Anti-cheating method, system, electronic device and medium for online live-action defense competition

Abstract

The present application provides an online real scene defense competition anti-cheating method, system, electronic equipment and medium, solves the technical problem that the existing online real scene defense competition cannot prevent potential cheating. The method comprises the following steps: accepting a submission request of a defense method document, detecting the legality of the submission request and the defense method document; obtaining a patched executable file from the received legal defense method document; parsing the executable file to obtain an abstract syntax tree resource; comparing the abstract syntax tree resource with an available command whitelist to determine whether there is an illegal intention; and running the executable file to perform defense environment patching when there is no illegal instruction. The potential harm to the fairness of the competition deployed on the cloud server can be avoided by avoiding the formation of targeted command combinations by the players according to the competition experience of the real scene defense competition scene. The problem of taking advantage of the situation can be effectively avoided, and the fairness of the competition is greatly maintained.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an anti-cheating method, system, electronic device, and medium for online real-world defense competitions. Background Technology

[0002] Cybersecurity competitions primarily test participants' cybersecurity response capabilities through attack and defense maneuvers. Real-world defense competitions present a new format by separating defense from the attack and defense process. Currently, real-world defense competitions are conducted in a local server-based environment. This local server is manually controlled, and the deployed defense environment is isolated from the internet, creating a local area network environment to ensure fair competition without external communication. However, due to the high cost of migrating and deploying local servers, cloud-based real-world defense competitions have gradually emerged. While cloud servers can build the competition environment in real time, they inevitably connect to the internet. This communication allows for the submission of solutions (patching methods and files), and the execution of special commands during patching process. This can expose vulnerabilities and attack traffic, allowing non-public competition information to be shared online. This provides participants with convenient access to solutions, compromising fairness and deviating from the original purpose of the competition. Summary of the Invention

[0003] In view of the above problems, embodiments of the present invention provide an anti-cheating method, system, electronic device and medium for online real-scene defense competitions, solving the technical problem that existing online real-scene defense competitions cannot defend against potential cheating.

[0004] The anti-cheating method for online real-world defense competitions according to embodiments of the present invention is characterized by comprising:

[0005] Accept submission requests for defense method documents and check the validity of the submission requests and defense method documents;

[0006] Obtain the patch executable from the received legitimate defense methodology documentation;

[0007] Parse executable files to obtain abstract syntax tree resources;

[0008] Compare the abstract syntax tree resources with the whitelist of available commands to determine if there is any illegal intent;

[0009] Run the executable file to patch the defense environment when no illegal instructions are found.

[0010] In one embodiment of the present invention, the method document includes an execution script or an executable program (exe) or application program (app) initialized with parameters.

[0011] In one embodiment of the present invention, the detection of the legitimacy of the submission request and the defense method document includes:

[0012] The identity of the contestant submitting the request is verified using the contestant's identity key. The defense method document verifies the signature formed by the identity key. The legitimacy of the data connection is verified using the terminal address allocation data in the connection.

[0013] In one embodiment of the present invention, the executable file is a set of executable scripts, and the script type includes VBScript, JavaScriptJscript, Shell script or Python script.

[0014] In one embodiment of the present invention, the abstract syntax tree resource includes:

[0015] The script content is parsed into an abstract syntax tree based on the script syntax rules to form an abstract syntax tree structure and structure content of instructions and instruction parameters; or the corresponding abstract syntax tree structure and structure content can be obtained by using the corresponding compiler.

[0016] In one embodiment of the present invention, the process of repairing the defensive environment includes:

[0017] Grant access to the real-world defense competition scenario, run the executable file, and patch the scenario environment parameters and resource configurations after the attack.

[0018] The anti-cheating system for online real-world defense competitions according to embodiments of the present invention includes:

[0019] A document inspection device is used to accept submission requests for defense method documents and to inspect the legitimacy of the submission requests and the defense method documents.

[0020] A document acquisition device for acquiring executable files for patching the defense environment from received legitimate defense method documents;

[0021] A document abstraction device used to parse executable files to obtain abstract syntax tree resources;

[0022] An intent recognition device is used to compare abstract syntax tree resources with a whitelist of available commands to determine whether an illegal intent exists.

[0023] A legitimate deployment device used to run executable files to patch the defense environment when no illegal instructions are present.

[0024] The electronic device of this invention includes:

[0025] Processor, memory, and interfaces for communication with the gateway;

[0026] The memory is used to store programs and data, and the processor calls the programs stored in the memory to execute the methods described above.

[0027] The computer-readable storage medium of this invention includes a program that, when executed by a processor, performs the method described above.

[0028] The anti-cheating method, system, electronic device, and medium for online real-world defense competitions in this invention can prevent contestants from developing targeted command combinations for real-world defense competition scenarios based on their competition experience. By utilizing the opportunity of submitting patching methods, it directly tests vulnerability points, obtains attack traffic, and directly analyzes the attack traffic to patch the problems more quickly and obtain higher scores. This eliminates the potential harm to the fairness of competitions deployed on cloud servers. It can effectively prevent cheating and greatly maintain the fairness of the competition. Attached Figure Description

[0029] Figure 1 The diagram shown is a flowchart illustrating an anti-cheating method for an online real-world defense competition according to an embodiment of the present invention.

[0030] Figure 2 The diagram shown illustrates the application process of an anti-cheating method for online real-world defense competitions according to an embodiment of the present invention.

[0031] Figure 3 The diagram shown is an architectural schematic of an anti-cheating system for an online real-world defense competition according to an embodiment of the present invention.

[0032] Figure 4 The diagram shown is a schematic diagram of the architecture of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the invention will be further described below in conjunction with the accompanying drawings and specific embodiments. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0034] An embodiment of the present invention provides an anti-cheating method for online real-world defense competitions, as follows: Figure 1 As shown. In Figure 1 In this embodiment, the following are included:

[0035] Step 100: Accept the submission request for the defense method document and check the legitimacy of the submission request and the defense method document.

[0036] The defense methodology document is submitted by the contestant to the cloud server deploying the real-world defense competition scenario. The defense methodology document includes, but is not limited to, resource documents and executable files for patching vulnerabilities in the defense scenario. Executable files include scripts or parameter-initialized executable programs (exe) or applications (app). Based on the submission request, the cloud server verifies the contestant's identity, the defense methodology document, and the legitimacy of the data connection. The contestant's identity can be verified using their identity key. The defense methodology document can be verified using a signature formed from the identity key. The legitimacy of the data connection can be verified using the terminal address allocation data in the connection.

[0037] Step 200: Obtain the executable file for patching the defense environment from the received legitimate defense method document.

[0038] In one embodiment of the present invention, the executable file is a set of executable scripts. The executable scripts are formed according to the type of browser, scene resource interpreter, or compiler in the real-world defense competition scenario. Examples include VBScript, JavaScript, Shell script, and Python script.

[0039] Step 300: Parse the executable file to obtain the abstract syntax tree resource.

[0040] As those skilled in the art will understand, an Abstract Syntax Tree (AST), or simply a syntax tree, is an abstract representation of the syntactic structure of source code. It represents the syntactic structure of a programming language in a tree-like format, where each node in the tree represents an instruction structure in the source code. Based on the script's syntax rules, the script content is parsed using an Abstract Syntax Tree to form an Abstract Syntax Tree structure and its contents, consisting of instructions and instruction parameters. For executable programs (exe) or application programs (app), the corresponding compiler obtains the corresponding Abstract Syntax Tree structure and its contents.

[0041] Step 400: Compare the abstract syntax tree resource with the whitelist of available commands to determine if there is any illegal intent.

[0042] The command whitelist comprises a set of commands authorized for execution in real-world defense competition scenarios. Each command consists of a corresponding set of instructions, including the constituent instructions and instruction parameter thresholds adapted to the rules of the real-world defense competition scenario. By comparing the whitelist with the command list, it is determined whether the executable file's execution logic contains any illegal instructions, instruction fragments, commands, or command parameters.

[0043] In one embodiment of the present invention, a command whitelist is constructed according to the executable file syntax rules corresponding to the real-world defense competition scenario. The executable file for answering the questions is parsed to form a syntax tree. The commands in the script are semantically compared and analyzed to restrict contestants from using available commands to perform illegal operations.

[0044] Step 500: If no illegal instructions are found, run the executable file to repair the defense environment in the real-world defense competition scenario.

[0045] If an illegal command is detected, the detection process for this defense will be terminated and the deployment and execution of executable files will be rejected.

[0046] The anti-cheating method for online real-world defense competitions in this invention avoids contestants developing targeted command combinations for real-world defense competition scenarios based on their experience. Instead, it directly tests vulnerability points and obtains attack traffic during the submission of patching methods. This allows for direct analysis of the attack traffic and faster patching of the problems, resulting in higher scores. This eliminates the potential harm to the fairness of competitions deployed on cloud servers. It effectively prevents cheating and greatly maintains the fairness of the competition.

[0047] An embodiment of the present invention applies the anti-cheating method for online real-world defense competitions as follows: Figure 2 As shown. During the application process, contestants submit documents related to defense methods. The real-world defense competition scenario deployed on the cloud server checks the legality of these documents. If legal, it downloads and decompresses the documents, parses the executable file to obtain the abstract syntax tree resource, and then uses a pre-defined whitelist of available commands to check the resource content. If it is determined that no illegal commands are contained, the real-world defense competition scenario is granted access, the executable file is run, and the scenario environment parameters and resource configurations are patched after the attack, making the real-world defense competition scenario meet the requirements for solving the competition questions. If illegal commands are found to be contained, the detection is terminated, and the real-world defense competition scenario defense process is marked with an alarm.

[0048] An embodiment of the present invention provides an anti-cheating system for online real-world defense competitions, such as... Figure 3 As shown. In Figure 3 In this embodiment, the following are included:

[0049] The document inspection device 10 is used to accept submission requests for defense method documents and to inspect the legality of the submission requests and the defense method documents.

[0050] Document acquisition device 20 is used to acquire executable files for patching the defense environment from received legitimate defense method documents;

[0051] Document abstraction device 30 is used to parse executable files to obtain abstract syntax tree resources;

[0052] Intent recognition device 40 is used to compare the abstract syntax tree resource with the available command whitelist to determine whether there is an illegal intent;

[0053] The legitimate deployment device 50 is used to run an executable file to patch the defense environment when no illegal instructions are present.

[0054] This application also provides a specific implementation of an electronic device capable of implementing all the steps in the methods described above. See [link to implementation details]. Figure 4 The electronic device 600 specifically includes the following:

[0055] Processor 610, memory 620, communication unit 630 and bus 640;

[0056] The processor 610, memory 620, and communication unit 630 communicate with each other via bus 640; the communication unit 630 is used to realize information transmission between server-side devices and terminal devices and other related devices.

[0057] The processor 610 is used to call the computer program in the memory 620. When the processor executes the computer program, it implements all the steps in the anti-cheating method of the online real-world defense competition in the above embodiments.

[0058] Those skilled in the art will understand that memory can be, but is not limited to, Random Access Memory (RAM), Read Only Memory (ROM), Programmable Read-Only Memory (PROM), Erasable Programmable Read-Only Memory (EPROM), and Electrically Erasable Programmable Read-Only Memory (EEPROM). The memory stores programs, which are then executed by the processor upon receiving execution instructions. Furthermore, the software programs and modules within the memory may include an operating system, which may include various software components and / or drivers for managing system tasks (e.g., memory management, storage device control, power management), and can communicate with various hardware or software components to provide an operating environment for other software components.

[0059] A processor can be an integrated circuit chip with signal processing capabilities. The aforementioned processor can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this application. The general-purpose processor can be a microprocessor or any conventional processor.

[0060] This application also provides a computer-readable storage medium including a program, which, when executed by a processor, is used to perform the anti-cheating method for online real-world defense competitions provided in any of the foregoing method embodiments.

[0061] Those skilled in the art will understand that all or part of the steps in the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks, and this application does not limit the specific type of media.

[0062] The above description is merely a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. An anti-cheating method for online real-world defense competitions, characterized in that, include: Accept submission requests for defense method documents and check the validity of the submission requests and defense method documents; Obtain the patch executable from the received legitimate defense methodology documentation; Parse executable files to obtain abstract syntax tree resources; Compare the abstract syntax tree resources with the whitelist of available commands to determine if there is any illegal intent; Run the executable file to patch the defense environment when no illegal instructions are found.

2. As described in claim 1, characterized in that, The method documentation includes execution scripts or parameter-initialized executable programs (exe) or applications (app).

3. The anti-cheating method for online real-world defense competitions as described in claim 1, characterized in that, The legitimacy of the detection submission request and the defense method document includes: The identity of the contestant submitting the request is verified using the contestant's identity key. The defense method document verifies the signature formed by the identity key. The legitimacy of the data connection is verified using the terminal address allocation data in the connection.

4. The anti-cheating method for online real-world defense competitions as described in claim 1, characterized in that, The executable file is a set of executable scripts, and the script types include VBScript, JavaScript, JScript, Shell script, or Pythonscript.

5. The anti-cheating method for online real-world defense competitions as described in claim 1, characterized in that, The abstract syntax tree resource includes: The script content is parsed into an abstract syntax tree based on the script syntax rules to form an abstract syntax tree structure and structure content of instructions and instruction parameters; or the corresponding abstract syntax tree structure and structure content can be obtained by using the corresponding compiler.

6. The anti-cheating method for online real-world defense competitions as described in claim 1, characterized in that, The aforementioned environmental remediation includes: Grant access to the real-world defense competition scenario, run the executable file, and patch the scenario environment parameters and resource configurations after the attack.

7. An anti-cheating system for online real-world defense competitions, characterized in that, include: A document inspection device is used to accept submission requests for defense method documents and to inspect the legitimacy of the submission requests and the defense method documents. A document acquisition device for acquiring executable files for patching the defense environment from received legitimate defense method documents; A document abstraction device used to parse executable files to obtain abstract syntax tree resources; An intent recognition device is used to compare abstract syntax tree resources with a whitelist of available commands to determine whether an illegal intent exists. A legitimate deployment device used to run executable files to patch the defense environment when no illegal instructions are present.

8. An electronic device, characterized in that, include: Processor, memory, and interfaces for communication with the gateway; The memory is used to store programs and data, and the processor invokes the programs stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium includes a program that, when executed by a processor, performs the method according to any one of claims 1 to 6.

Images