Cloud computing-based cloud game vulnerability analysis monitoring system

Abstract

This invention discloses a cloud gaming vulnerability analysis and monitoring system based on cloud computing, relating to the field of game vulnerability analysis technology. The system includes a game monitoring module, an intelligent aggregation module, and a resource scheduling module. The game monitoring module collects performance parameters and interaction parameters of game instances through a lightweight monitor, and calculates anomaly frequency, coefficient of determination, kurtosis, and temporal anomalies using multidimensional modeling and statistical analysis. Based on this, it performs comprehensive calculations to generate risk assessment values ​​and screen suspicious targets. The intelligent aggregation module performs similarity calculations and undirected graph clustering on suspicious targets and their risk parameters to aggregate scattered suspicious targets into vulnerability analysis tasks. The resource scheduling module calculates an evidence collection index based on parameters such as task size, latency, average risk, and similarity. Based on the evidence collection index, it allocates vulnerability analysis tasks to parallel analysis lines in an isolated analysis cluster for execution, thereby achieving in-depth forensics and dynamic detection.

Description

Technical Field

[0001] This invention relates to the field of game vulnerability analysis technology, and in particular to a cloud gaming vulnerability analysis and monitoring system based on cloud computing. Background Technology

[0002] Cloud gaming vulnerabilities refer to security flaws or configuration errors existing in cloud rendering, streaming media transmission, session management, game image or operation, etc. Attackers can exploit these flaws to bypass authentication, inject or tamper with media streams, hijack sessions, execute remote code, gain unauthorized access to storage or sideload malicious images. The harms include not only theft of user accounts, loss of virtual assets and privacy leaks, but also game cheating and unfairness, service interruption and performance degradation, supply chain contamination and large-scale lateral movement, compliance and legal risks, and serious damage to brand reputation, ultimately leading to direct economic losses and long-term loss of user trust; therefore, vulnerability analysis in cloud gaming is particularly important.

[0003] When current cloud gaming involves in-depth vulnerability analysis (such as dynamic taint analysis), its sophisticated analysis methods introduce huge performance overhead at the instruction level, creating an irreconcilable resource competition with the real-time performance pursued by cloud gaming, thus affecting the gaming experience on the player's end. Summary of the Invention

[0004] Therefore, it is necessary to provide a cloud gaming vulnerability analysis and monitoring system based on cloud computing to address the issues mentioned in the background technology.

[0005] The objective of this invention can be achieved through the following technical solution: a cloud gaming vulnerability analysis and monitoring system based on cloud computing, comprising: a game monitoring module, an intelligent aggregation module, and a resource scheduling module;

[0006] The game monitoring module performs in-depth analysis on the collected behavioral data of game instances to output filtered suspicious targets and their corresponding metadata.

[0007] The intelligent aggregation module categorizes and aggregates suspicious targets and their corresponding metadata to form several vulnerability analysis tasks;

[0008] The resource scheduling module performs priority parsing based on each vulnerability analysis task to dynamically control the priority of each vulnerability analysis task and schedule the task.

[0009] In some embodiments, behavioral data includes performance parameters and interaction parameters, wherein the performance parameters include CPU utilization, GPU utilization, memory utilization, uplink traffic, and downlink traffic at each acquisition time; and the interaction parameters include mouse movement trajectory and mouse click behavior distributed along the mouse trajectory.

[0010] In some embodiments, the process of screening suspicious targets is as follows:

[0011] The game monitoring module has a built-in performance monitoring unit and an interactive monitoring unit. The performance monitoring unit constructs multi-dimensional risk characteristics based on performance parameters for CPU, GPU, memory, and traffic ratios to output the frequency of anomalies.

[0012] The interactive monitoring unit analyzes mouse trajectories, click behaviors, and temporal anomaly states based on interactive parameters to output the coefficient of determination, kurtosis, and temporal anomaly values.

[0013] The game monitoring module then calculates the risk assessment value by formulating the abnormal frequency, output determination coefficient, kurtosis, and time-series outlier. If the risk assessment value is greater than or equal to the risk assessment threshold, the game instance is marked as a suspicious target, and the abnormal frequency, determination coefficient, kurtosis, and time-series outlier are used as risk parameters of the suspicious target. The game instance ID, timestamp, and risk parameters of the suspicious target are extracted as metadata of the suspicious target.

[0014] In some embodiments, the abnormal frequency output process is as follows:

[0015] Divide the uplink traffic by the downlink traffic to obtain the transmission symmetry ratio. Then, take the CPU utilization, GPU utilization, memory utilization, and transmission symmetry ratio values ​​at each acquisition time to construct a four-dimensional super cuboid. Multiply the four parameters to obtain the volume V of the four-dimensional super cuboid. Sort the volumes V at each acquisition time according to the order of acquisition time. There is a preset abnormal volume threshold. If the volume is greater than or equal to the abnormal volume threshold, the acquisition time is marked as an abnormal time. Traverse all acquisition times, count the number of abnormal times, divide it by the total number of acquisition times, and then multiply by 100% to obtain the abnormal frequency.

[0016] In some embodiments, the determination coefficient output process is as follows:

[0017] Extract the mouse trajectory and the mouse click behaviors distributed along the trajectory. Resample the mouse trajectory into N trajectory points with equal arc lengths, place the mouse trajectory in a coordinate system, and calculate the acceleration of each trajectory point to obtain the acceleration A of each trajectory point. n and coordinates (x) n y n ), where n=1,2,3……N, n is the index of any trajectory point; extract the coordinates of N trajectory points, plot them on a blank coordinate axis, and use the N trajectory points to perform linear regression to fit the straight line that is closest to or best represents the overall trend of this trajectory, which is the best fitting line. The equation of the straight line is y=kx+b, where k and b are constants.

[0018] Calculate the coefficient of determination R using the following formula. 2 The calculation formula is:

[0019] (1)

[0020] (2)

[0021] (3) .

[0022] In some embodiments, the kurtosis output process is as follows:

[0023] Arrange the accelerations of each trajectory point in sequence to obtain the acceleration sequence {A} n} Calculate the fourth central moment m4, the second central moment m2, and the kurtosis g of the acceleration sequence using the following formulas. 2 The formula for calculating kurtosis is:

[0024] (1)

[0025] (2)

[0026] (3) .

[0027] In some embodiments, the timing outlier output process is as follows:

[0028] The mouse clicks distributed along the mouse trajectory are arranged in sequence to obtain the click sequence; the time interval between two adjacent clicks is calculated to obtain the click interval sequence; the mean of each time interval in the click interval sequence is calculated to obtain the interval mean; the variance of the click interval sequence is calculated and denoted as S; the standard deviation of the click interval sequence is calculated and divided by the interval mean to obtain the coefficient of variation and denoted as D; the maximum and minimum values ​​of the preset uniform distribution are Cmin and Cmax; the significance probability P of the click sequence is estimated using the KS test based on the set maximum and minimum values ​​of the uniform distribution Cmin and Cmax; then the variance S, coefficient of variation D, and significance probability P are used to calculate the time series outlier Q according to the formula:

[0029]

[0030] Where k s This is a scaling constant.

[0031] In some embodiments, the classification aggregation process is as follows:

[0032] For any two suspicious targets i and j, i ≠ j, where i and j are the indices of the two suspicious targets respectively, calculate the similarity of their risk parameters sim(i, j).

[0033] With a preset association threshold, all suspicious targets are treated as nodes to construct an undirected graph. For any two nodes i and j, if sim(i,j) ≤ association threshold, then an edge is formed between the two nodes. Thus, all two nodes that meet the association requirements are connected to identify the connected subgraphs in the undirected graph. Each connected subgraph is a vulnerability analysis task. In this way, all suspicious targets can be aggregated and classified into several vulnerability analysis tasks and sent to the resource scheduling module.

[0034] In some embodiments, the priority resolution process is as follows:

[0035] Step 1: Based on each vulnerability analysis task, perform parameter parsing to obtain task parameters, which include the number of subtasks, final latency, average risk, and average similarity of the vulnerability analysis task.

[0036] Step 2: Calculate and output the evidence collection index based on the task parameters, and then queue the data accordingly.

[0037] The evidence collection index of the vulnerability analysis task is obtained by formulating the number of subtasks, final latency, average risk and average similarity of the vulnerability analysis task. The vulnerability analysis tasks are arranged in descending order of their corresponding evidence collection indices to obtain the vulnerability analysis task sequence. Steps three and four are executed sequentially for each vulnerability analysis task until all vulnerability analysis tasks have completed the vulnerability analysis.

[0038] Step 3: Pre-set an isolated analysis cluster consisting of multiple parallel vulnerability analysis lines. The number of pending subtasks for each vulnerability analysis line is obtained in real time, and the vulnerability analysis lines are sorted in ascending order of the number of pending subtasks to obtain the line sequence.

[0039] Step 4: Sort the subtasks in the vulnerability analysis task in descending order of their corresponding relative delays to obtain a subtask sequence. Select the subtasks in sequence and assign them to the vulnerability analysis line ranked first in the line sequence. Increase the number of unprocessed subtasks on the vulnerability analysis line by one and update it in real time to step 3. Repeat steps 3 and 4 until all subtasks in the vulnerability analysis task are completed, and return to step 1.

[0040] In some embodiments, the task parameter acquisition process is as follows:

[0041] Extract the number of subtasks for each vulnerability analysis task and the timestamp corresponding to each subtask, calculate the relative latency by comparing each timestamp with the current system time, and select the largest relative latency as the final latency of the vulnerability analysis task.

[0042] The risk average is calculated by averaging the risk assessment values ​​of each subtask. Then, each subtask is divided into several association groups according to its relationship. The similarity average is calculated by averaging the similarity between two subtasks in all association groups.

[0043] Compared with the prior art, the beneficial effects of the present invention are:

[0044] This invention uses a lightweight monitor to continuously collect performance and interaction parameters of cloud gaming instances. Based on this, it constructs multi-dimensional risk features based on CPU, GPU, memory, and traffic ratios. Combined with the comprehensive judgment of mouse trajectory, click behavior, and statistical time series anomalies, it can initially screen out suspicious targets and their corresponding metadata, which can effectively improve efficiency and provide reliable input for subsequent vulnerability analysis.

[0045] This invention uses a lightweight monitor to continuously collect performance and interaction parameters of cloud gaming instances. Based on this, it constructs multi-dimensional risk features based on CPU, GPU, memory, and traffic ratios. Combined with the comprehensive judgment of mouse trajectory, click behavior, and statistical time series anomalies, it can initially screen out suspicious targets and their corresponding metadata, which can effectively improve efficiency and provide reliable input for subsequent vulnerability analysis.

[0046] This invention uses a lightweight monitor to continuously collect performance and interaction parameters of cloud gaming instances. Based on this, it constructs multi-dimensional risk features based on CPU, GPU, memory, and traffic ratios. Combined with a comprehensive judgment of mouse trajectory, click behavior, and statistical time series anomalies, it can initially screen out suspicious targets and their corresponding metadata, which can effectively improve efficiency and provide reliable input for subsequent vulnerability analysis. Attached Figure Description

[0047] To more clearly illustrate the technical solutions in the embodiments of this application or the conventional technology, the drawings used in the description of the embodiments or the conventional technology will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0048] Figure 1 This is a schematic diagram of the system module connections of the present invention. Detailed Implementation

[0049] To make the above-mentioned objects, features, and advantages of the present invention more apparent and understandable, specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Many specific details are set forth in the following description to provide a thorough understanding of the present invention. However, the present invention can be practiced in many other ways different from those described herein, and those skilled in the art can make similar modifications without departing from the spirit of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0050] When current cloud gaming involves in-depth vulnerability analysis (such as dynamic taint analysis), its sophisticated analysis methods introduce huge performance overhead at the instruction level, creating an irreconcilable resource competition with the real-time performance pursued by cloud gaming, thus affecting the gaming experience on the player's end.

[0051] like Figure 1 As shown, in order to solve the above technical problems, a cloud gaming vulnerability analysis and monitoring system based on cloud computing is proposed, including: a game monitoring module, an intelligent aggregation module, and a resource scheduling module; the game monitoring module has a built-in performance monitoring unit and an interaction monitoring unit.

[0052] The game monitoring module communicates with a deployed lightweight monitor to collect behavioral data of game instances on a large scale and continuously, and performs preliminary screening to output suspicious targets and their corresponding metadata. It should be noted that a game instance refers to an isolated virtual computing unit temporarily created for a single player (or a single game session) on the backend of the cloud gaming platform, containing a complete game runtime environment. It runs only for this player on the server in the cloud data center and streams the video and audio to the player's device over the network.

[0053] The initial screening process is as follows:

[0054] A lightweight monitor is deployed in the operating kernel of each game instance. This monitor is not an independent process, but a set of processes injected into the kernel program through advanced kernel technology. It is directly established with the game monitoring module through an efficient inter-kernel communication mechanism, maintaining low performance overhead.

[0055] Behavioral data from game instances is extracted, including performance parameters and interaction parameters. Performance parameters include CPU usage, GPU utilization, memory usage, uplink traffic, and downlink traffic at each collection point. Interaction parameters include mouse movement trajectories and mouse clicks distributed along those trajectories. It's important to note that abnormal resource usage often indicates that the game instance is not only running the game but also additional computational programs (such as cheats, mining trojans, or hacking tools). Normal cloud gaming should have a high downlink and low uplink transmission pattern. If this pattern is not observed, it means the game instance may be transmitting data externally (such as stealing game assets, recording videos, or acting as a network proxy or relay). The mouse movement of a real player in a game instance is a smooth curve with randomness, while the movement of a machine (i.e., a cheat) is often a perfect straight line, instantaneous lock-on, or with extremely high-frequency micro-jitter (aiming lock). The mouse click intervals of a real player in a game instance follow a normal distribution, while the click intervals of a machine are more uniform.

[0056] The performance monitoring unit performs in-depth analysis based on performance parameters to output the frequency of anomalies, specifically:

[0057] Divide the uplink traffic by the downlink traffic to obtain the transmission symmetry ratio. Then, take the values ​​of CPU utilization, GPU utilization, memory utilization, and transmission symmetry ratio at each acquisition time (i.e., multiply each parameter by 100) to construct a four-dimensional super cuboid. Multiply the four parameters to obtain the volume V of the four-dimensional super cuboid. It should be noted that the larger the V value, the greater the risk of anomalies at that acquisition time. CPU utilization, GPU utilization, and memory utilization are percentages, ranging from 0% to 100% (i.e., 1). The transmission symmetry ratio (uplink / downlink) is a decimal much smaller than 1 under normal circumstances. If the product of the four parameters is calculated directly without processing, the entire volume V will be very small, which is not conducive to observation and judgment. Multiplying the four parameters by 100 makes the calculated volume V easier to manage and monitor.

[0058] The volumes V at each collection time are sorted according to the order of collection time. An abnormal volume threshold is preset. It should be noted that the abnormal volume threshold defines a boundary of normal behavior. It is a numerical boundary calculated by statistical analysis methods (such as taking the 99th percentile) based on all volume V values ​​collected from a large number of game instances during the system's historical normal operation. If the volume is greater than or equal to the abnormal volume threshold, it indicates that there is a non-negligible abnormal risk, and the collection time is marked as an abnormal time. All collection times are traversed, the number of abnormal times is counted, and the abnormal frequency is obtained by dividing it by the total number of collection times and multiplying it by 100%.

[0059] The interactive monitoring unit performs in-depth interactive analysis based on mouse trajectories and mouse click behaviors distributed along those trajectories to output kurtosis and temporal outliers; specifically:

[0060] Extract the mouse trajectory and the mouse click behaviors distributed along the trajectory. Resample the mouse trajectory into N trajectory points with equal arc lengths. Place the mouse trajectory in a coordinate system and calculate the acceleration of each trajectory point to obtain the acceleration A of each trajectory point. n and coordinates (x) n y n ), where n=1,2,3……N, n is the index of any trajectory point; extract the coordinates of N trajectory points, plot them on a blank coordinate axis, and use the N trajectory points to perform linear regression to fit the straight line that is closest to or best represents the overall trend of this trajectory, which is the best fitting line. The equation of the straight line is y=kx+b, where k and b are constants.

[0061] Calculate the coefficient of determination R using the following formula. 2 It represents the proportion of variance explained, and its value ranges from (-∞, 1]. The closer it is to 1, the better the fit, and the closer the trajectory is to a straight line of a function. The calculation formula is:

[0062] (1)

[0063] (2)

[0064] (3)

[0065] Arrange the accelerations of each trajectory point in sequence to obtain the acceleration sequence {A} n} Calculate the fourth central moment m4, the second central moment m2, and the kurtosis g of the acceleration sequence using the following formulas. 2 The peak value is the fourth moment describing the shape of a probability distribution. It measures the tail weight and peak sharpness of the data distribution compared to a normal distribution. Specifically, it measures the contribution of extreme values ​​(amplified to the fourth power) to the dispersion (variance) of the data distribution. While the muscle movements of a real player's arm and wrist may involve unconscious tremors, their acceleration distribution generally still approximates a normal distribution. The excessive kurtosis will fluctuate around 0, without extreme positive values. In this case, the kurtosis g... 2 Approximately equal to zero or slightly greater than zero; when an external cheat (such as auto-aiming headlock) is running, it produces an extremely abnormal acceleration pattern: most of the time it is fine-tuning or stationary (acceleration is 0 or very small), but at the moment of locking onto a target, it produces an extremely high and extremely short acceleration spike, which statistically forms an extreme value; since the kurtosis is calculated to the fourth power, these huge values ​​are significantly amplified, causing the value of m4 to increase sharply, at which point the peak value g 2It will become a very large positive number, perfectly reflecting the heavy-tailed characteristic of the data distribution, that is, the appearance of extreme acceleration values ​​far exceeding the normal range; the formula for calculating kurtosis is:

[0066] (1)

[0067] (2)

[0068] (3)

[0069] The click sequence is obtained by arranging the mouse clicks distributed along the mouse trajectory in order; the time interval between two adjacent clicks is calculated to obtain the click interval sequence; the mean of each time interval in the click interval sequence is calculated to obtain the interval mean; the variance of the click interval sequence is calculated and denoted as S. The click intervals of real players fluctuate and have a large variance; the click intervals of auto-clickers or scripts are almost completely consistent, with an exceptionally low variance; the standard deviation of the click interval sequence is calculated, and then divided by the interval mean to obtain the coefficient of variation, denoted as D. This is a standardized dispersion index, more suitable for comparing sequences with different average click speeds. The coefficient of variation will be within a relatively stable range (e.g., 0.2-0.5), while the machine's coefficient of variation will approach 0; the preset maximum and minimum values ​​of the uniform distribution are Cmin and Cmax, which are set according to the behavioral characteristics of the plug-in; the click sequence is estimated using the KS test based on the set maximum and minimum values ​​of the uniform distribution Cmin and Cmax. The higher the significance probability, the more uniform the distribution, and the more it tends to be mechanical clicking, which is suspected to be an automated script; the variance S, coefficient of variation D, and significance probability P are used to calculate the time series outlier Q according to the formula:

[0070]

[0071] Where k s The scaling constant is used to adjust the influence of variance S, and those skilled in the art take its value as 0.01. The higher the significance probability, the larger the time series outlier; the smaller the coefficient of variation, the larger the time series outlier; the smaller the variance S, the smaller the denominator, and the closer the factor is to 1, the larger the time series outlier; the larger S, the larger the denominator, and the closer the factor is to 0, the smaller Q. This formula ensures that the Q value is between 0 and 1, and simultaneously considers the uniformity of distribution (P), relative dispersion (D), and absolute variance (S). When only one indicator is abnormal, it will not lead to a particularly high final time series outlier Q, effectively preventing false alarms. Only when three strong pieces of evidence—uniform distribution, low relative dispersion, and small absolute variance—appear simultaneously will it be judged as high risk. This is precisely the most typical and most difficult-to-imitate feature of an automated script.

[0072] The abnormal frequency f and the coefficient of determination R2 kurtosis g 2 The risk assessment value W is calculated based on the time series outlier Q using the following formula:

[0073]

[0074] Only the non-negative part is taken. Specifically: if ≤0, then =0, if >0, then = λ is the kurtosis adjustment constant, with a value of 10. -4 The higher the anomaly frequency f, the higher the risk assessment value; the higher the kurtosis, the higher the risk assessment value; the higher the time-series outlier, the higher the risk assessment value. In this formula, the anomaly frequency is expressed as a percentage and divided by 100 to normalize it; the coefficient of determination R... 2 Quantizing it using a monotonically increasing function, if the coefficient of determination R 2 The closer the value is to 1, the more linear the mouse trajectory, and the better it conforms to the machine's automatic script. The coefficient of determination R for the monotonically increasing function is... 2 The closer the behavior is to 1, the higher the corresponding risk judgment value; negative kurtosis indicates that the distribution is flatter than the normal distribution, the events are scattered and not explosive, therefore, this factor contributes ln(1)=0, resulting in the overall risk W=0. This shows that the formula only punishes explosive behaviors; using the natural logarithm ln() to compress the kurtosis achieves a marginal effect, preventing the risk judgment value from expanding indefinitely, thus making the model more robust; this formula indicates that only when high frequency, high explosiveness and anomalousness are present simultaneously will the risk judgment value be very high. If any one of these factors is zero or very small, the final risk judgment value will be greatly suppressed, greatly reducing misjudgment and improving the screening quality;

[0075] A risk assessment threshold is preset. It should be noted that this threshold is determined by statistically analyzing the distribution of risk assessment values ​​among normal game instances in the cloud gaming environment, using the 95th percentile as the threshold value. (The 95th percentile is a numerical value representing that at least 95% of the risk assessment values ​​among all normal game instances are less than or equal to this value, while at most 5% are greater than or equal to it.) If a risk assessment value is greater than or equal to the risk assessment threshold, it indicates that the game instance has a significant abnormal risk. The game instance is then marked as a suspicious target, and the anomaly frequency f and the coefficient of determination R are set accordingly. 2 kurtosis Time-series outliers are used as risk parameters for suspicious targets; the game instance ID, timestamp (game instance session creation time), and risk parameters of suspicious targets are extracted as metadata for suspicious targets; if the risk judgment value is less than the risk judgment threshold, the game instance is marked as a normal game instance and no further processing is required;

[0076] By using a lightweight monitor to continuously collect performance and interaction parameters of cloud gaming instances, and constructing multi-dimensional risk characteristics based on CPU, GPU, memory, and traffic ratios, combined with a comprehensive judgment of mouse trajectory, click behavior, and statistical time series anomalies, suspicious targets and their corresponding metadata can be initially screened out. This can effectively improve efficiency and provide reliable input for subsequent vulnerability analysis.

[0077] The intelligent aggregation module performs correlation analysis based on all suspicious targets and their corresponding metadata to classify and aggregate all suspicious targets, and then sends the classification and aggregation results to the resource scheduling module. This method of classifying and aggregating suspicious targets is more efficient than the currently prevalent isolated analysis. The correlation analysis specifically involves:

[0078] For any two suspicious targets i and j, where i ≠ j, and i and j are the indices of the two suspicious targets respectively, calculate the similarity of their risk parameters sim(i, j). The specific calculation formula is as follows:

[0079] In the similarity calculation formula, the relative differences of the four risk parameters are calculated one by one and then multiplied to the fourth power, which is to calculate the geometric mean of the risk parameters. This means that the overall similarity sim(i,j) will approach 0 only when the parameters in all four dimensions are very similar. If the parameters in any one dimension are significantly different, the overall similarity value will tend to 1.

[0080] A pre-set association threshold is used. It should be noted that in this application scenario, the technical personnel will set the association threshold to 0.2. All suspicious targets are treated as nodes, and an undirected graph is constructed. For any two nodes i and j, if sim(i,j) ≤ the association threshold, it indicates that the vulnerability methods between i and j are highly similar, and an edge is formed between the two nodes. This process connects all two nodes that satisfy the association requirement (i.e., sim(i,j) ≤ association threshold), identifying connected subgraphs in the undirected graph. Each connected subgraph is a vulnerability analysis task. It should be noted that each node in a vulnerability analysis task is treated as a subtask; therefore, the number of subtasks in a vulnerability analysis task is ≥1. When a node does not satisfy the association requirement with any other node, the vulnerability analysis task only includes this one subtask. Thus, all suspicious targets can be aggregated and classified into several vulnerability analysis tasks, which are then sent to the resource scheduling module.

[0081] By calculating the similarity between suspicious targets and their risk parameters, and using an undirected graph classification and aggregation method, all suspicious targets are aggregated and split to form several vulnerability analysis tasks. It can automatically identify highly similar attack patterns, quickly build vulnerability task groups, realize the efficient transformation from scattered data to the overall task, improve task processing efficiency, and reduce the waste of analysis resources.

[0082] The resource scheduling module offloads received vulnerability analysis tasks to a dedicated isolated analysis cluster for deep vulnerability analysis, thus avoiding performance issues on the business host; specifically:

[0083] Step 1: Obtain task parameters by parsing the parameters of each vulnerability analysis task;

[0084] Extract the number of subtasks for each vulnerability analysis task, denoted as n, and the timestamp corresponding to each subtask. Calculate the relative delay by comparing each timestamp with the current system time. Select the largest relative delay as the final delay of the vulnerability analysis task and denot it as T. It should be noted that the larger the final delay, the higher the priority it should be.

[0085] The risk average is calculated by averaging the risk assessment values ​​of each subtask, denoted as H. Then, each subtask is divided into several association groups according to its relationship with other subtasks. The similarity average is calculated by averaging the similarity between any two subtasks (nodes) in all association groups, denoted as F. For example, if the subtasks of the vulnerability analysis task are B1, B2, B3, and B4, where B1 and B2 are related, B1 and B4 are related, B2 and B3 are related, and B3 and B4 are related, then their corresponding association groups are (B1, B2), (B1, B4), (B2, B3), and (B3, B4).

[0086] Step 2: Calculate and output the evidence collection index based on the task parameters, and then queue the data accordingly.

[0087] The forensics index of the vulnerability analysis task is calculated using the formula based on the number of subtasks n, the final latency T, the average risk H, and the average similarity F.

[0088] (1)

[0089] (2)

[0090] Where n max For reference task volume, its value is the largest number of subtasks in the history of cloud gaming, T. refThe reference latency is set to the highest historical final latency in cloud gaming; η is the saturation adjustment coefficient, used to control the rate at which the evidence collection index Z increases with G, η > 0; through the calculation of the intermediate value G, it can be seen that the larger the scale of the vulnerability analysis task (larger n), the higher the latency (larger T), the higher the similarity (smaller F), and the higher the risk (larger H), the larger the corresponding intermediate value G; the evidence collection index adopts the standard exponential function saturation model, mapping the intermediate value G to the range [0,1). When G is very small, Z grows almost linearly with G. When G is large, the growth rate of Z slows down and gradually approaches 1; the saturation adjustment coefficient η controls the transition speed of the curve from linear growth to saturation; this formula transforms an unbounded intermediate value G into a fixed, interpretable priority range of [0,1), making the priority ranking more stable; the vulnerability analysis tasks are arranged in descending order of their corresponding evidence collection indices to obtain the vulnerability analysis task sequence, and each vulnerability analysis task is selected in turn to execute steps three and four until all vulnerability analysis tasks have completed vulnerability analysis;

[0091] Step 3: A pre-defined isolated analysis cluster is established, consisting of multiple parallel vulnerability analysis lines. Each line runs a trained vulnerability analysis model and analysis tool to perform in-depth forensics and dynamic analysis on suspicious targets selected and isolated by the intelligent aggregation module. The number of pending subtasks for each vulnerability analysis line is obtained in real time, and the vulnerability analysis lines are sorted in ascending order of the number of pending subtasks to obtain the line sequence.

[0092] Step 4: Sort the subtasks in the vulnerability analysis task in descending order of their corresponding relative delays to obtain a subtask sequence. Select the subtasks in sequence and assign them to the vulnerability analysis line ranked first in the line sequence. Increase the number of unprocessed subtasks on the vulnerability analysis line by one and update it in real time to step 3. Repeat steps 3 and 4 until all subtasks in the vulnerability analysis task are completed, and return to step 1.

[0093] By parsing task parameters and analyzing and calculating the forensic index, which comprehensively considers the number of subtasks, maximum latency, average risk, and similarity, the forensic index is generated and sorted accordingly. A dynamic load balancing algorithm is used to distribute tasks in parallel to a dedicated isolated analysis cluster for vulnerability analysis and processing, thereby achieving reasonable task scheduling and dynamic priority control to ensure that high-risk and high-time-efficiency tasks are processed first.

[0094] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0095] The formula described above is an example of an empirical formula defined by an expert in the field. Any formula that conforms to the relationship between the parameters of this application is acceptable. The specific size of the weighting factors in the formula shall be reasonably set by a person skilled in the art based on actual use.

[0096] The above embodiments merely illustrate several implementation methods of the present invention, and their descriptions are relatively specific and detailed, but they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these all fall within the protection scope of the present invention. Therefore, the protection scope of this invention patent should be determined by the appended claims.

Claims

1. A cloud gaming vulnerability analysis and monitoring system based on cloud computing, characterized in that, include: Game monitoring module, intelligent aggregation module, resource scheduling module; The game monitoring module performs in-depth analysis on the collected behavioral data of game instances to output filtered suspicious targets and their corresponding metadata. The process for screening suspicious targets is as follows: The game monitoring module has a built-in performance monitoring unit and an interactive monitoring unit. The performance monitoring unit constructs multi-dimensional risk characteristics based on performance parameters for CPU, GPU, memory, and traffic ratios to output the frequency of anomalies. The interactive monitoring unit analyzes mouse trajectories, click behaviors, and temporal anomaly states based on interactive parameters to output the coefficient of determination, kurtosis, and temporal anomaly values. The game monitoring module then calculates the anomaly frequency f and the coefficient of determination R. 2 kurtosis g 2 The risk assessment value W is calculated based on the time series outlier Q using the following formula: ;in This indicates that only the non-negative part is taken, where λ is the kurtosis adjustment constant. If the risk assessment value is greater than or equal to the risk assessment threshold, the game instance is marked as a suspicious target, and the anomaly frequency, coefficient of determination, kurtosis, and time-series outlier are used as risk parameters of the suspicious target; the game instance ID, timestamp, and risk parameters of the suspicious target are extracted as metadata of the suspicious target; The intelligent aggregation module categorizes and aggregates suspicious targets and their corresponding metadata to form several vulnerability analysis tasks; The resource scheduling module performs priority parsing based on each vulnerability analysis task to dynamically control the priority of each vulnerability analysis task and schedule the task.

2. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 1, characterized in that, Behavioral data includes performance parameters and interaction parameters. Performance parameters include CPU utilization, GPU utilization, memory utilization, uplink traffic, and downlink traffic at each collection time. Interaction parameters include mouse movement trajectory and mouse click behavior distributed along the mouse trajectory.

3. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 2, characterized in that, Abnormal frequency output process: Divide the uplink traffic by the downlink traffic to obtain the transmission symmetry ratio. Then, take the CPU utilization, GPU utilization, memory utilization, and transmission symmetry ratio values ​​at each acquisition time to construct a four-dimensional super cuboid. Multiply the four parameters to obtain the volume V of the four-dimensional super cuboid. Sort the volumes V at each acquisition time according to the order of acquisition time. There is a preset abnormal volume threshold. If the volume is greater than or equal to the abnormal volume threshold, the acquisition time is marked as an abnormal time. Traverse all acquisition times, count the number of abnormal times, divide it by the total number of acquisition times, and then multiply by 100% to obtain the abnormal frequency.

4. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 3, characterized in that, Determination coefficient output process: Extract the mouse trajectory and the mouse click behaviors distributed along the trajectory. Resample the mouse trajectory into N trajectory points with equal arc lengths, place the mouse trajectory in a coordinate system, and calculate the acceleration of each trajectory point to obtain the acceleration A of each trajectory point. n and coordinates (x) n y n ), where n=1,2,3……N, n is the index of any trajectory point; extract the coordinates of N trajectory points, plot them on a blank coordinate axis, and use the N trajectory points to perform linear regression to fit the straight line that is closest to or best represents the overall trend of this trajectory, which is the best fitting line. The equation of the straight line is y=kx+b, where k and b are constants. Calculate the coefficient of determination R using the following formula. 2 The calculation formula is: （1） （2） （3） 。 5. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 4, characterized in that, Kurtosis output process: Arrange the accelerations of each trajectory point in sequence to obtain the acceleration sequence {A} n } Calculate the fourth central moment m4, the second central moment m2, and the kurtosis g of the acceleration sequence using the following formulas. 2 The formula for calculating kurtosis is: （1） （2） （3） 。 6. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 5, characterized in that, Timing outlier output process: The mouse clicks distributed along the mouse trajectory are arranged in sequence to obtain the click sequence; the time interval between two adjacent clicks is calculated to obtain the click interval sequence; the mean of each time interval in the click interval sequence is calculated to obtain the interval mean; the variance of the click interval sequence is calculated and denoted as S; the standard deviation of the click interval sequence is calculated and divided by the interval mean to obtain the coefficient of variation and denoted as D; the maximum and minimum values ​​of the preset uniform distribution are Cmin and Cmax; the significance probability P of the click sequence is estimated using the KS test based on the set maximum and minimum values ​​of the uniform distribution Cmin and Cmax; then the variance S, coefficient of variation D, and significance probability P are used to calculate the time series outlier Q according to the formula: Where k s This is a scaling constant.

7. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 1, characterized in that, The classification and aggregation process is as follows: For any two suspicious targets i and j, i ≠ j, where i and j are the indices of the two suspicious targets respectively, calculate the similarity of their risk parameters sim(i, j). With a preset association threshold, all suspicious targets are treated as nodes to construct an undirected graph. For any two nodes i and j, if sim(i,j) ≤ association threshold, then an edge is formed between the two nodes. Thus, all two nodes that meet the association requirements are connected to identify the connected subgraphs in the undirected graph. Each connected subgraph is a vulnerability analysis task. In this way, all suspicious targets can be aggregated and classified into several vulnerability analysis tasks and sent to the resource scheduling module.

8. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 1, characterized in that, The priority resolution process is as follows: Step 1: Based on each vulnerability analysis task, perform parameter parsing to obtain task parameters, which include the number of subtasks, final latency, average risk, and average similarity of the vulnerability analysis task. Step 2: Calculate and output the evidence collection index based on the task parameters, and then queue the data accordingly. The evidence collection index of the vulnerability analysis task is obtained by formulating the number of subtasks, final latency, average risk and average similarity of the vulnerability analysis task. The vulnerability analysis tasks are arranged in descending order of their corresponding evidence collection indices to obtain the vulnerability analysis task sequence. Steps three and four are executed sequentially for each vulnerability analysis task until all vulnerability analysis tasks have completed the vulnerability analysis. Step 3: Pre-set an isolated analysis cluster consisting of multiple parallel vulnerability analysis lines. The number of pending subtasks for each vulnerability analysis line is obtained in real time, and the vulnerability analysis lines are sorted in ascending order of the number of pending subtasks to obtain the line sequence. Step 4: Sort the subtasks in the vulnerability analysis task in descending order of their corresponding relative delays to obtain a subtask sequence. Select the subtasks in sequence and assign them to the vulnerability analysis line ranked first in the line sequence. Increase the number of unprocessed subtasks on the vulnerability analysis line by one and update it in real time to step 3. Repeat steps 3 and 4 until all subtasks in the vulnerability analysis task are completed, and return to step 1.

9. The cloud gaming vulnerability analysis and monitoring system based on cloud computing according to claim 8, characterized in that, Task parameter acquisition process: Extract the number of subtasks for each vulnerability analysis task and the timestamp corresponding to each subtask, calculate the relative latency by comparing each timestamp with the current system time, and select the largest relative latency as the final latency of the vulnerability analysis task. The risk average is calculated by averaging the risk assessment values ​​of each subtask. Then, each subtask is divided into several association groups according to its relationship, and the similarity average is calculated by averaging the similarity between two subtasks in all association groups.

Images