An anti-cheat AI algorithm ESP protection method for games

Abstract

This invention discloses a game anti-cheat AI algorithm ESP protection method that encrypts game speed, health, equipment, simulated mouse, mouse trajectory analysis, game character health bars, and provides protection against unlimited health bars. It also allows the client to support speed control, vulnerability patching, and extended encryption for unlimited health and unlimited equipment. This invention effectively prevents cheats from modifying and intruding into the game client, protecting the security and integrity of game data. AI behavior detection technology can identify abnormal behavior in real time, and features such as speed blocking systems and anti-simulated keyboard and mouse further increase the difficulty of cheat attacks. Multi-instance control and virtual machine detection measures reduce the scenarios in which cheats are used, and the image protection function effectively combats image-based AFK behavior. The entire protection mechanism combines data encryption, AI algorithms, and multi-dimensional protection controls to form a complete game anti-cheat solution, providing strong guarantees for the fairness and stability of the game.

Description

Technical Field

[0001] This invention relates to the field of game security technology, and more specifically to a game anti-cheat AI algorithm ESP protection method. Background Technology

[0002] Current anti-cheat technologies in games mainly focus on the following aspects:

[0003] Memory scanning and signature detection: By monitoring the game process memory, this method matches known cheat signature codes or data patterns to intercept suspicious operations. However, this method relies on real-time updates to the cheat signature database and is difficult to deal with dynamically changing new cheats.

[0004] Data verification and encryption: Simple encryption or verification is performed on critical game data (such as health and equipment attributes) to prevent direct memory tampering. However, existing encryption algorithms are not strong enough, and cheaters can bypass the protection through memory breakpoints and debugging tools. Especially for scenarios that require dynamically expanding values, such as "infinite health bars" and "infinite equipment," traditional encryption methods cannot support secure data expansion.

[0005] Behavioral pattern recognition: Based on rule engines or simple machine learning algorithms, it detects abnormal player behavior (such as excessive speed movement or high-frequency clicking). However, such methods lack self-learning capabilities, have insufficient accuracy in detecting complex cheating behaviors (such as simulating keyboard and mouse input or AFK farming), and are prone to false positives.

[0006] Engine vulnerability patching: Patches are applied to fix known vulnerabilities in the game engine. However, cheaters can exploit undisclosed vulnerabilities or the limitations of the engine's extended interfaces (such as fixed ranges of health values) to illegally bypass the game logic.

[0007] To address the issues of insufficient data encryption strength, delayed vulnerability patching, and limited behavior detection in existing technologies, this invention proposes an AI algorithm ESP protection method for game anti-cheat systems. This method can encrypt character and monster health bars to prevent cheat modifications, encrypt and draw independent infinite health bars, and also encrypt infinite equipment expansion, game speed, and game mouse movement trajectory. Combined with AI behavior recognition, it can effectively prevent game cheating. Summary of the Invention

[0008] In view of this, the present invention provides a method for protecting the AI ​​algorithm (ESP) in games against cheating.

[0009] To achieve the above objectives, the present invention provides the following technical solution, which mainly includes: a loading and initialization module, a data encryption and protection module, an AI behavior detection module, a vulnerability patching and extension module, a blocking and anomaly handling module, and a multi-dimensional protection and control module;

[0010] The loading and initialization module loads the ESP protection unit via SDK and DLL embedding. The unit file name is ESP-X32.DLL. After loading, it triggers the ESP-B version gateway protection mechanism and establishes a connection between the game client and the anti-cheat gateway Gameofesp.

[0011] The data encryption and protection module encrypts key data in the game, including game speed data, health values, equipment data, and mouse movement trajectory data. The health values ​​use an independently drawn infinite health bar encryption technology, and the equipment data uses an infinite expansion encryption technology.

[0012] The AI ​​behavior detection module introduces AI behavior simulation detection technology to analyze players' operational behavior in the game in real time and identify abnormal behavior patterns. The AI ​​behavior simulation detection technology is based on the AI ​​large model visual neural system and has self-learning ability.

[0013] The vulnerability patching and expansion module automatically detects and patches vulnerabilities in the game engine client, and also supports the expansion of game data, including health value expansion and equipment value expansion, to resist modification attacks by cheats.

[0014] The speed blocking and anomaly handling module: detects movement speed and attack speed in the game through the gateway speed blocking system, sets an abnormal accumulation value and handling strategy, and disconnects the player when an abnormal speed is detected.

[0015] In the AI ​​behavior detection, abnormal behavior patterns include, but are not limited to, high-frequency clicks in a short period of time, unnatural movement trajectories, and speed values ​​exceeding the game's set range. The AI ​​algorithm learns from the behavior data of normal players, establishes a behavior model, and compares and judges real-time operation data.

[0016] Preferably, the gateway speed blocking system includes movement speed detection and attack speed detection.

[0017] The multi-dimensional protection and control module includes an anti-simulated keyboard and mouse detection unit, a multi-instance control unit, a virtual machine detection unit, and an image protection unit. The anti-simulated keyboard and mouse detection unit identifies driver-level mouse simulations. The multi-instance control unit limits the number of game clients that can log in simultaneously based on the account or machine code. The virtual machine detection unit determines whether it is a virtual machine environment based on features such as CPU model, hard disk size, and shared folders. The image protection unit interferes with and detects image-based AFK behavior in the game.

[0018] Preferably, the anti-simulated keyboard and mouse detection includes detection of driver-level mouse emulation software such as AutoHotkey and large-scale plugins, supports setting a keyboard and mouse protection whitelist, performs compatibility settings for remote control software such as ToDesk and Sunflower, and enters a prohibited attack period by default.

[0019] Preferably, the multi-instance control function supports limiting the number of multi-instance instances based on the ESP account or machine code as an identifier, setting time intervals and multi-instance instance thresholds, and prohibiting new client logins when the set number is exceeded, and prompting the player.

[0020] Preferably, the virtual machine detection options include common options, robust options, and brute-force options. Common options detect virtual machines by CPU model name and shared folder. Robust options use CPUID + hard disk detection and network card MAC detection. Brute-force options determine the virtual machine environment by CPUID detection and hard disk size detection (less than or equal to 99GB). It also supports adding machine code whitelists to reduce false positives.

[0021] Preferably, the image protection options include detecting image binding, protecting character name styles, protecting NPC name styles, protecting monster name styles, and protecting underground item name styles, enabling the anti-foreground image offline function, blacking out some software screenshots of games, and supporting the setting of effective maps and machine code whitelists.

[0022] As can be seen from the above technical solutions, compared with existing technologies, the game anti-cheat AI algorithm ESP protection method provided by this invention can effectively prevent cheats from modifying and intruding into the game client, protecting the security and integrity of game data. AI behavior detection technology can identify abnormal behavior in real time, while features such as speed-blocking systems and anti-simulated keyboard and mouse further increase the difficulty of cheat attacks. Multi-instance control and virtual machine detection measures reduce the scenarios in which cheats are used, and the image protection function effectively combats image-based AFK behavior. The entire protection mechanism combines data encryption, AI algorithms, and multi-dimensional protection controls, forming a complete game anti-cheat solution that provides strong guarantees for the fairness and stability of the game. Detailed Implementation

[0023] The technical solutions of the present invention will be clearly and completely described below with reference to the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0024] The present invention discloses a game anti-cheat AI algorithm ESP protection method, which mainly includes: a loading and initialization module, a data encryption protection module, an AI behavior detection module, a vulnerability patching and extension module, a speed blocking and anomaly handling module, and a multi-dimensional protection control module;

[0025] The loading and initialization module loads the ESP protection unit via SDK and DLL embedding. The unit file name is ESP-X32.DLL. After loading, it triggers the ESP-B version gateway protection mechanism and establishes a connection between the game client and the anti-cheat gateway Gameofesp.

[0026] The data encryption and protection module encrypts key data in the game, including game speed data, health values, equipment data, and mouse movement trajectory data. The health values ​​use an independently drawn infinite health bar encryption technology, and the equipment data uses an infinite expansion encryption technology.

[0027] The AI ​​behavior detection module introduces AI behavior simulation detection technology to analyze players' operational behavior in the game in real time and identify abnormal behavior patterns. The AI ​​behavior simulation detection technology is based on the AI ​​large model visual neural system and has self-learning ability.

[0028] The vulnerability patching and expansion module automatically detects and patches vulnerabilities in the game engine client, and also supports the expansion of game data, including health value expansion and equipment value expansion, to resist modification attacks by cheats.

[0029] The speed blocking and anomaly handling module: detects movement speed and attack speed in the game through the gateway speed blocking system, sets an abnormal accumulation value and handling strategy, and disconnects the player when an abnormal speed is detected.

[0030] The multi-dimensional protection and control module includes an anti-simulated keyboard and mouse detection unit, a multi-instance control unit, a virtual machine detection unit, and an image protection unit. The anti-simulated keyboard and mouse detection unit identifies driver-level mouse simulations. The multi-instance control unit limits the number of game clients that can log in simultaneously based on the account or machine code. The virtual machine detection unit determines whether it is a virtual machine environment based on features such as CPU model, hard disk size, and shared folders. The image protection unit interferes with and detects image-based AFK behavior in the game.

[0031] The loading and initialization module loads the ESP-X32.DLL file via SDK and DLL embedding when the game engine starts. During loading, the ESP-B version gateway protection mechanism is triggered, and the anti-hacking gateway Gameofesp starts and establishes a communication connection with the game client. During gateway initialization, the authorization information and protection policies in the configuration file are read to ensure the normal operation of the protection module. For example, files such as esp.dll and ESP-X32.dll exist in the MirServer / Mir200 directory on the server side, and initialization settings are performed through ESP configuration and ESP authorization verification in the configuration file.

[0032] The data encryption protection module includes encryption for health and equipment: It encrypts the health bars of game characters and monsters using an independent encryption algorithm to generate encrypted health values, preventing cheat programs from directly accessing and modifying health data by modifying memory. Simultaneously, it implements an unlimited health bar expansion function, extending the health value to a larger range through the encryption algorithm. Even if cheat programs attempt to modify it, they will fail because the values ​​exceed expectations. Equipment data is also encrypted, including equipment attributes and quantity information, supporting unlimited equipment expansion and ensuring the security of equipment data.

[0033] Furthermore, speed and mouse trajectory encryption: Game speed data (including movement speed and attack speed) is encrypted during transmission to prevent cheats from modifying speed parameters to achieve acceleration. Mouse movement trajectory parameters such as coordinates, speed, and acceleration are collected and encrypted in real time, generating a unique trajectory feature code for subsequent AI behavior detection and anti-simulation keyboard and mouse detection.

[0034] The AI ​​behavior detection module is based on a large-scale AI visual neural network system. It trains and builds a normal behavior model by collecting a large amount of normal player operation data. Simultaneously, during game operation, it collects player operation data in real time, including mouse click positions, movement trajectories, key press frequencies, and skill release intervals. This data is input into the AI ​​algorithm for analysis and compared with the normal behavior model. When abnormal behavior patterns are detected (such as high-frequency clicks in a short period of time, unnatural movement trajectories, etc.), an early warning mechanism is triggered, and further protective measures are taken, such as logging, restricting operations, or disconnecting the connection.

[0035] The vulnerability patching and extension module is used to periodically scan the game engine client for vulnerabilities, identifying potential security vulnerabilities such as memory vulnerabilities and network protocol vulnerabilities. Once a vulnerability is discovered, the corresponding patch is automatically loaded to fix it, preventing cheat programs from exploiting the vulnerability. Simultaneously, it supports extending game data; for example, by modifying the game client's code and data structures, it can expand health and equipment values, providing a wider range of values ​​and enhancing the game's resistance to cheat modifications.

[0036] Movement speed detection: The movement speed detection function is enabled, with an abnormal accumulation value set to 20 (adjustable based on actual conditions). An enhanced movement speed calculation algorithm is used to intelligently determine whether the player's movement speed is normal. When the player is not moving, the abnormal accumulation value is 5; when moving, the abnormal accumulation value is 2; and during normal movement, it is 1. When an abnormal movement speed is detected (exceeding the set threshold), a disconnection operation is performed, and a prompt message is sent to the player: "Your movement speed is abnormal. Please do not use programs such as speed hacks!"

[0037] The attack speed detection also employs an enhanced attack speed calculation algorithm, with attack speed detection enabled and an abnormal accumulation value set to 20. When an abnormal attack speed is detected, the connection is disconnected and the player is prompted with "Your attack speed is abnormal; please do not use programs such as speed hacks!" To avoid false positives due to overly strict detection, adjustments can be made by entering parameters such as -16 in the global compensation setting.

[0038] The anti-keyboard and mouse emulation detection unit is used to enable anti-keyboard and mouse protection, detecting common driver-level mouse emulation software (such as AutoHotkey and large-scale plugins). In the advanced options, the strictest detection mechanism can be set, enabling enhanced mouse pointer protection. Simultaneously, to ensure compatibility with remote control software such as ToDesk and Sunflower, a default setting is implemented to enter a prohibited attack period when accessing these programs, avoiding false positives. Players can set a whitelist of character names to make exceptions for specific accounts.

[0039] Based on game operation needs, configure multi-instance control strategies. You can choose to limit the number of instances by using the ESP account as an identifier, setting a time range (e.g., 00:00 to 23:00 daily) and a threshold for the number of instances (e.g., allowing a maximum of 3 clients to log in simultaneously). When the number of clients a player attempts to log in exceeds the set value, new login requests are blocked, and the player is prompted that "the current account has reached the multi-instance limit." Simultaneously, it supports compatibility settings for multiple launcher versions and adding machine code whitelists for exception handling of specific devices.

[0040] Furthermore, the virtual machine detection unit provides multiple virtual machine detection options, including a common option, a robust option, and a brute-force option. Specifically, the common option determines whether it is a virtual machine environment by detecting the CPU model name and shared folders; the robust option uses CPUID + hard disk detection and network card MAC detection to improve detection accuracy; the brute-force option strictly identifies virtual machines by detecting CPUID and hard disk size (less than or equal to 99GB), which has strong detection capabilities but may have some false positives. Players can choose the appropriate detection option according to their actual situation and add machine codes to the whitelist to reduce false positives.

[0041] Furthermore, the image protection unit is used to enable image protection functionality, interfering with and detecting image-based AFK (away from keyboard) behavior in the game. This includes detecting image bindings and protecting the styles of character names, NPC names, monster names, and underground item names to prevent cheat programs from automatically AFKing by recognizing image information. It also enables anti-foreground image-based offline AFK functionality, blacking out screenshots taken by certain software to prevent them from obtaining game screen information. It supports setting the effective map, enabling image protection only in specific maps, and adding machine code whitelists to disable anti-screenshot functionality on specific devices.

[0042] Through the specific implementation methods described above, this invention effectively prevents cheat programs from modifying and intruding into the game client, protecting the security and integrity of game data. AI behavior detection technology can identify abnormal behavior in real time, while features such as speed-blocking systems and anti-simulated keyboard and mouse controls further increase the difficulty of cheat attacks. Multi-instance control and virtual machine detection measures reduce the scenarios in which cheat programs can be used, and the image protection function effectively combats image-based AFK (away from keyboard) behavior. The entire protection mechanism combines data encryption, AI algorithms, and multi-dimensional protection controls, forming a complete anti-cheat solution for games, providing strong guarantees for the fairness and stability of the game.

[0043] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for protecting game anti-cheat AI algorithms (ESP), characterized in that, include: Loading and initialization module, data encryption and protection module, AI behavior detection module, vulnerability patching and extension module, blocking speed and exception handling module, multi-dimensional protection and control module; The loading and initialization module loads the ESP protection unit via SDK and DLL embedding. The unit file is named ESP-X32.DLL. After loading, it triggers the ESP-B version gateway protection method and establishes a connection between the game client and the anti-cheat gateway Gameofesp. The data encryption and protection module encrypts key data in the game, including game speed data, health values, equipment data, and mouse movement trajectory data. The health values ​​use an independently drawn infinite health bar encryption technology, and the equipment data uses an infinite expansion encryption technology. The AI ​​behavior detection module introduces AI behavior simulation detection technology to analyze players' operational behavior in the game in real time and identify abnormal behavior patterns. The AI ​​behavior simulation detection technology is based on the AI ​​large model visual neural system and has self-learning ability. The vulnerability patching and expansion module automatically detects and patches vulnerabilities in the game engine client, and also supports the expansion of game data, including health value expansion and equipment value expansion, to resist modification attacks by cheats. The speed blocking and anomaly handling module: detects movement speed and attack speed in the game through the gateway speed blocking system, sets an abnormal accumulation value and handling strategy, and disconnects the player when an abnormal speed is detected. In the AI ​​behavior detection, abnormal behavior patterns include high-frequency clicks in a short period of time, unnatural movement trajectories, and speed values ​​that exceed the game's set range. The AI ​​algorithm learns from the behavior data of normal players, builds a behavior model, and compares and judges real-time operation data. The multi-dimensional protection and control module includes an anti-simulated keyboard and mouse detection unit, a multi-instance control unit, a virtual machine detection unit, and an image protection unit. The anti-simulated keyboard and mouse detection unit identifies driver-level mouse simulations. The multi-instance control unit limits the number of game clients that can log in simultaneously based on the account or machine code. The virtual machine detection unit determines whether it is a virtual machine environment by using the CPU model, hard disk size, and shared folder characteristics. The image protection unit interferes with and detects image-based AFK behavior in the game.

2. The game anti-cheat AI algorithm ESP protection method according to claim 1, characterized in that, The gateway speed blocking system includes movement speed detection and attack speed detection.

3. The game anti-cheat AI algorithm ESP protection method according to claim 1, characterized in that, Anti-simulated keyboard and mouse detection includes detection of driver-level mouse emulation software, supports setting a keyboard and mouse protection whitelist, compatibility settings for remote control software, and enters a prohibited attack period by default.

4. The game anti-cheat AI algorithm ESP protection method according to claim 1, characterized in that, The multi-instance control function supports limiting the number of instances based on the ESP account or machine code, setting time intervals and thresholds for the number of instances, and prohibiting new client logins when the set number is exceeded, and prompting the player.

5. The game anti-cheat AI algorithm ESP protection method according to claim 1, characterized in that, The virtual machine detection options include common options, robust options, and brute-force options. Common options detect virtual machines by CPU model name and shared folders. Robust options use CPUID + hard disk detection and network card MAC detection. Brute-force options use CPUID detection and hard disk size detection to determine the virtual machine environment. It also supports adding machine code whitelists to reduce false positives.

6. The game anti-cheat AI algorithm ESP protection method according to claim 1, characterized in that, Image protection options include detecting image binding, protecting character name styles, protecting NPC name styles, protecting monster name styles, and protecting underground item name styles. It also enables the function to prevent foreground image binding from running offline, black screen processing for some software screenshots of the game, and supports setting effective map and machine code whitelists.