Method for identifying and tracing various types of cheating in network security CTF competition

Abstract

The present application relates to a kind of network security CTF competition multi-class cheating identification and trace analysis method, belong to network security technical field.The present application first monitors and records log to the process of player competition answering question;Then use finite state machine to analyze the logic abnormality of player of answering question step, based on normal distribution to judge the time abnormality of answering question step of player, and according to flag submission time, propose player correlation degree calculation method, find suspicious high similarity player, analyze and trace back the source of player cheating;Finally, collect and comprehensively judge suspicious player Writeup, answering question log under new and old environment, output cheating identification result and analysis report.The method effectively identifies the cheating behaviors in CTF competition, such as proxy participation, multiple accounts, plagiarism of other players' flags or solution ideas, and locates suspicious similar players.

Description

Technical Field

[0001] This invention designs a method for identifying and tracing various types of cheating in cybersecurity CTF competitions, belonging to the field of cybersecurity technology. Background Technology

[0002] CTF (Capture the Flag) is a popular information security competition among cybersecurity professionals. CTF typically consists of three formats: puzzle-solving, attack-defense, and hybrid. Puzzle-solving is the most common format for online competitions, with challenges categorized into various types, such as Web, Crypto, Misc, and Pwn. Contestants solve puzzles to obtain a flag, which is a formatted string hidden within the challenge. Submitting the correct flag earns points.

[0003] However, some cheating phenomena exist in online capture-the-flag competitions, such as:

[0004] 1. Plagiarizing other players' flags and submitting them;

[0005] 2. Use the problem-solving strategies provided by other contestants to complete the problem;

[0006] 3. Provide your own flag or solution method for other contestants to copy;

[0007] 4. Replacing other contestants in a competition, or using multiple accounts to participate in a competition.

[0008] The current anti-cheating methods for CTF competitions aim to determine whether a player has engaged in cheating. These methods can be broadly categorized into two types:

[0009] 1. Anti-cheating method based on dynamically generated flags

[0010] Anti-cheating methods based on dynamically generated flags refer to the practice of dynamically generating different flags for different participants on the same question during the question generation phase, in order to differentiate the participants' answering environments. When a participant submits a flag from another participant's question, it is considered that the participant has engaged in cheating. However, this method can only identify cheating behavior such as copying someone else's flag, and cannot effectively identify complex cheating behaviors such as using other participants' solution approaches.

[0011] 2. Anti-cheating methods based on abnormal player behavior analysis

[0012] Anti-cheating methods based on abnormal player behavior analysis involve analyzing a player's behavior during the question-answering process to determine if it is reasonable. For example, they might frequently change environments, submit results without enabling the environment, or submit answers in less than the set time. This analysis can help identify cheating methods such as impersonation, using multiple accounts, or copying flags. However, these methods struggle to trace the source of cheating behavior and detect the provider of the cheating strategy.

[0013] In summary, existing anti-cheating methods for CTF competitions can effectively identify cheating behaviors such as copying other contestants' flags, impersonating others, and using multiple accounts. However, they struggle to detect cheating behaviors such as using other contestants' solutions or providing one's own solutions for other contestants to copy, making it difficult to achieve source tracing analysis of cheating. Therefore, this invention proposes a multi-type cheating identification and source tracing analysis method for cybersecurity CTF competitions. Summary of the Invention

[0014] The purpose of this invention is to achieve the identification and source tracing analysis of various types of cheating in CTF competitions, and to propose a method for the identification and source tracing analysis of various types of cheating in cybersecurity CTF competitions.

[0015] The design principle of this invention is as follows: First, monitor and log the contestants' answering behavior; then, extract the key step sequence, execution time difference, and flag submission time information from the answer logs, and use finite state machines, normal distribution models, and contestant correlation calculations to identify suspicious contestants; finally, collect the re-answering process logs and detailed answers to the questions of suspicious contestants, combine them with the old answer log data for comprehensive comparative analysis, and finally output a contestant cheating analysis report for judgment.

[0016] The technical solution of the present invention is achieved through the following steps:

[0017] Step 1: Monitor the contestants' answering process, record the HTTP messages and time data of the contestants' answering process to generate an answering log database. If a contestant frequently changes the answering environment or submits content that is a flag of other contestants' questions, a penalty will be imposed.

[0018] Step 2 involves analyzing the contestants' answer log data. On one hand, it extracts the contestants' answer steps and their time series, and uses finite state machine analysis and normal distribution discriminant analysis to identify contestants with abnormalities in the answer process and to identify cheating behavior by using the solution ideas provided by other contestants. On the other hand, it extracts the submission time data of all contestants' question flags, and uses contestant correlation calculation to identify similar contestant pairs, thereby analyzing and tracing the source of contestant cheating and obtaining all suspicious contestants.

[0019] Step 3: Collect and analyze the multi-dimensional features of all suspicious contestants identified in Step 2. Collect the contestants' answer logs and problem-solving ideas in the new environment by notifying them to answer the questions again and submit a writeup. Compare and analyze the answer log data in Step 1 to identify cheating and punish them.

[0020] Beneficial effects

[0021] Compared to anti-cheating methods based on dynamically generated flags, this invention extracts the sequence and time of key steps in a contestant's answering process, and combines finite state machine and normal distribution models to detect abnormal answering behaviors from multiple angles to identify cheating behaviors such as copying others' ideas.

[0022] Compared to anti-cheating methods based on abnormal player behavior, this invention uses a player correlation calculation model to analyze the similarity of flag submission times, thereby enabling the analysis and tracing of the source of player cheating. Attached Figure Description

[0023] Figure 1 This is a schematic diagram illustrating the principle of the method for identifying and tracing various types of cheating in cybersecurity CTF competitions according to the present invention. Detailed Implementation

[0024] To better illustrate the purpose and advantages of the present invention, the implementation methods of the present invention will be further described in detail below.

[0025] The specific process is as follows:

[0026] Step 1: Real-time monitoring of the competition's answer sheet.

[0027] Step 1.1: After the contestants complete their registration, assign different flags to the questions each contestant needs to answer, and generate a Docker container as the answering environment;

[0028] Step 1.2: After a contestant requests to answer a question, obtain the browser version and IP address, compare them with the information at the time of registration, and analyze whether the contestant's answering environment is normal. For contestants who frequently change their environment or whose answering environment is abnormal, including those who change their browser more than 3 times, whose IP address is located in a different city, or whose IP address and browser version are the same as another contestant, it is believed that they are impersonating another contestant, and their request to answer a question is rejected.

[0029] Step 1.3: If another player's flag appears when a player attempts to submit the result, both the player who submitted the flag and the player from whom the flag originated will be judged as having cheated.

[0030] Step 1.4: During the contestant's answering process, log data containing the contestant's username, IP address, access cookie, question name, each HTTP message accessed during the answering process, and access time information is recorded to construct an answering log database.

[0031] Step 2, Analysis of the answer log.

[0032] Step 2.1: From the answer log database, on the one hand, extract the log data for each question to obtain the sending time of all HTTP messages for each contestant for that question, the request resource path of the GET method or the request resource path of the POST method in the message, and the request body data, and sort them in chronological order to form the contestant's answer steps and time data; on the other hand, extract the contestant logs to obtain the submission time data of all question flags for each contestant.

[0033] Step 2.2, Analysis of the Logical Reasonableness of the Answer. The sequence of contestant answer steps obtained in Step 2.1 {q1,q2,…,q} n}, where q represents the steps taken by the contestant, n is the number of steps in the problem, and the input is a pre-set finite state machine model M containing the solution to the problem, whose state transition function F is as shown in Equation 1.

[0034] F(s j ,a)=s j+1 (1)

[0035] Where s j s j+1 These represent the current state and the next state in the problem-solving process, where 'a' represents the state that leads to the current state 's'. j The transition condition refers to the key steps in the question-answering process. For example, if a contestant needs to first use step q to obtain the database password, then q is the condition that causes the current question to transition from the state of waiting for the database password to be entered. j The user has successfully logged in after entering the correct database password. j+1 A necessary condition for F(s), therefore F(s) j ,q)=s j+1 When the contestant's answer steps are sequentially input into M, if the state machine successfully transitions to the final state, it indicates that the answer process conforms to logical rules; otherwise, it indicates that the contestant's key steps are missing, i.e., there is a logical anomaly in the answer process, and the contestant is judged to have given a suspicious answer.

[0036] Step 2.3: Record the time taken for all key steps of the contestant in Step 2.2, and calculate the time taken for each key step: t = t2 - t1, where t1 is the time of the first request to the server in this step, and t2 is the time of the first request to the server in the next step.

[0037] Step 2.4, Analysis of the Reasonableness of Answering Time. The time taken for each key step in the answering process is statistically analyzed. All contestants' times should conform to a normal distribution. Samples with times significantly shorter than the average, i.e., contestants who answer too quickly, are considered to have reasoning that does not originate from independent thought and are marked as suspicious contestants.

[0038] Assuming that solving problem Q requires a key step q, and that the time taken by all contestants who answered correctly follows a normal distribution, the time distribution of the key step q can be obtained by fitting a normal curve as shown in Equation 2.

[0039]

[0040] Among them, t q Let μ be the time taken by all contestants to complete step q, where N is a normal distribution. q The mean of the fitted curve is . To determine the variance of the fitted curve, we analyze the time data for key steps obtained in step 2.4, specifically the answering time of contestant a in step q. If it appears It is believed that his answering time was much shorter than that of the average contestant, which raises suspicions.

[0041] Step 2.5, Contestant Correlation Analysis. Based on the flag submission time data for all contestants obtained in Step 2.1, the submission times of all questions between any two contestants should not conform to a normal distribution. Otherwise, it indicates that the contestants assisted each other in answering questions, resulting in a normal correlation between the question completion time and flag submission time. This is achieved by defining the time difference between contestant A and contestant B's submission results for the i-th question. It can be represented as Equation 3.

[0042]

[0043] in Let be the submission times of contestant a and contestant b for the i-th problem, respectively. Then, what is the average submission time difference between them? Equation 4, correlation degree sim ab Equation 5.

[0044]

[0045]

[0046] Where n is the size of the intersection of the questions submitted by the two contestants. When the correlation between contestants a and b is sim ab The larger the value, the more relevant their submission times are. By calculating the correlation between any two participants, we obtain the correlation data sim between each participant and (a,b). ab ;

[0047] Step 2.6, Suspicious contestant pair identification. On one hand, based on the contestant pair correlation data in Step 2.5, the 10% of contestant pairs (a,b) with the highest correlation are judged as suspicious; on the other hand, for the suspicious contestant a in Steps 2.2 and 2.4 with abnormal answering logic and answering time, the contestant b with the highest correlation among other contestants is selected as the source of the suspicious contestant's cheating, forming a suspicious contestant pair (a,b);

[0048] Step 3: Multi-dimensional analysis of suspicious candidates.

[0049] Step 3.1: Notify all suspected contestants via email to answer the specified questions again in the newly generated environment, and collect the contestants' Writeup documents, that is, collect the documents written by the contestants to record their problem-solving ideas and steps;

[0050] Step 3.2: Extract the author, modifier, and modification time information from all suspicious contestants' Writeup documents, calculate the hash value of all images in the document, and perform cross-comparison. If any item in a contestant's document information is the same as that of another contestant, it is considered abnormal.

[0051] Step 3.3: Calculate the minimum edit distance D between any two suspected contestants a and b in the Writeup documents submitted for the same question. ab If D ab Less than 15% of the shorter document length t, i.e., D ≤ 0.15min(len(t) a ),len(t b If the two contestants' writeups are similar, it is considered an anomaly.

[0052] Step 3.4: For the questioner's answers in this round of questioning, extract the sequence and time information of key steps in the same way as in steps 2.1, 2.2, 2.3, and 2.4, and compare it with the answer data from previous competition environments. Based on the abnormal answer types identified in step 2, perform the following analysis:

[0053] 1. If the answer logic is determined to be abnormal in step 2.2, but the logic of the answer process is correct in this instance, it is considered that the contestant realized that there was a problem with the steps in the first answer and it is determined to be abnormal.

[0054] 2. If step 2.4 determines that the answering speed is too fast, but the time for key steps in this answering process is more than twice the time of the first answer, then it is considered that the contestant's answering time in this answering process is the contestant's normal answering speed, and the first answering process was abnormal;

[0055] 3. For the top 10% of suspected contestants in step 2.6 with the highest correlation, focus on analyzing the similarity of their Writeup documents. Since two contestants exhibited plagiarism during their responses, they are more likely to have plagiarized Writeup documents compared to other contestants. Therefore, the minimum edit distance threshold is increased to 20%, i.e., if D ≤ 0.2min(len(t) a ),len(t b If )), then there is an anomaly.

[0056] Step 3.5: For contestants whose cross-matching results were generated in Step 3.2, whose Writeup results were similar in Step 3.3, and whose abnormal results were found in Step 3.4, the contestant information, two answer logs, key step information, reason for judgment, violation type information, and cheating source information are automatically organized, and a contestant cheating analysis report is output, and corresponding penalties are imposed.

[0057] The above detailed description further illustrates the purpose, technical solution, and beneficial effects of the invention. It should be understood that the above description is only a specific embodiment of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for identifying and tracing the source of various types of cheating in cybersecurity CTF competitions, characterized by... The method includes the following steps: Step 1: Monitor the contestants' answering process using logs, record the HTTP messages and time data of the contestants' answering process, and judge behaviors such as impersonating others or submitting flags of other contestants. Construct an answering process log database from the contestants' answering data. Step 2: Based on the contestant answer log data obtained in Step 1, extract the answer steps and times from all contestant logs. Analyze whether the sequence of key steps meets the problem-solving requirements using a finite state machine model to determine if the contestant has any abnormal answer logic. Fit the contestant answer time data using a normal distribution model to calculate the average and variance of the key step times for all contestants. Analyze whether the key step times for a contestant are much less than the average to identify cheating behavior by using problem-solving ideas provided by other contestants. At the same time, identify highly similar contestants by calculating the contestant correlation degree to analyze and trace the source of the contestant's cheating. Step 3 involves collecting and analyzing the multi-dimensional features of all suspicious contestants from Step 2. By notifying contestants to answer questions again and submit writeups, the contestants' answering behavior and problem-solving strategies in the new environment are collected. The answer log data from Step 1 is then compared and analyzed to identify cheating and impose penalties.

2. The method for identifying and tracing multiple types of cheating in cybersecurity CTF competitions according to claim 1, characterized in that: Step 2 proposes a formula for calculating the correlation between contestants. For cheating tracing analysis, this method comprehensively considers the average time difference between the two contestants' flag submissions and the time of each individual submission, calculating the correlation between their answer submissions and analyzing the distribution patterns of submission times. Players whose scores exceed the threshold are considered to have a connection.

3. The method for identifying and tracing multiple types of cheating in cybersecurity CTF competitions according to claim 1, characterized in that: In step 3, contestants whose answers were deemed suspicious are notified via email to retake the questions. The submitted writeups and answer data in the new environment are collected. On the one hand, the hash values ​​of images, document authors, and modification dates in the submitted writeups are used to build a database for cross-comparison. On the other hand, the order and interval of the steps for extracting the contestants' new answer data are compared with the previous answers to determine whether the contestants have cheated.

Images