A method and system for preventing cheating in a network security competition

Abstract

The application relates to a network security competition anti-cheating method and system to maintain the fairness of the competition. Through a fixed cycle and random time point mixed interception mechanism, interactive data such as network traffic, logs, system calls and the like of the operation machine and the competition node are collected in real time, and the data integrity and randomness are balanced; after data cleaning, features such as abnormal instructions and sensitive commands are extracted, and the trust value of the team member is quantitatively calculated based on a machine learning model from the dimensions of abnormal operation frequency, sensitive operation proportion and operation concentration. According to the trust value, the high, medium and low intervals are divided, the security Flag generation strategy is dynamically adapted, and a differential encryption algorithm is used. Finally, the cheating is judged by comparing the consistency of the submitted and system extracted Flags, and the precision, efficiency and scene adaptability of the anti-cheating system are effectively improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network, in particular to a network security competition anti-cheating method and system. BACKGROUND

[0002] CTF, usually translated as capture the flag in Chinese, represents a competition mode between network security technicians. After years of development, CTF has become a popular competition form in the global network security field. In CTF competition, contestants access the network on site and rank according to the score and time of solving network security technical challenge problems. Contestants need to obtain a specific format string Flag from the competition environment set by the organizer and submit it to the organizer to get the corresponding score. A series of problems of different types and difficulties will be set in the competition, and the Flag will be obtained by solving the problems and submitting the score. At the end of the competition, the teams are ranked according to the total score.

[0003] The Chinese invention patent with patent application number 202010984461.2 discloses a network security CTF competition anti-cheating system and method: the system mainly includes a CTF test paper module, a competition question management module, an operation machine management module, a Flag session module and a Flag security module. The CTF test paper module is used to synthesize the competition test paper and generate the Flag for all competition questions. The competition question management module is used to generate the competition question environment and write the Flag. The operation machine management module is used to generate the competition operation machine connected to the competition question environment for the contestants. The Flag session module is used to save the session record within the valid period of the session. The Flag security module is used to replace the intercepted message with secure Flag information. The CTF test paper module judges whether cheating or abnormality occurs according to the Flag session record. The present application can improve the security of the competition platform, the resistance and detection ability of the platform to cheating behavior, and can be applied to various protocol access competition question application scenarios.

[0004] In the prior art, although the corresponding secure Flag is set as further verification, only the IP address, timestamp and fixed algorithm signature encryption are used, which is easy to find the rule in the process of solving the problem multiple times and then be cracked. SUMMARY

[0005] The present application aims at the technical problems existing in the prior art, and quantifies the trust value of mixed intercepted interaction data to adapt the strategy to accurately determine the competition cheating.

[0006] The technical solution of the present application to solve the above technical problems is as follows: a network security competition anti-cheating method, comprising:

[0007] S1, real-time record all operations of the contestants on the operation machine, randomly intercept the interaction data between the competition topic node and the operation machine according to a fixed period;

[0008] S2, calculate the trust value according to the intercepted interaction data; decompose the competition topic into a multi-stage chain topic group with logical association; after the contestant submits the previous stage security flag information and completes the team identity verification, bind it with the current stage flag information, trigger the generation of dynamic encryption flag information, and predict the security flag information of the next stage; compare the predicted security flag information with the dynamic encryption flag information to verify the current security flag information, and dynamically update the trust value of each contestant;

[0009] S3, extract and sign and encrypt the security flag according to the preset rule of the trust value;

[0010] S4, compare the submitted and intercepted security flag information, and if they do not match, it is determined that cheating has occurred.

[0011] Preferably, the random interception of the interaction data between the competition topic node and the operation machine according to a fixed period comprises:

[0012] determining a fixed time period as the reference frequency of data interception, the interaction data between the competition topic node and the operation machine is periodically intercepted according to the period; in each fixed interception time period , through a random interception mechanism, multiple time intervals in the period are randomly selected for data interception; that is, at each random interception, multiple time points are randomly selected from the range to form a random interception time point set .

[0013] Preferably, the random selection of multiple time intervals in the period for data interception comprises:

[0014] calculating the number of sensitive operations in the random interception time point for the intercepted data respectively, the proportion of sensitive operations in the random interception time point , the density of operations in the random interception time point ; based on the historical labeled normal / abnormal behavior samples, use a machine learning model to train the weight coefficient , calculate the trust value according to the trained weight coefficient; the formula is as follows: .

[0015] Preferably, the calculation of the trust value according to the intercepted interaction data comprises:

[0016] Based on the historical labeled normal / abnormal behavior samples, the weight coefficients are trained using a machine learning model According to the trained weight coefficients, the trust value is calculated; the formula is as follows:

[0017] .

[0018] Preferably, the trigger generates dynamic encryption Flag information and predicts the security Flag information of the next stage, specifically including:

[0019] When constructing a multi-stage chain competition question, the overall goal of the competition question needs to be first determined, which is decomposed into logically independent but dependent sub-tasks, and then subdivided into N stages, each stage focusing on a specific task and having a globally unique identifier, and the stage dependency relationship is defined. After the team members submit the previous stage security Flag and team identity features, the system queries the database for verification, and if it is not reused, it is bound and encrypted with the current Flag, otherwise it is determined to be cheating. Collect historical stage security Flag information data, train using a time series model, input the previous stage security Flag information to predict the next stage security Flag information, and compare it with the decrypted security Flag information of the current stage to verify whether the current stage security Flag information is abnormal.

[0020] Preferably, the dynamic update of the trust value of each team member includes:

[0021] The trust value calculation results of the same operation machine are recorded to generate a time series fluctuation curve and store historical trend data; the mutation point and high-frequency fluctuation interval of the fluctuation curve are analyzed to locate the early point of trust value anomaly; a fake Flag is injected at the early warning point of trust value anomaly to verify whether the competition team member submits abnormally or cheats.

[0022] Preferably, the injection of the fake Flag at the early warning point of trust value anomaly includes:

[0023] From the time series fluctuation curve, the abnormal early warning point is selected, and the system generates a fake Flag based on the current stage security Flag information for the abnormal early warning point; the previous stage security Flag information of the early warning point is input, and the encryption algorithm and key derivation rule consistent with the formal system are used for encryption; the fake Flag is submitted by simulating the abnormal operation machine through the competition public interface, and is associated with the abnormal early warning point; wherein, the injection frequency of the fake Flag is limited; after the competition team member submits the fake Flag, the system records the response information and analyzes the operation log, and if the IP is frequently changed, the user agent is modified, and the trust value fluctuates abnormally, it is determined that the team member has cheating behavior.

[0024] Preferably, the calculation of the trust value further includes:

[0025] Real-time acquisition of multi-dimensional feature data of the state machine predicts the trend of trust value change in the future time window; according to the prediction result, the trap type, density and position are dynamically adjusted, and the injection frequency is limited; the operation log after submitting the Flag information is analyzed, and the bypass cheating behavior is judged according to the trust value sudden drop signal.

[0026] Preferably, the method further comprises:

[0027] The trap type includes fake Flag, delayed response, resource limitation trap, the trap density is the triggering probability per unit time, the position covers the submission interface layer, the data verification layer and the feedback response layer of the system; the cheating identification rate and the misjudgment rate are used as feedback to dynamically adjust the trap parameters by reinforcement learning; the operation log after submitting the security Flag information is collected in real time, and the trust value decline mode is analyzed; if there is an abnormal operation mode before and after the decline, it is determined that the bypass cheating behavior exists; wherein the abnormal operation mode includes but is not limited to frequently submitting similar security Flag information, modifying code or request parameters.

[0028] The application also provides a cheating prevention system for a network security competition, which comprises:

[0029] A data acquisition module, which records all operations of a contestant on an operation machine in real time, intercepts interaction data between a competition node and the operation machine according to a fixed interception time period and a random interception mechanism;

[0030] A trust calculation module, which calculates a trust value according to the intercepted interaction data and quantitatively evaluates the operation behavior credibility of the contestant;

[0031] A Flag generation module, which extracts security Flag information from the intercepted interaction data according to a preset selection rule according to the different trust values, and performs signature and encryption processing;

[0032] A comparison and judgment module, which compares the security Flag information submitted by the contestant with the extracted security Flag information, and considers that the contestant has cheating behavior if the comparison result does not match.

[0033] The application has the following beneficial effects: by recording the operations of the contestant in real time and intercepting the interaction data between the competition node and the operation machine, the data diversity is enhanced by the random interception mechanism; the operation behavior credibility is quantitatively evaluated by using a machine learning model, and the selection rule and encryption strategy of the security Flag are dynamically adjusted accordingly, which not only ensures efficient processing under high trust level, but also ensures strong security under low trust level; by comparing the security Flag submitted by the contestant with the Flag extracted by the system, cheating behavior is effectively identified, and the fairness and justice of the competition are maintained. The scheme not only improves the accuracy and efficiency of the cheating prevention system, but also enhances the flexibility and adaptability of the system;

[0034] By decomposing the competition into multiple-stage chain problems, determining the dependency relationship between stages, assigning a unique identifier to each stage and establishing a mapping database table, combining dynamic encryption flag generation, time series-based flag prediction verification and dynamic trust value updating, the strict control and cheating prevention of the CTF competition problem solving process are realized. This scheme not only ensures the compliance of the problem solving order, but also effectively prevents flag leakage and cheating behavior. At the same time, through the dynamic trust value updating mechanism, the credibility of the participants can be evaluated in real time, providing a strong guarantee for the fairness and safety of the competition.

[0035] By constructing a trust value time series analysis system, the dynamic changes of the trust value of the operation machine can be accurately captured, and the CUSUM algorithm and fluctuation threshold are used to accurately locate the abnormal precursor point, realizing early warning of potential cheating risks. By using the pseudo-flag injection and behavior monitoring technology, the attack scene is simulated to verify the response of the contestant, combined with the submission strategy adjustment and historical trust fluctuation analysis, the hidden cheating methods such as bypassing verification and frequent changing of operations can be effectively identified, ensuring the stable operation of the competition system while providing comprehensive and dynamic technical support for the fairness of the competition, greatly improving the accuracy and efficiency of cheating behavior identification.

[0036] By real-time collection of multi-dimensional operation data to build a dynamic trust evaluation system, combined with the LSTM model to realize accurate prediction and risk grading of trust value, and based on the prediction results to dynamically adapt the trap strategy, high-risk behaviors can be captured in advance; correlation of operation logs and trust value drop signals realizes multi-dimensional cross verification of cheating behaviors, significantly improving the identification rate of hidden cheating methods; through reinforcement learning to continuously optimize the trap trigger threshold and type combination, while reducing the false positive rate, the defense flexibility is improved, finally forming a "prediction-response-evolution" closed loop mechanism, providing full-process and adaptive technical support for the fairness of the competition, effectively dealing with complex and variable cheating scenarios. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 A flowchart of a network security competition anti-cheating method according to an embodiment of the present application;

[0038] Figure 2 A structural block diagram of a network security competition anti-cheating system according to an embodiment of the present application. DETAILED DESCRIPTION

[0039] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0040] In the description of the present application, the terms "first", "second" are only for descriptive purpose, and cannot be understood to indicate or imply relative importance or implicitly indicate the number of the indicated technical features. Therefore, the features defined with "first", "second" can explicitly or implicitly include one or more of the features. In the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0041] In the description of the present application, the term "for example" is used to indicate "as an example, illustration or description". Any embodiment described as "for example" in the present application is not necessarily interpreted as more preferred or more advantageous than other embodiments. The following description is given in order to enable any person skilled in the art to implement and use the present application. In the following description, details are listed for the purpose of explanation. It should be understood that those skilled in the art can recognize that the present application can be implemented without using these specific details. In other examples, well-known structures and processes will not be described in detail in order to avoid unnecessary details making the description of the present application obscure. Therefore, the present application is not intended to be limited to the embodiments shown, but is consistent with the broadest scope consistent with the principles and features disclosed in the present application.

[0042] Embodiment 1: Figure 1 is a flowchart of a network security competition anti-cheating method according to an embodiment of the present application, comprising the following steps:

[0043] S1, real-time record all operations of the contestant on the operation machine, according to the fixed interception time period and the random interception mechanism, intercept the interaction data between the competition node and the operation machine.

[0044] Among them, the interaction data includes intercepting key data segments from the interaction data between the competition node and the operation machine at the determined interception time point, and the data segments include but are not limited to network traffic (such as TCP / UDP packets), operation logs (such as system logs, application logs), system call records, etc.

[0045] Specifically, start the anti-cheating system, determine a fixed time period as the reference frequency of system interception data, periodically intercept the interaction data between the competition node and the operation machine. For example, set the fixed time period = 10 minutes, in each fixed interception time period, introduce a random interception mechanism to determine the random interception time interval (the time interval is defined according to the actual situation), such as 2 minutes, 4 minutes, 6 minutes, respectively, once random interception, at each random interception, randomly select multiple time points from the range , that is For example, = 10 minutes, = {2 minutes, 3 minutes, 4 minutes}, then randomly intercept the time point Will be intercepted at some time in [0, 10] minutes (such as 2 minutes, 5 minutes, 9 minutes, just an example, actually randomly selected).

[0046] Record all operations of the participating team members on the operating machine, including but not limited to keyboard input, mouse operation, network request (such as HTTP request, SSH connection, etc.) and other system events.

[0047] S2, calculate the trust value according to the intercepted interaction data, and quantitatively evaluate the credibility of the operation behavior of the participating team members.

[0048] Specifically, in the intercepted interaction data, extract abnormal instructions (such as rm -rf / ) and sensitive commands (such as sudo su) from network traffic, count file read / write, process creation, etc. System events from operation logs, identify privilege escalation attempts, port scanning, etc. Behavior from system call records, eliminate non-malicious operations (such as normal compilation commands, document editing), and desensitize sensitive information (such as hiding IP addresses, user identities).

[0049] Based on the above preprocessed data, calculate the abnormal operation frequency (the number of illegal instructions or sensitive operations in the random interception time point): For example: The data segment duration is 10 minutes, and the random interception time points are 2 minutes, 3 minutes, and 4 minutes. Then 5 times, 7 times, and 2 times of illegal instructions are detected in 0-2 minutes, 2-5 minutes, and 5-9 minutes, respectively. Then A = 5 / 2 + 7 / 3 + 2 / 4; The proportion of sensitive operations (the proportion of sensitive operations in the random interception time point to all operations in the random interception time point): For example: The data segment duration is 10 minutes, and the random interception time points are 2 minutes, 3 minutes, and 4 minutes. Then 5 times, 7 times, and 2 times of sensitive operations are detected in 0-2 minutes, 2-5 minutes, and 5-9 minutes, respectively. Then B = 5 / 50 + 7 / 50 + 2 / 50; The concentration of operations (the concentration of operations in the random interception time point): For example: The data segment duration is 10 minutes, and the random interception time points are 2 minutes, 3 minutes, and 4 minutes. Then 5 times, 7 times, and 2 times of sensitive operations are detected in 0-2 minutes, 2-5 minutes, and 5-9 minutes, respectively. Then C = 50 / 2 + 70 / 3 + 20 / 4.

[0050] Based on the historical normal / abnormal behavior samples labeled, use machine learning model to train weight coefficients , according to the training output weight coefficient (the application ), the trust value is calculated. The formula is as follows:

[0051] .

[0052] S3, according to the different trust value, according to the preset selection rule from the intercepted interaction data extraction security Flag information, and signing and encryption processing.

[0053] Specifically, the selection rule is to divide the trust value into three intervals of high trust degree (reference value TS≥80), medium trust degree (reference value 50≤TS<80) and low trust degree (reference value TS<50); for the interaction data of high trust degree, the interaction data segment in the last 10 minutes is intercepted, for the interaction data of medium trust degree, the interaction data segment in the past 30 minutes is intercepted, and for the interaction data of low trust degree, the full interaction data segment since the start of the game is intercepted.

[0054] The intercepted new interaction data segment generates security Flag information (data fingerprint, dynamic timestamp, random salt value), calculates the SHA-256 hash value of the segment content (such as df=SHA256(fragment)) to obtain the data fingerprint, obtains the current UTC timestamp and performs Base64 encoding (such as dt=base64(UTC time)) to obtain the dynamic timestamp, and generates a 128-bit random number (such as rs=openssl rand -hex 16) to obtain the random salt value; according to the trust value, different encryption algorithms are selected to encrypt the security Flag information, such as AES-128-GCM for high trust value, AES-256-CBC for medium trust value, and RSA-4096-OAEP for low trust value.

[0055] Among them, the encryption encapsulation formula is: SecureFlag=Encrypt(df||dt||rs,SecretKey), df (data fingerprint) is the hash value of the data segment calculated by SHA-256, which is used to verify the integrity of the Flag content (such as preventing tampering); dt (dynamic timestamp) is the Base64 encoding of the current UTC time, which is used to limit the validity period of the Flag (prevent old Flag from being repeatedly submitted); rs (random salt value) is a 128-bit random number, which increases the randomness and unpredictability of encryption (prevent the same data from generating the same Flag). The encryption process is input: df||dt||rs (pasted binary data) + SecretKey (key), output: encrypted ciphertext (SecureFlag).

[0056] S4, compare the security flag information submitted by the contestant with the intercepted security flag information, if the comparison result is not matched, it is considered that the contestant has cheating behavior.

[0057] Specifically, the system receives the security flag information submitted by the contestant, decrypts and verifies the signature of the received security flag information submitted by the contestant and the security flag information extracted by the system, and performs byte-by-byte comparison to check whether they are completely consistent. Analyze the comparison result to determine whether the security flag information submitted by the contestant is consistent with the security flag information extracted by the system. If the comparison result is inconsistent, the system determines that the contestant has cheating behavior.

[0058] The technical solutions in the embodiments of the application have at least the following technical effects or advantages:

[0059] By recording the operation of the contestant in real time and intercepting the interaction data between the contest node and the operation machine, the data diversity is enhanced by combining the random interception mechanism; the operation behavior credibility is quantitatively evaluated by using a machine learning model, and the selection rules and encryption strategies of the security flag are dynamically adjusted accordingly, which not only ensures efficient processing under high trustworthiness, but also ensures strong security under low trustworthiness; by comparing the security flag submitted by the contestant with the flag extracted by the system, cheating behavior is effectively identified, and the fairness and justice of the competition are maintained. The scheme not only improves the accuracy and efficiency of the anti-cheating system, but also enhances the flexibility and adaptability of the system.

[0060] In embodiment 1, cheating is mainly detected by behavior feature similarity and fixed trust threshold, but this method has obvious shortcomings. On the one hand, a static trust threshold is difficult to adapt to different difficulty levels of the contest, such as Pwn type and Web type, and a fixed threshold will lead to misjudgment. On the other hand, the logic dependence between stages is not dynamically combined with the behavior trust value, and the attacker may bypass the stage verification to submit high-order flags. In addition, only the current stage flag is checked, and the time sequence correlation of the historical stage flag sequence is not used to predict the legitimacy of the next stage flag, making it difficult to identify cheating behavior of locally tampered flags.

[0061] Therefore, the embodiments of the application make certain optimizations on the basis of the above embodiments.

[0062] In some embodiments, in step S2, the trust value is calculated according to the intercepted interaction data, and the method further comprises:

[0063] S21, the contest is disassembled into a multi-stage chain type problem set, and the dependency relationship between multiple problems is determined.

[0064] Wherein, the multi-stage chain question group needs to assign a unique identifier to each stage, establish a stage-identifier mapping database table, which needs to include the unique identifier of each stage, stage description, and pre-dependence, etc.

[0065] Specifically, the overall goal of the competition question is determined (such as vulnerability mining, password cracking, protocol reverse, etc.), and the task is divided into logically independent but dependent sub-tasks according to the goal (example: Web penetration question→information collection→vulnerability verification→permission maintenance→flag extraction). Divide the sub-tasks into N stages , each stage focuses on a specific task, and each stage needs to have a clear completion mark, and assign a globally unique identifier to each stage . Define the conditions of stage dependence . The dependence relationship can be represented as a directed acyclic graph , V is the set of stages, and E is the set of dependence relationships. If stage depends on , then can only be unlocked after is completed, and the stage unlocking condition is: .

[0066] S22, the contestant submits the previous stage security flag information and verifies the team identity characteristics, binds with the current stage flag, and triggers the generation of dynamic encrypted flag information.

[0067] Specifically, the contestant submits the security flag information (denoted as ) of the previous stage and the team identity characteristics (such as the IP address of the operating machine). Query the database table to check if exists in the legal security flag information set of , and has not been reused by other contestants. If the verification is passed, bind with the current security flag information to generate the of the current stage , and encrypt . If the verification fails, it is determined that the contestant has cheating behavior.

[0068] S23, according to the previous stage security flag information to predict the next stage security flag information, compare the predicted information with the dynamic encrypted flag information, and verify the current stage security flag information.

[0069] Among them, the security flag information of the next stage is collected from the security flag information of the historical stage, including the security flag information of the previous stage​​ and the corresponding stage identifier and related data, using historical data to train the model to obtain a trained model M. The previous stage safety flag information of the current stage is input into the trained model M to obtain the predicted next stage safety flag information . The dynamic encryption flag information of the current stage is obtained from the database , and the current stage flag information is decrypted by the corresponding decryption method , the predicted next stage safety flag information and the decrypted safety flag information of the current stage are compared to verify whether the current stage is abnormal.

[0070] S24, according to the safety flag information of the current stage, the trust value of each contestant is dynamically updated.

[0071] wherein the trust value dynamic updating formula is , , is the trust value adjustment amount, is the trust value of the contestant in the previous stage.

[0072] The technical solutions in the embodiments of the present application have at least the following technical effects or advantages:

[0073] By decomposing the competition topic into a multi-stage chain topic group, the dependency relationship between stages is clear, a unique identifier is assigned to each stage and a mapping database table is established, combined with dynamic encryption flag generation, time series-based flag prediction verification, and dynamic trust value updating, the competition process of CTF is strictly controlled and cheating is prevented. This scheme not only ensures the compliance of the competition topic solving order, but also effectively prevents flag leakage and cheating behavior. At the same time, through the dynamic trust value updating mechanism, the credibility of the contestants can be evaluated in real time, providing a strong guarantee for the fairness and safety of the competition.

[0074] Embodiment 3: In embodiment 2, the system identifies cheating based on a fixed trust value threshold and a static encryption trap mechanism, but there are obvious shortcomings: on the one hand, the trust value fluctuation benchmark changes dynamically with the stage of the competition and the participating group, and a static threshold is easy to misjudge normal fluctuations or miss hidden cheating; on the other hand, the encryption trap triggering rule is decoupled from the dynamic changes of the trust value, the intervention for high-risk teams with sudden drop in trust value is lagging, and there is a lack of gradient monitoring for teams in the medium and low range of trust value. In addition, abnormal analysis only focuses on trust value and trap response, without correlating with operation logs, strategy evolution and other dimensions, making it difficult to capture hidden behaviors such as "segmented exploration".

[0075] Therefore, the embodiments of the present application make certain optimizations on the basis of the above embodiments.

[0076] In some embodiments, in step S24, the dynamic updating of the trust value of each participating team member also includes:

[0077] S241, record the trust value calculation results of the same operation machine, generate a time series fluctuation curve, and store historical trend data.

[0078] Specifically, the system automatically extracts the trust value calculation results of the participating team members associated with the operation machine, and records the specific timestamp (accurate to seconds) at the end of the current stage. The timestamp and the corresponding trust value are bound as a record to form a data pair (timestamp, trust value), and then each (timestamp, trust value) record is inserted into the database. Subsequently, the historical trust value records of the operation machine are queried according to the operation machine identifier, and arranged in ascending order of timestamp. A continuous line graph is drawn with the timestamp as the horizontal axis and the trust value as the vertical axis. The horizontal axis represents the time stamps arranged in chronological order, which is used to show the trend of the trust value over time; the vertical axis represents the numerical range of the trust value, reflecting the fluctuation amplitude of the trust value.

[0079] S242, analyze the mutation points and high-frequency fluctuation intervals of the fluctuation curve to locate the early points of trust value anomalies.

[0080] Specifically, the mutation points and high-frequency fluctuation intervals of the fluctuation curve are analyzed to identify the risk of cheating in advance. First, for each time point of the time series fluctuation curve, the deviation from the historical mean μ is calculated, and a drift parameter k (usually set to 0.5 times the standard deviation) is introduced to filter random noise. If the deviation of the current time point is positive after drift correction and superposition of the previous positive cumulative sum, the positive cumulative sum is updated, otherwise it is reset to zero; the negative cumulative sum is processed through reverse logic. When the positive or negative cumulative sum exceeds the preset threshold (3 times the standard deviation), it is determined that the time point is a trust value mutation point.

[0081] For two adjacent time points in the time series fluctuation curve, their trust values are obtained respectively, the absolute difference of the trust values of adjacent time points is calculated, and the distribution characteristics (mean and standard deviation) of the historical difference values are counted. If the difference value of a certain time point exceeds the mean value plus 2 times the standard deviation, the time point is marked as an abnormal fluctuation point; if a plurality of continuous time points satisfy the condition that the difference value exceeds the mean value plus 2 times the standard deviation, the continuous time interval is determined as a high-frequency fluctuation interval.

[0082] The time of the suspicious mutation point determined by the mutation point detection and the start time of the high-frequency fluctuation interval obtained by the high-frequency fluctuation interval detection are used as the abnormal early points of the time series fluctuation curve.

[0083] S243, injecting a fake flag at the trust value abnormal precursor point, verifying whether the contestant submits abnormally or cheats.

[0084] Specifically, the highly suspicious test objects are selected from the located abnormal early points, the false positive conditions caused by system failure or strategy adjustment are further investigated and excluded. For the selected targets, the system generates a fake flag highly consistent with the real flag, and simulates abnormal behavior for testing.

[0085] The generation of the fake flag needs to strictly follow the legal logic of the current stage. Taking the legal flag normally obtained by the contestant in the previous stage of the abnormal precursor point as input, the encryption algorithm (such as AES-256) and key derivation rule consistent with the formal system are used for encryption processing. This process ensures that the fake flag is completely consistent with the real flag in form and rule, so as to have enough confusion. After generation, the system will perform uniqueness verification on the fake flag, compare it with the historical legal flag, and ensure that they are not repeated, so as to avoid misjudgment caused by repeated submission. After completion, the system simulates the submission behavior of the abnormal operation machine through the public interface (Flag submission API) of the competition system. The behavior is associated with the abnormal precursor point, which is convenient for subsequent analysis of the operation of the contestant on the abnormal device. In order to ensure the stability of the competition system, the injection frequency of the fake flag will be strictly limited, for example, at most 1 operation per hour, which ensures the verification effect while avoiding pressure on the system.

[0086] After the contestant submits a fake flag, the system records the response information in real time, including types such as "verification failure" or "flag repetition". If the system fails to identify the illegality of the fake flag, it means that the contestant may have bypassed the verification and cheated. At the same time, the system analyzes the operation log of the contestant after injecting the fake flag, and observes whether the contestant continues to attempt to submit other fake flags, or whether the contestant adjusts the submission strategy by changing the IP address, modifying the user agent, etc. If the contestant frequently changes the IP and modifies the user agent after injecting the fake flag, and in combination with the abnormal situation of the historical trust value fluctuation, it can be determined that the contestant is highly suspicious. This abnormal behavior pattern may indicate that the contestant is trying to evade monitoring by changing the operation method, and there is a possibility of cheating.

[0087] The technical solutions in the embodiments of the present application have at least the following technical effects or advantages:

[0088] By constructing a trust value time series analysis system, the dynamic change of the trust value of the operation machine can be accurately captured, the CUSUM algorithm and the fluctuation threshold are used to accurately locate the abnormal precursor point, and early warning of potential cheating risks is realized. By using the fake flag injection and behavior monitoring technology, the attack scene is simulated to verify the response of the contestant, and in combination with the multi-dimensional analysis of the submission strategy adjustment and the historical trust fluctuation, the bypass verification and frequent change of operation can be effectively identified. The hidden cheating means, while ensuring the stable operation of the competition system, provides comprehensive and dynamic technical support for the fairness of the competition, and greatly improves the accuracy and efficiency of cheating behavior identification.

[0089] In embodiment 4, in embodiment 3, although the system has constructed a cheating prevention and control framework based on trust value prediction and dynamic trap mechanism, it still has obvious shortcomings in actual confrontation scene: on the one hand, the LSTM model only relies on historical trust value and basic operation features for single-dimensional prediction, and has insufficient adaptability to more hidden cheating methods (such as detecting trap rules by high-frequency small-amplitude exploratory submission, and dynamically sharing fake flags across contestants), and the prediction error accumulates with the evolution of attack mode; on the other hand, the trap strategy adjustment logic lacks correlation mining of multi-source behavior signals, and it is difficult to capture the continuous cheating attempt under the "high frequency and low error" disguise, and the strategy iteration relies on manual intervention, and cannot respond to new attacks in time.

[0090] Therefore, the embodiments of the present application are optimized on the basis of the above embodiments.

[0091] In some embodiments, in step S241, the trust value calculation result of the same operation machine is recorded, and further includes:

[0092] 1A, the multi-dimensional feature data of the state machine is collected in real time to predict the trust value change trend in the future time window.

[0093] Specifically, real-time collection of operation logs of participating team members (including operation time, type, and device information), flag submission records (time, content, and results), and system access logs (interface, frequency, and duration), and data cleaning (de-duplication, missing value filling, and abnormal value correction). Extract multi-dimensional feature data such as current trust value, historical average value, volatility rate (standard deviation to average value in the past 24 hours), flag submission frequency per unit time, error flag proportion, IP switching frequency, device fingerprint diversity, and trust value coordination fluctuation coefficient between team members. Use the LSTM model to divide the data set by 7:1.5:1.5, and based on the latest data every 10 minutes, predict the trust value and 95% confidence interval for the next 1 hour.

[0094] 1B, dynamically adjust the trap type, density, and location according to the prediction results, and limit the injection frequency.

[0095] Specifically, the trap type includes fake flag, delayed response, and resource limitation trap, the trap density is the triggering probability per unit time (such as 30% representing 3 times out of 10 submissions), and the location covers the submission interface layer, data verification layer, and feedback response layer. If the predicted value is lower than 1.5 times the standard deviation of the average value or shows a downward trend, it is determined to be high risk, and 40% triggering probability traps are deployed in the data verification layer and feedback response layer. If the predicted value is stable but the error flag proportion exceeds 30%, enable the delayed response trap in the feedback layer. Combined with high-frequency submission, frequent IP switching, and highly similar flag submission characteristics, add fake flag and resource limitation trap in the submission interface layer. Take the cheating recognition rate and misjudgment rate as feedback indicators, dynamically adjust the trap parameters using reinforcement learning, and realize adaptive matching of risk and defense.

[0096] 1C, analyze the operation logs after submitting the flag information, and determine the bypass cheating behavior in combination with the trust value drop signal.

[0097] Specifically, real-time collection of operation logs after submitting the safe flag information (including operation time, type, object, and results), and extraction of key information such as submission, access, and code operation. Set the trust value drop threshold (such as a 20% drop within 10 minutes), analyze the drop pattern (start time, duration, and subsequent trend), and determine the association with cheating. If there are frequent submissions of highly similar flags before the drop and similar flags are submitted after the drop, or if there are frequent accesses to the verification result page and modifications of the request parameters during the drop, it is determined to be a bypass cheating behavior.

[0098] The technical solutions in the above embodiments of the present application have at least the following technical effects or advantages:

[0099] A dynamic trust evaluation system is constructed by collecting multi-dimensional operation data in real time, the LSTM model is combined to realize accurate prediction of trust value and risk grading, and the trap strategy is dynamically adapted based on the prediction result, so that high-risk behaviors can be captured in advance; multi-dimensional cross verification of cheating behaviors is realized by associating operation logs with trust value sudden drop signals, which significantly improves the recognition rate of hidden cheating means; the trap triggering threshold and type combination are continuously optimized through reinforcement learning, which reduces the false positive rate while improving the defense flexibility, and finally forms a "prediction-response-evolution" closed loop mechanism, which provides full-process and adaptive technical support for the fairness protection of the event, and effectively deals with complex and variable cheating scenarios.

[0100] Further, the embodiment of the present application also provides a cheating prevention system for a network security competition.

[0101] Figure 2 is a structural schematic diagram of a cheating prevention system for a network security competition according to the embodiment of the present application.

[0102] As shown in Figure 2 , a cheating prevention system for a network security competition includes a data acquisition module, a trust calculation module, a Flag generation module, and a comparison and determination module.

[0103] The data acquisition module records all operations of the contestant on the operation machine in real time, intercepts the interaction data between the competition node and the operation machine according to a fixed interception time period and a random interception mechanism;

[0104] The trust calculation module calculates the trust value according to the intercepted interaction data, and quantitatively evaluates the operation behavior credibility of the contestant;

[0105] The Flag generation module extracts security Flag information from the intercepted interaction data according to the preset selection rule according to the different trust values, and performs signature and encryption processing;

[0106] The comparison and determination module compares the security Flag information submitted by the contestant with the intercepted security Flag information, and if the comparison result does not match, it is considered that the contestant has cheating behavior.

[0107] It should be noted that other specific implementation contents of the cheating prevention system for a network security competition according to the embodiment of the present application can refer to the cheating prevention method for a network security competition described above.

[0108] It should be noted that in the above embodiments, the description of each embodiment has its own emphasis, and the parts not described in detail in a certain embodiment can be referred to the related description of other embodiments.

[0109] Those skilled in the art will appreciate that embodiments of the present application can be devised for a variety of applications. It is intended that the present application be limited only by the scope of the appended claims, and it is intended that various modifications and alterations made by those skilled in the art be considered as within the scope of the present application. The embodiments of the present application will be described with reference to the attached drawings identified below.

[0110] The present application is described in reference to the drawings using a flowchart and / or a block diagram of the method, apparatus (system) and computer program product according to embodiments of the application. It will be understood that each block of the flowchart and / or block diagram, and combinations of blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0111] These computer program instructions can also be stored in a computer- readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instructions which implement the function specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0112] These computer program instructions can also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks. Figure 1 one or more functions specified in the flowchart and / or block diagram block or blocks.

[0113] While the preferred embodiments of the application have been described, additional variations and modifications can be made to the embodiments by those skilled in the art once they learn of the basic inventive concepts. Therefore, the appended claims are intended to cover all such modifications and variations as fall within the scope of the present application.

[0114] Obviously, many modifications and variations of the present application are possible in light of the above teachings. It is, therefore, to be understood that within the scope of the appended claims and their equivalents, the application can be practiced otherwise than as specifically described.

Claims

1. A method for preventing cheating in cybersecurity competitions, characterized in that, The method includes: S1 records all operations performed by participating team members on the control unit in real time, and randomly extracts the interaction data between the competition question nodes and the control unit at fixed intervals; S2: Calculate the trust value based on the intercepted interaction data; break down the competition problem into a multi-stage chain of problems with logical connections; after the participating team members submit the security flag information of the previous stage and complete the team identity verification, bind it with the flag information of the current stage, trigger the generation of dynamically encrypted flag information, and predict the security flag information of the next stage; compare the predicted security flag information with the dynamically encrypted flag information to verify the current security flag information, and dynamically update the trust value of each team member. S3 extracts the security flag according to the preset rules of the trust value and signs and encrypts it; S4 compares the submitted and intercepted security flag information; if they do not match, cheating is determined.

2. The anti-cheating method for cybersecurity competitions as described in claim 1, characterized in that, The random sampling of interaction data between the competition problem nodes and the operating machine at fixed intervals includes: Determine a fixed time period As the baseline frequency for data extraction, the interaction data between the competition nodes and the operating machine is periodically extracted according to this cycle; in each Within this period, multiple time intervals are arbitrarily selected for data extraction; that is, during each random extraction, data is extracted from... Randomly select multiple time points within the range To form a set of randomly selected time points .

3. The anti-cheating method for cybersecurity competitions as described in claim 2, characterized in that, The process of arbitrarily selecting multiple time intervals within the period for data extraction includes: Calculate the number of sensitive operations within each randomly selected time point in the extracted data. The proportion of sensitive operations at randomly selected time points out of all operations at those randomly selected time points. The density of operations within a random time point Based on historically labeled normal / abnormal behavior samples, weight coefficients are trained using a machine learning model. The confidence value is calculated based on the training output weight coefficients; the formula is as follows: .

4. The anti-cheating method for cybersecurity competitions as described in claim 1, characterized in that, The step of calculating the trust value based on the intercepted interaction data includes: Weight coefficients are trained using a machine learning model based on historically labeled normal / abnormal behavior samples. The confidence value is calculated based on the training output weight coefficients; the formula is as follows: 。 5. The anti-cheating method for cybersecurity competitions as described in claim 1, characterized in that, The triggering of dynamic encryption flag information and prediction of the next stage's security flag information specifically includes: When constructing a multi-stage chain-like competition problem, first clarify the overall goal of the competition problem, break it down into logically independent but dependent sub-tasks, and then further subdivide it into N stages. Each stage focuses on a specific task and has a globally unique identifier, defining the stage dependencies. After participating team members submit the security flag information and team identity characteristics of the previous stage, the system queries the database for verification. If it is not reused, it is bound and encrypted with the current security flag information; otherwise, it is considered cheating. Collect historical stage security flag information data to train a time series model. Input the security flag information of the previous stage to predict the security flag information of the next stage, and compare it with the decrypted security flag information of the current stage to verify whether there is any anomaly in the current stage security flag information.

6. The anti-cheating method for cybersecurity competitions as described in claim 1, characterized in that, The dynamic updating of each team member's trust value includes: Record the trust value calculation results of the same operating machine, generate a time series fluctuation curve, and store historical trend data; analyze the abrupt change points and high-frequency fluctuation ranges of the fluctuation curve to locate the leading point of trust value anomalies; inject a fake flag at the leading point of trust value anomalies to verify whether the participating team members have submitted abnormally or cheated.

7. The anti-cheating method for cybersecurity competitions as described in claim 6, characterized in that, The injection of a forged flag at the precursor point of an abnormal trust value includes: The system identifies anomalous early warning points by filtering out abnormal early warning points. For each anomalous early warning point, a fake flag is generated based on the current stage's security flag information. Using the security flag information of the stage preceding the anomalous early warning point as input, the system encrypts the flag using the same encryption algorithm and key derivation rules as the official system. The fake flag is submitted by a simulated abnormal operation machine through the competition's public interface and associated with the anomalous early warning point. The frequency of fake flag injection is limited. After a participating team member submits a fake flag, the system records the response information and analyzes the operation logs. If the team member frequently changes their IP address, modifies their user agent, and exhibits abnormal fluctuations in trust value, the system determines that the team member has engaged in cheating.

8. The anti-cheating method for cybersecurity competitions as described in claim 1, characterized in that, The calculation of the trust value also includes: Real-time acquisition of multi-dimensional feature data from the state machine predicts the trend of trust value changes in future time windows; based on the prediction results, the trap type, density, and location are dynamically adjusted, and the injection frequency is limited; the operation logs after submitting Flag information are analyzed, and the bypass cheating behavior is determined by combining the sudden drop in trust value signal.

9. The anti-cheating method for cybersecurity competitions as described in claim 8, characterized in that, The method further includes: The trap types include forged Flags, delayed responses, and resource limitation traps. The trap density is the trigger probability per unit time, and the locations cover the system's submission interface layer, data verification layer, and feedback response layer. The trap parameters are dynamically adjusted using reinforcement learning, with feedback based on the cheating detection rate and false positive rate. Operation logs after submitting security Flag information are collected in real time, and the trust value decline pattern is analyzed. If there are abnormal operation patterns before and after the decline, it is determined to be a bypass cheating behavior. Among them, abnormal operation patterns include, but are not limited to, frequently submitting similar security Flag information, modifying code, or request parameters.

10. A cheating prevention system for cybersecurity competitions, applied to a cheating prevention method for cybersecurity competitions as described in any one of claims 1 to 9, characterized in that, The system includes: The data acquisition module records all operations performed by the participants on the control unit in real time, and captures the interaction data between the competition nodes and the control unit according to a fixed capture time period and a random capture mechanism. The trust calculation module calculates trust values ​​based on the captured interaction data to quantitatively assess the credibility of the participants' actions. The Flag generation module extracts security Flag information from the intercepted interaction data according to different trust values ​​and preset selection rules, and performs signing and encryption processing. The comparison and judgment module compares the security flag information submitted by the contestants with the extracted security flag information. If the comparison results do not match, the contestant is considered to have cheated.

Images