forged Flags at the precursor points of abnormal trust values includes: Screen out the early abnormal points from the time series fluctuation curve. The system generates forged Flags according to the security Flag information of the current stage for the early abnormal points; encrypts with the same encryption algorithm and key derivation rule as the formal system using the security Flag information of the previous stage before the precursor point as the input; submits the forged Flags through the public interface of the competition to simulate an abnormal operating machine and associates it with the precursor point of abnormality; among them, the injection frequency of the forged Flags is limited; after the participating team members submit the forged Flags, the system records the response information and analyzes the operation logs. If they frequently change the IP, modify the user agent, and the trust value fluctuates abnormally, it is determined that the team member has cheated.

[0013] Preferably, the calculation of the trust value further includes: Real-time collect multi-dimensional feature data of the state machine to predict the change trend of the trust value in the future time window; dynamically adjust the trap type, density, and position according to the prediction results, and limit the injection frequency; analyze the operation logs after submitting the Flag information, and combine the signal of a sudden drop in the trust value to determine and bypass cheating behavior.

[0014] Preferably, the method further includes: The trap types include forged Flag, delayed response, and resource - limit traps. The trap density is the triggering probability per unit time, and the positions cover the submission interface layer, data verification layer, and feedback response layer of the system. Using the cheating recognition rate and misjudgment rate as feedback, the trap parameters are dynamically adjusted by reinforcement learning. The operation logs after submitting the security Flag information are collected in real - time, and the pattern of trust value decline is analyzed. If there is an abnormal operation pattern before and after the decline, it is determined as a bypass cheating behavior. Among them, the abnormal operation patterns include, but are not limited to, frequently submitting similar security Flag information, modifying code or request parameters.

[0015] This application also provides an anti - cheating system for network security competitions, and the system includes: A data collection module that records all operations of the participating team members on the operation machine in real - time, and intercepts the interaction data between the competition problem nodes and the operation machine according to a fixed interception time period and a random interception mechanism. A trust calculation module that calculates the trust value based on the intercepted interaction data and quantitatively evaluates the credibility of the operation behavior of the participating team members. A Flag generation module that extracts security Flag information from the intercepted interaction data according to preset selection rules based on different trust values, and performs signature and encryption processing. A comparison and determination module that compares the security Flag information submitted by the participating team members with the extracted security Flag information. If the comparison result does not match, it is considered that the participating team members have cheating behavior.

[0016] The beneficial effects of the present invention are as follows: By recording the operations of the participating team members in real - time and intercepting the interaction data between the competition problem nodes and the operation machine, the data diversity is enhanced by combining the random interception mechanism. Using a machine - learning model to quantitatively evaluate the credibility of operation behavior and dynamically adjusting the selection rules and encryption strategies of security Flags accordingly, it not only ensures efficient processing under high trust, but also ensures strong security under low trust. By comparing the security Flag submitted by the participating team members with the Flag extracted by the system, cheating behavior is effectively identified, and the fairness and justice of the competition are maintained. This solution not only improves the accuracy and efficiency of the anti - cheating system, but also enhances the flexibility and adaptability of the system. By disassembling the competition problems into multi - stage chained problem groups, clarifying the dependencies between stages, assigning a unique identifier to each stage and establishing a mapping database table, and combining means such as dynamic encryption Flag generation, time - series - based Flag prediction and verification, and dynamic trust value update, strict control and cheating prevention of the CTF competition problem - solving process are realized. This solution not only ensures the compliance of the competition problem - solving order, effectively prevents Flag leakage and cheating behavior, but also can real - time evaluate the credibility of the contestants through the dynamic trust value update mechanism, providing a strong guarantee for the fairness and security of the competition. By constructing a trust value time series analysis system, the dynamic changes of the trust value of the operator can be accurately captured. With the help of the CUSUM algorithm and the fluctuation threshold determination, the abnormal precursor points can be accurately located, realizing the early warning of potential cheating risks. By using forged Flag injection and behavior monitoring technologies, simulating attack scenarios to verify the responses of participating team members, and combining multi-dimensional analyses such as submission strategy adjustment and historical trust fluctuations, hidden cheating means such as bypassing verification and frequent operation changes can be effectively identified. While ensuring the stable operation of the competition system, it provides a full-range and dynamic technical guarantee for the fairness of the competition, greatly improving the recognition accuracy and efficiency of cheating behaviors. By collecting multi-dimensional operation data in real time to construct a dynamic trust evaluation system, combining the LSTM model to achieve accurate prediction and risk grading of trust values, and dynamically adapting trap strategies based on the prediction results, high-risk behaviors can be captured in advance. Associating operation logs with sudden drops in trust values to achieve multi-dimensional cross-verification of cheating behaviors, significantly improving the recognition rate of hidden cheating means. Continuously optimizing the trap trigger threshold and type combination through reinforcement learning, while reducing the false positive rate, improving the defense flexibility, and finally forming a "prediction-response-evolution" closed-loop mechanism, providing a full-process and adaptive technical support for ensuring the fairness of the competition and effectively dealing with complex and changeable cheating scenarios. Brief Description of the Drawings

[0017] Figure 1 It is a schematic flowchart of an anti-cheating method for a network security competition according to an embodiment of the present invention; Figure 2 It is a structural block diagram of an anti-cheating system for a network security competition according to an embodiment of the present invention. Detailed Embodiments

[0018] Next, the technical solutions in the embodiments of the present application will be clearly and completely described in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative efforts belong to the scope of protection of the present application.

[0019] In the description of the present application, the terms "first" and "second" are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include one or more of the described features. In the description of the present application, "a plurality" means two or more, unless otherwise specifically defined.

[0020] In the description of this application, the term "for example" is used to mean "serving as an example, illustration, or explanation". Any embodiment described as "for example" in this application is not necessarily construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to implement and use the present invention. In the following description, details are set forth for purposes of explanation. It should be understood that those of ordinary skill in the art can recognize that the present invention can be implemented without using these specific details. In other instances, well-known structures and processes are not elaborated in detail to avoid obscuring the description of the present invention with unnecessary details. Therefore, the present invention is not intended to be limited to the embodiments shown, but rather to be in line with the broadest scope consistent with the principles and features disclosed in this application.

[0021] Embodiment 1: Figure 1 It is a schematic flowchart of an anti-cheating method for a network security competition in the first embodiment of the present invention, including the following steps: S1, record all operations of participating team members on the operation machine in real time, and intercept the interaction data between the competition question node and the operation machine according to a fixed interception time period and a random interception mechanism.

[0022] Among them, the interaction data includes intercepting key data segments from the interaction data between the competition question node and the operation machine at a determined interception time point. The data segments include but are not limited to network traffic (such as TCP / UDP packets), operation logs (such as system logs, application logs), system call records, etc.

[0023] Specifically, start the anti-cheating system and determine a fixed time period as the benchmark frequency for the system to intercept data, and regularly intercept the interaction data between the competition question node and the operation machine. For example, set a fixed time period = 10 minutes. Within each fixed interception time period, introduce a random interception mechanism to determine the random interception time interval (the time interval is specifically defined according to the actual situation). For example, perform a random interception 2 minutes later, 4 minutes later, and 6 minutes later respectively. At each random interception, randomly select multiple time points within the range , that is . For example, = 10 minutes, ={2 minutes, 3 minutes, 4 minutes}, then the random interception time point will be intercepted at a certain moment within [0, 10] minutes (such as the 2nd minute, the 5th minute, the 9th minute, here is only an example, actually randomly selected).

[0024] Record all operations of the participating team members on the operating machine. The recorded content includes but is not limited to keyboard input, mouse operations, network requests (such as HTTP requests, SSH connections, etc.), and other system events.

[0025] S2. Calculate the trust value based on the intercepted interaction data to quantitatively evaluate the credibility of the operation behavior of the participating team members.

[0026] Specifically, extract abnormal instructions (such as rm -rf / ) and sensitive commands (such as sudo su) from the network traffic in the intercepted interaction data, count system events such as file reading and writing and process creation from the operation logs, identify behaviors such as privilege escalation attempts and port scans from the system call records, filter out non-malicious operations (such as normal compilation commands and document editing), and desensitize sensitive information (such as hiding IP addresses and user identities).

[0027] Based on the data after the above preprocessing, calculate the abnormal operation frequency (the number of illegal instructions or sensitive operations within a randomly intercepted time point): For example: the duration of the data segment is 10 minutes, and the randomly intercepted time points are 2 minutes, 3 minutes, and 4 minutes. If 5 times, 7 times, and 2 times of illegal instructions are detected at 0 - 2 minutes, 2 - 5 minutes, and 5 - 9 minutes respectively, then A = 5 / 2 + 7 / 3 + 2 / 4; the proportion of sensitive operations (the proportion of sensitive operations at the randomly intercepted time points to all operations at the randomly intercepted time points): For example: the duration of the data segment is 10 minutes, and the randomly intercepted time points are 2 minutes, 3 minutes, and 4 minutes. If the total number of operations is 50 times, 70 times, and 20 times at 0 - 2 minutes, 2 - 5 minutes, and 5 - 9 minutes respectively, and the number of sensitive operations is 5 times, 7 times, and 2 times respectively, then B = 5 / 50 + 7 / 50 + 2 / 50; the operation concentration (the density of operations within a randomly intercepted time point): For example: the duration of the data segment is 10 minutes, and the randomly intercepted time points are 2 minutes, 3 minutes, and 4 minutes. If the total number of operations is 50 times, 70 times, and 20 times at 0 - 2 minutes, 2 - 5 minutes, and 5 - 9 minutes respectively, then C = 50 / 2 + 70 / 3 + 20 / 4.

[0028] Based on the historically labeled normal / abnormal behavior samples, use a machine learning model to train the weight coefficients , according to the trained output weight coefficients (in this application ), calculate the trust value. The formula is as follows: .

[0029] S3. According to the different trust values, extract the security Flag information from the intercepted interaction data according to the preset selection rules, and perform signature and encryption processing;

[0030] Specifically, the selection rule is to divide the trust value into three intervals: high trust (reference value TS≥80), medium trust (reference value 50≤TS<80), and low trust (reference value TS<50); for the interaction data with high trust, intercept the interaction data segment within the most recent 10 minutes, for the interaction data with medium trust, intercept the interaction data segment within the past 30 minutes, and for the interaction data with low trust, intercept the full volume of interaction data segments from the start of the competition to the present.

[0031] Generate security Flag information (data fingerprint, dynamic timestamp, random salt value) for the intercepted new interaction data segment. Calculate the SHA-256 hash value of the segment content (e.g., df=SHA256(fragment)) to obtain the data fingerprint, obtain the current UTC timestamp and perform Base64 encoding (e.g., dt=base64(UTC time)) to obtain the dynamic timestamp, and generate a 128-bit random number (e.g., rs=openssl rand -hex 16) to obtain the random salt value; encrypt the security Flag information using different encryption algorithms according to the trust value. For example, use AES-128-GCM for high trust values, AES-256-CBC for medium trust values, and RSA-4096-OAEP for low trust values.

[0032] Among them, the encryption encapsulation formula is: SecureFlag=Encrypt(df∣∣dt∣∣rs,SecretKey). df (data fingerprint) is the hash value of the data segment calculated by SHA-256, which is used to verify the integrity of the Flag content (e.g., prevent tampering); dt (dynamic timestamp) is the Base64 encoding of the current UTC time, which is used to limit the validity period of the Flag (prevent old Flags from being submitted repeatedly); rs (random salt value) is a 128-bit random number, which increases the randomness and unpredictability of encryption (prevent the same data from generating the same Flag). The encryption process takes as input: df||dt||rs (concatenated binary data) + SecretKey (secret key), and the output is the encrypted ciphertext (SecureFlag).

[0033] S4. Compare the security Flag information submitted by the participating players with the intercepted security Flag information. If the comparison result does not match, it is considered that the participating players have cheated.

[0034] Specifically, the system receives the security Flag information submitted by the participating team members, decrypts and verifies the signature of the received security Flag information submitted by the participating team members and the security Flag information extracted by the system, and performs a byte-by-byte comparison to check whether the two are exactly the same. Analyze the comparison result to determine whether the security Flag information submitted by the participating team members is consistent with the security Flag information extracted by the system. If the comparison result is inconsistent, the system determines that the participating team members have cheated.

[0035] The technical solutions in the above embodiments of the present application at least have the following technical effects or advantages: By recording the operations of the participating team members in real time and intercepting the interaction data between the competition question nodes and the operation machines, combined with the random interception mechanism to enhance data diversity; using the machine learning model to quantitatively evaluate the credibility of operation behaviors, and dynamically adjusting the selection rules and encryption strategies of the security Flag accordingly, which not only ensures efficient processing under high trust, but also ensures strong security under low trust; by comparing the security Flag submitted by the participating team members with the Flag extracted by the system, cheating behaviors are effectively identified, and the fairness and impartiality of the competition are maintained. This solution not only improves the accuracy and efficiency of the anti-cheating system, but also enhances the flexibility and adaptability of the system.

[0036] Embodiment 2: In Embodiment 1, cheating is mainly detected through the similarity of behavior characteristics and a fixed trust threshold. However, this method has obvious deficiencies. On the one hand, the static trust threshold is difficult to adapt to competition questions of different difficulties. For example, the submission intervals of Pwn-type questions and Web-type questions vary greatly, and the fixed threshold may lead to misjudgments. On the other hand, the logical dependencies between stages and the behavior trust values are not dynamically combined, and attackers may bypass the stage verification and submit high-order Flags. In addition, only the Flags of the current stage are verified, and the temporal relevance of the historical stage Flag sequences is not used to predict the legitimacy of the next stage Flag, making it difficult to identify cheating behaviors of locally tampering with Flags.

[0037] Therefore, the embodiments of the present application are optimized to a certain extent on the basis of the above embodiments.

[0038] In some embodiments, in step S2, when calculating the trust value according to the intercepted interaction data, it further includes: S21, disassemble the competition questions into multi-stage chained question groups, and clarify the dependency relationships between multiple question stages.

[0039] Among them, for the multi-stage chained question groups, a unique identifier needs to be assigned to each stage, and a stage-identifier mapping database table is established. The table needs to contain the unique identifier of each stage 、stage description, and pre-dependencies, etc.

[0040] Specifically, clarify the overall goal of the competition questions (such as vulnerability mining, password cracking, protocol reverse engineering, etc.), and decompose the tasks into subtasks that are logically independent but have dependencies according to the goal (example: Web penetration question → information collection → vulnerability verification → privilege maintenance → Flag extraction). Divide the subtasks into N stages , with each stage focusing on a clear task, each stage having a clear completion flag, and assigning a globally unique identifier to each stage . Define the conditions for stage dependencies . The dependency relationship can be represented as a directed acyclic graph , where V is the set of stages and E is the set of dependency relationships. If stage depends on , then can only be unlocked after is completed. The stage unlocking condition is: . .

[0041] S22. The contestant submits the security Flag information of the previous stage and verifies the team identity characteristics, which are bound to the Flag of the current stage, triggering the generation of dynamically encrypted Flag information

[0042] Specifically, the contestant submits the security Flag information of the previous stage (denoted as ) and the team identity characteristics (such as the IP address of the operating machine). Query the database table to check whether exists in the legitimate security Flag information set of and has not been reused by other contestants. If the verification passes, it is bound to the current security Flag information to generate the of the current stage , and encrypt . If the verification fails, it is determined that the contestant has cheated

[0043] S23. Predict the security Flag information of the next stage based on the security Flag information of the previous stage, and compare the predicted information with the dynamically encrypted Flag information to verify the security Flag information of the current stage

[0044] Among them, predicting the security Flag information of the next stage is to collect the security Flag information of historical stages, including the security Flag information of the previous stage and the corresponding stage identifier and other relevant data. Use a time series-based prediction model, train the model with historical data to obtain the trained model M. Use the security Flag information of the previous stage of the current stage Input it into the trained model M to obtain the predicted next-stage security Flag information Obtain the dynamic encryption Flag information of the current stage from the database and decrypt it through the corresponding decryption method to obtain the Flag information of the current stage Compare the predicted next-stage security Flag information with the decrypted security Flag information of the current stage to verify whether there is an abnormality in the current stage .

[0045] S24. Dynamically update the trust value of each participating player according to the security Flag information of the current stage

[0046] Among them, the dynamic update formula of the trust value is , , is the trust value adjustment amount is the trust value of this participating player in the previous stage

[0047] The technical solutions in the embodiments of the present application at least have the following technical effects or advantages By disassembling the competition questions into multi-stage chained question groups, clarifying the dependency relationships between stages, assigning unique identifiers to each stage and establishing a mapping database table, and combining means such as dynamic encryption Flag generation, time series-based Flag prediction verification, and dynamic trust value update, strict control of the CTF competition problem-solving process and cheating prevention are realized. This solution not only ensures the compliance of the competition question-solving order, effectively prevents Flag leakage and cheating behavior, but also through the dynamic trust value update mechanism, can real-time evaluate the credibility of the contestants, providing a strong guarantee for the fairness and security of the competition

[0048] Embodiment 3: In Embodiment 2, the system identifies cheating based on a fixed trust value threshold and a static encryption trap mechanism, but there are obvious shortcomings: on the one hand, the trust value fluctuation benchmark changes dynamically with the competition question stage and the participating group, and the static threshold is likely to cause misjudgment of normal fluctuations or missed judgment of hidden cheating; on the other hand, the encryption trap trigger rule is decoupled from the dynamic change of the trust value, the intervention of high-risk teams with a sharp drop in the trust value is lagged, and there is a lack of gradient monitoring for teams in the low and medium trust value ranges. In addition, the abnormal analysis only focuses on the trust value and trap response, and does not associate with dimensions such as operation logs and policy evolution, making it difficult to capture hidden behaviors such as "segmented probing"

[0049] Therefore, the embodiments of the present application are optimized to a certain extent on the basis of the above embodiments

[0050] In some embodiments, in step S24, when dynamically updating the trust value of each participating player, it further includes S241. Record the trust value calculation results of the same manipulator, generate a time series fluctuation curve, and store the historical trend data.

[0051] Specifically, the system automatically extracts the trust value calculation results of the participating team members associated with the manipulator and records the specific timestamp (accurate to seconds) at the end of the current stage. Bind the timestamp and the corresponding trust value into a record to form a data pair (timestamp, trust value), and then insert each (timestamp, trust value) record into the database. After that, query its historical trust value records by the manipulator identifier and sort them in ascending order of the timestamp. Use the timestamp as the horizontal axis and the trust value as the vertical axis to draw a continuous line chart. Among them, the horizontal axis represents the timestamps arranged in chronological order, which is used to show the change trend of the trust value over time; the vertical axis represents the trust value numerical range, which reflects the fluctuation range of the trust value.

[0052] S242. Analyze the mutation points and high-frequency fluctuation intervals of the fluctuation curve, and locate the early points of abnormal trust values.

[0053] Specifically, analyze the mutation points and high-frequency fluctuation intervals of the fluctuation curve to identify the cheating risk in advance. First, for each time point of the time series fluctuation curve, calculate its deviation from the historical mean μ, and introduce a drift parameter k (usually set to 0.5 times the standard deviation) to filter out random noise. If the result of the deviation of the current time point after drift correction and the cumulative sum in the forward direction of the previous order is positive, update the cumulative sum in the forward direction, otherwise reset it to zero; the cumulative sum in the negative direction is processed through the reverse logic. When the cumulative sum in the forward or negative direction exceeds the preset threshold (3 times the standard deviation), determine that this time point is a trust value mutation point.

[0054] For two adjacent time points in the time series fluctuation curve, obtain their trust values respectively, calculate the absolute difference between the trust values of the adjacent time points, and statistically analyze the distribution characteristics (mean and standard deviation) of the historical differences. If the difference at a certain time point exceeds the mean plus 2 times the standard deviation, mark this time point as an abnormal fluctuation point; if multiple consecutive time points all meet the condition that the difference exceeds the mean plus 2 times the standard deviation, determine this continuous time interval as a high-frequency fluctuation interval.

[0055] Take the time of the suspicious mutation points determined by the mutation point detection and the start time of the high-frequency fluctuation intervals obtained by the high-frequency fluctuation interval detection as the early abnormal points of the time series fluctuation curve.

[0056] S243. Inject a forged Flag at the early warning points of abnormal trust values to verify whether the participating team members submit abnormally or cheat.

[0057] Specifically, to screen out highly suspicious test objects from the already located abnormal early points, it is necessary to deeply investigate and exclude false alarm situations that may be caused by system failures or policy adjustments. For the screened targets, the system will generate forged Flags that are highly consistent with the real Flags and simulate abnormal behaviors for testing.

[0058] The generation of forged Flags must strictly follow the legal logic of the current stage. Taking the legal Flags normally obtained by the participating team members in the previous stage before the abnormal precursor points as input, encryption processing is carried out using the same encryption algorithm (such as AES-256) and key derivation rules as the formal system. This process ensures that the forged Flags are exactly the same as the real Flags in form and rules, thus having sufficient deception. After generation, the system will perform a uniqueness check on the forged Flags, comparing them with the historical legal Flags to ensure that the two do not repeat, avoiding misjudgment caused by repeated submissions. After completion of the generation, the system simulates the submission behavior of the abnormal operation machine through the public interface (Flag submission API) of the competition system. This behavior will be associated with the abnormal precursor points for subsequent analysis of the operations of the participating team members on the abnormal devices. To ensure the stability of the competition system, the injection frequency of forged Flags will be strictly restricted. For example, at most 1 operation can be performed per hour, avoiding putting pressure on the system while ensuring the verification effect.

[0059] After the participating team members submit the forged Flags, the system records the response information in real time, including types such as "verification failed" or "Flag repeated". If the system fails to recognize the illegality of the forged Flags, it indicates that the participating team members have cheated by bypassing the verification. At the same time, the system analyzes the operation logs of the participating team members after the injection of the forged Flags to observe whether they continue to try to submit other forged Flags, or whether they adjust the submission strategy by changing the IP address, modifying the user agent, etc. If the participating team members frequently change the IP and modify the user agent after the injection of the forged Flags, and there are abnormalities in combination with the fluctuations in their historical trust values, it can be determined that the participating team members are highly suspicious. This abnormal behavior pattern may indicate that they are trying to evade monitoring by changing the operation method and there is a possibility of cheating.

[0060] The technical solutions in the embodiments of the present application described above have at least the following technical effects or advantages: By constructing a trust value time series analysis system, the dynamic changes of the trust value of the operator can be accurately captured. With the help of the CUSUM algorithm and the fluctuation threshold determination, the abnormal precursor points can be accurately located, realizing the early warning of potential cheating risks. By using the forged Flag injection and behavior monitoring technology, simulating the attack scenarios to verify the responses of the participating team members, and combining multi-dimensional analyses such as submission strategy adjustment and historical trust fluctuations, the concealed cheating means such as bypassing the verification and frequently changing operations can be effectively identified, providing a full-range and dynamic technical guarantee for the fairness of the competition while ensuring the stable operation of the competition system, and greatly improving the recognition accuracy and efficiency of cheating behaviors.

[0061] Embodiment 4: In Embodiment 3, although the system has constructed a cheating prevention and control framework based on trust value prediction and dynamic trap mechanism, obvious shortcomings are still exposed in the actual confrontation scenarios: on the one hand, the LSTM model only relies on historical trust values and basic operation features for one-dimensional prediction, and is insufficiently adaptable to more concealed cheating means (such as detecting trap rules through high-frequency small-amplitude exploratory submissions and dynamically sharing forged Flags across team members), and the prediction error accumulates with the evolution of the attack mode; on the other hand, the trap strategy adjustment logic lacks the correlation mining of multi-source behavior signals, making it difficult to capture the continuous cheating attempts under the guise of "high frequency and low error", and the strategy iteration depends on manual intervention and cannot respond to new types of attacks in a timely manner.

[0062] Therefore, the embodiments of the present application are optimized on the basis of the above embodiments.

[0063] In some embodiments, in step S241, recording the trust value calculation results of the same operator further includes: 1A. Real-time collecting multi-dimensional feature data of the state machine to predict the change trend of the trust value in the future time window.

[0064] Specifically, real-time collecting the operation logs of the participating team members (including operation time, type, device information), Flag submission records (time, content, result), and system access logs (interface, frequency, duration), and cleaning the data (removing duplicates, filling missing values, correcting abnormal values). Extracting multi-dimensional feature data, such as the current trust value, historical mean, volatility (ratio of standard deviation to mean in the past 24 hours), Flag submission frequency per unit time, proportion of incorrect Flags, IP switching frequency, device fingerprint diversity, and the trust value co-fluctuation coefficient among team members. Using the LSTM model to divide the data set according to 7:1.5:1.5, and rolling the prediction of the trust value in the future 1 hour and the 95% confidence interval based on the latest data every 10 minutes.

[0065] 1B. Dynamically adjusting the trap type, density, and position according to the prediction results, and restricting the injection frequency.

[0066] Specifically, the trap types include forged Flag, delayed response, and resource limit traps. The trap density is the triggering probability per unit time (e.g., 30% means 3 triggers per 10 submissions), and the locations cover the submission interface layer, data verification layer, and feedback response layer. If the predicted value is lower than 1.5 times the standard deviation of the mean or shows a downward trend, it is determined to be a high risk, and traps with a 40% triggering probability are deployed at the data verification layer and the feedback response layer. If the predicted value is stable but the proportion of incorrect Flags exceeds 30%, a delayed response trap is enabled at the feedback layer. Combining operation characteristics such as high-frequency submissions, frequent IP switches, and highly similar submitted Flags, forged Flag and resource limit traps are superimposed at the submission interface layer. Using the cheating recognition rate and misjudgment rate as feedback indicators, the trap parameters are dynamically adjusted by reinforcement learning to achieve an adaptive match between risk and defense.

[0067] 1C. Analyze the operation logs after submitting Flag information, and combine the signal of a sharp drop in the trust value to determine bypass cheating behavior.

[0068] Specifically, real-time collect the operation logs after submitting security Flag information (including operation time, type, object, result), parse and extract key information such as submissions, accesses, and code operations. Set a threshold for a sharp drop in the trust value (e.g., a drop exceeding 20% of the mean within 10 minutes), and analyze the sharp drop pattern (start time, duration, subsequent trend) to judge the association with cheating. Associate the operation logs with the signal of a sharp drop in the trust value. If highly similar Flags are frequently submitted before the sharp drop and similar Flags are continued to be submitted after modifying the code after the sharp drop, or if the verification result page is frequently accessed and the request parameters are modified during the sharp drop, it is determined to be bypass cheating behavior.

[0069] The technical solutions in the embodiments of the present application at least have the following technical effects or advantages: By real-time collecting multi-dimensional operation data to construct a dynamic trust evaluation system, combining the LSTM model to achieve accurate prediction of trust values and risk classification, and dynamically adapting the trap strategy based on the prediction results, high-risk behaviors can be captured in advance; associating operation logs with the signal of a sharp drop in the trust value to achieve multi-dimensional cross-verification of cheating behaviors, significantly improving the recognition rate of hidden cheating means; continuously optimizing the trap triggering threshold and type combination through reinforcement learning, while reducing the misjudgment rate, improving the flexibility of defense, and finally forming a "prediction-response-evolution" closed-loop mechanism, providing full-process and adaptive technical support for ensuring the fairness of the competition and effectively coping with complex and changeable cheating scenarios.

[0070] Furthermore, the embodiment of the present invention also provides an anti-cheating system for network security competitions.

[0071] Figure 2 It is a schematic structural diagram of an anti-cheating system for network security competitions according to an embodiment of the present invention.

[0072] Such as Figure 2As shown in the figure, an anti-cheating system for a network security competition includes: a data collection module, a trust calculation module, a Flag generation module, and a comparison and determination module.

[0073] The data collection module records all operations of the participating team members on the operation machine in real time, and intercepts the interaction data between the competition question nodes and the operation machine according to a fixed interception time period and a random interception mechanism. The trust calculation module calculates the trust value based on the intercepted interaction data, and quantitatively evaluates the credibility of the operation behavior of the participating team members. The Flag generation module extracts security Flag information from the intercepted interaction data according to different trust values according to the preset selection rules, and performs signature and encryption processing. The comparison and determination module compares the security Flag information submitted by the participating team members with the intercepted security Flag information. If the comparison result does not match, it is considered that the participating team members have cheated.

[0074] It should be noted that other specific implementation contents of an anti-cheating system for a network security competition in the embodiments of the present invention can refer to the above-mentioned anti-cheating method for a network security competition.

[0075] It should be noted that in the above embodiments, the descriptions of the various embodiments have their own emphases. For the parts not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0076] Those skilled in the art should understand that the embodiments of the present invention can be provided as a method, a system, or a computer program product. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0077] The present invention is described with reference to the flowcharts and / or block diagrams of methods, apparatuses (systems), and computer program products according to the embodiments of the present invention. It should be understood that each process and / or block in the flowchart and / or block diagram can be realized by computer program instructions, and the combination of the processes and / or blocks in the flowchart and / or block diagram can also be realized by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded computer, or other programmable data processing devices to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing devices generate means for realizing the functions specified in Figure 1 one process or multiple processes and / or blocks Figure 1 one block or multiple blocks.

[0078] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to operate in a particular manner, such that the instructions stored in the computer-readable memory produce a manufacture including an instruction device that implements the functions specified in one or more of the flows Figure 1 or more flows and / or boxes Figure 1 or more boxes.

[0079] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable apparatus provide steps for implementing the functions specified in one or more of the flows Figure 1 or more flows and / or boxes Figure 1 or more boxes.

[0080] Although the preferred embodiments of the present invention have been described, additional changes and modifications can be made by those skilled in the art once they learn of the basic inventive concept. Therefore, the appended claims are intended to be construed to include the preferred embodiments as well as all changes and modifications that fall within the scope of the present invention.

[0081] Obviously, those skilled in the art can make various changes and modifications to the present invention without departing from the spirit and scope of the present invention. Thus, if these modifications and variations of the present invention fall within the scope of the claims of the present invention and their equivalent technologies, the present invention is also intended to include these modifications and variations.

Claims

1. A method for preventing cheating in a network security competition, characterized in that, The method includes: S1. Record all operations of the participating team members on the operating machine in real time, and randomly intercept the interaction data between the competition question nodes and the operating machine at fixed intervals. S2. Calculate the trust value based on the intercepted interaction data; disassemble the competition questions into a multi-stage chained question group with logical associations; after the participating team members submit the security Flag information of the previous stage and complete the team identity verification, bind it to the current stage Flag information, trigger the generation of dynamically encrypted Flag information, and predict the security Flag information of the next stage; compare the predicted security Flag information with the dynamically encrypted Flag information to verify the current security Flag information, and dynamically update the trust values of each team member. S3. Extract the security Flag according to the preset rules of the trust value and sign and encrypt it. S4. Compare the submitted security Flag information with the intercepted security Flag information. If they do not match, it is determined that cheating has occurred.

2. The anti-cheating method for network security competitions according to claim 1, characterized in that, The randomly intercepting the interaction data between the competition question nodes and the operating machine at fixed intervals includes: Determine a fixed time period As the reference frequency for data interception, intercept the interaction data between the competition node and the manipulator regularly according to this period; within each randomly select multiple time intervals within this period for data interception; that is, at each random interception, randomly select multiple time points from to form a set of randomly intercepted time points .​ 3. The anti-cheating method for network security competitions according to claim 2, wherein, Arbitrarily select multiple time intervals within this period for data interception, including: Calculate the number of sensitive operations within the randomly intercepted time points for the intercepted data respectively , the proportion of sensitive operations at the randomly intercepted time points to all operations at the randomly intercepted time points - sensitive operation ratio , the intensity of operations within the randomly intercepted time points ; Based on the historically labeled normal / abnormal behavior samples, use a machine learning model to train the weight coefficients , calculate the trust value according to the trained output weight coefficients; The formula is as follows: .

4. The anti-cheating method for network security competitions according to claim 1, characterized in that, The calculating the trust value according to the intercepted interaction data includes: Based on the historically labeled normal / abnormal behavior samples, use a machine learning model to train the weight coefficients , calculate the trust value according to the trained output weight coefficients; the formula is as follows: 。 5. The anti-cheating method for network security competitions according to claim 1, wherein The triggering the generation of dynamically encrypted Flag information and predicting the security Flag information of the next stage specifically includes: When constructing a multi-stage chained competition question, first clarify the overall goal of the competition question, disassemble it into logically independent but dependent subtasks, and then subdivide it into N stages. Each stage focuses on a specific task and has a globally unique identifier, and define the stage dependencies; after the participating team members submit the security Flag information and team identity characteristics of the previous stage, the system queries the database for verification; if it has not been reused, bind it to the current security Flag information and encrypt it, otherwise it is determined that cheating has occurred; collect the security Flag information data of historical stages, and train a time series model; input the security Flag information of the previous stage to predict the security Flag information of the next stage, and compare it with the decrypted security Flag information of the current stage to verify whether there is an abnormality in the security Flag information of the current stage.

6. The anti-cheating method for a network security competition according to claim 1, wherein The dynamically updating the trust values of each team member includes: Record the trust value calculation results of the same operating machine, generate a time series fluctuation curve, and store the historical trend data; analyze the mutation points and high-frequency fluctuation intervals of the fluctuation curve to locate the early points of abnormal trust values; inject forged Flags at the early warning points of abnormal trust values to verify whether the participating team members submit abnormally or cheat.

7. The anti-cheating method for network security competitions according to claim 6, characterized in that, The injecting forged Flags at the early warning points of abnormal trust values includes: Select the early warning points from the time series fluctuation curve. The system generates forged Flags according to the security Flag information of the current stage for the early warning points; use the same encryption algorithm and key derivation rule as the formal system to encrypt with the security Flag information of the previous stage before the early warning point as the input; simulate the submission of forged Flags by the abnormal operating machine through the public interface of the competition and associate it with the early warning point; among them, the injection frequency of the forged Flags is limited; after the participating team members submit the forged Flags, the system records the response information and analyzes the operation logs. If they frequently change the IP and modify the user agent and the trust value fluctuates abnormally, it is determined that the team member has cheated.

8. The anti-cheating method for network security competitions according to claim 1, characterized in that, The calculating the trust value further includes: Predict the change trend of the trust value in the future time window based on the multi-dimensional feature data of the real-time acquisition state machine; dynamically adjust the trap type, density and position according to the prediction result, and limit the injection frequency; analyze the operation log after submitting the Flag information, and combine the sudden drop signal of the trust value to determine the bypass cheating behavior.

9. The anti-cheating method for network security competitions according to claim 8, characterized in that, The method further includes: The trap types include forged Flag, delayed response, and resource limit traps. The trap density is the triggering probability per unit time, and the position covers the submission interface layer, data verification layer, and feedback response layer of the system. Using the cheating recognition rate and misjudgment rate as feedback, dynamically adjust the trap parameters with reinforcement learning; collect the operation log in real time after submitting the security Flag information, and analyze the trust value drop pattern; if there is an abnormal operation pattern before and after the drop, it is determined as a bypass cheating behavior; among them, the abnormal operation pattern includes but is not limited to frequently submitting similar security Flag information, modifying code or request parameters.

10. An anti-cheating system for a network security competition, which is applied to an anti-cheating method for a network security competition as described in any one of claims 1 to 9, and is characterized in that, The system includes: A data acquisition module that records all operations of the participating team members on the operation machine in real time, and intercepts the interaction data between the competition question node and the operation machine according to a fixed intercept time period and a random intercept mechanism; A trust calculation module that calculates the trust value based on the intercepted interaction data and quantitatively evaluates the credibility of the operation behavior of the participating team members; A Flag generation module that extracts security Flag information from the intercepted interaction data according to preset selection rules based on different trust values, and performs signature and encryption processing; A comparison and determination module that compares the security Flag information submitted by the participating team members with the extracted security Flag information. If the comparison result does not match, it is considered that the participating team members have cheated.

Images