Automatic testing method, system and equipment for simulating malicious recharging and medium

Abstract

The invention is suitable for the technical field of computers, and provides an automatic testing method for simulating malicious recharging, which comprises the following steps: collecting historical recharging data, performing clustering analysis on the historical recharging data through an unsupervised learning algorithm, and constructing a recharging knowledge base; based on the recharge knowledge base, constructing a three-dimensional attack simulation space, and generating a malicious recharge test scene in the three-dimensional attack space; in the game test environment, the malicious recharging test scene is converted into test flow, and the test flow is injected into a game recharging system; state change monitoring is carried out in the game recharging system, and a response sequence is generated; and evaluating the game recharging system based on the response sequence, thereby improving the test dimension from a single attack dimension to a multi-dimension linkage three-dimensional level, enabling the test of the game recharging system to systematically cover a cross-dimension cooperative attack scene, and remarkably improving the coverage rate and effectiveness of the test.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and in particular relates to an automated testing method, system, device and medium for simulating malicious recharge. Background Technology

[0002] With the rapid development of the gaming industry, in-game recharge systems have become an important source of revenue for game developers and operators. However, the frequent occurrence of malicious recharge behavior has seriously threatened the economic balance of games and the interests of developers.

[0003] Current game security testing technologies mainly rely on manual or simple automated testing tools for in-game purchase security testing. These methods cannot fully cover all possible malicious purchase methods, are prone to overlooking potential security vulnerabilities, and have low levels of intelligence, lacking the ability to learn autonomously and generate new test cases, making it difficult to cope with constantly changing malicious purchase methods.

[0004] Therefore, there is an urgent need for a method that can simulate malicious recharge methods from multiple dimensions for testing recharge systems. Summary of the Invention

[0005] This application provides an automated testing method, system, device, and medium for simulating malicious recharge, which can solve one of the above-mentioned problems in the prior art.

[0006] In a first aspect, embodiments of this application provide an automated testing method for simulating malicious top-ups, including: Collect historical recharge data, perform cluster analysis on the historical recharge data using an unsupervised learning algorithm, and construct a recharge knowledge base. The historical recharge data includes data generated by normal recharge behavior and abnormal recharge behavior. Based on the aforementioned recharge knowledge base, a three-dimensional attack simulation space is constructed, and malicious recharge test scenarios are generated in the three-dimensional attack space. In the game testing environment, the malicious recharge test scenario is transformed into test traffic, and the test traffic is injected into the game recharge system; The system monitors status changes and generates response sequences within the game recharge system. The game recharge system is evaluated based on the response sequence.

[0007] Furthermore, the collected historical recharge data is clustered using an unsupervised learning algorithm to construct a recharge knowledge base. The historical recharge data includes both normal and abnormal recharge behaviors, including: Multi-dimensional raw data is collected from game servers, payment gateways, and client devices. The multi-dimensional raw data includes payment transaction data, user operation behavior sequence data, and device environment fingerprint data. The multidimensional raw data is cleaned, denoised, normalized, and correlated and aligned to form standardized behavioral flow data; Based on the standardized behavioral flow data, static and dynamic features are extracted to construct a behavioral profile. At the same time, feature abstraction is performed on equipment information to generate an equipment risk profile. The characteristics of the behavioral profile and the device risk profile are represented as feature vectors, and corresponding metadata is attached and stored in the recharge database.

[0008] Furthermore, the construction of the behavioral profile includes: Based on static and dynamic features, a Gaussian mixture model is used to perform density estimation and clustering of normal recharge behavior to form a normal user behavior profile, which includes multiple behavior cluster centers. The isolated forest algorithm is used to detect outliers based on the standardized behavioral flow data. The detected outliers are then clustered in a second stage to determine malicious behavior patterns and form malicious behavior feature clusters.

[0009] Furthermore, based on the recharge knowledge base, a three-dimensional attack simulation space is constructed, and malicious recharge test scenarios are generated in the three-dimensional attack space, including: Based on the aforementioned recharge knowledge base, feature vectors are extracted from three dimensions: payment data, user behavior sequences, and device information, to construct a three-dimensional attack simulation space. In the three-dimensional attack simulation space, the malicious behavior feature cluster is sampled in a targeted manner to generate a target feature vector. The target feature vector is then input into a pre-trained CGAN model to generate a malicious attack scenario. In the three-dimensional attack simulation space, based on the normal user behavior profile, data perturbation is performed to generate hybrid attack scenarios; By combining the malicious attack scenarios and the hybrid attack scenarios, a test scenario set is generated, and each malicious recharge test scenario in the test scenario set is equipped with a corresponding malicious intent.

[0010] Furthermore, in the game testing environment, converting the malicious recharge test scenario into test traffic and injecting the test traffic into the game recharge system includes: Based on the malicious recharge test scenario, combined with the pre-configured simulation engine, a specific protocol stack is selected for adaptation, and the corresponding client behavior model and protocol rules are loaded. Based on the client behavior model and the protocol rules, network data packets for test traffic are generated. When generating the network data packet, the session context is dynamically dimensioned and updated, and the session context includes the user session token, transaction serial number, and client status identifier. The network data packets are injected into the game recharge system, and timing disturbances are introduced, including network latency disturbances, request interval disturbances, and packet reordering and packet loss retransmission.

[0011] Furthermore, the step of monitoring status changes and generating a response sequence in the game recharge system includes: Security probes are deployed at key business logic nodes in the game recharge system to collect system status data. The key business logic nodes include request entry gateways, business logic services, data layers, and external service call boundaries. A globally unique tracking identifier is attached to the system status data, and all monitoring data of the same malicious recharge test scenario are associated to form a response sequence.

[0012] Furthermore, the evaluation of the game recharge system based on the response sequence includes: The system status data is compared with the preset malicious intent. From the three dimensions of business consistency, data integrity and logical completeness, it is determined whether the actual response of the game recharge system has reached the abnormal state corresponding to the malicious recharge test scenario. If an abnormal state is reached, the propagation process of system state data in the response sequence is analyzed to identify vulnerabilities in the game recharge system. These vulnerabilities are then associated with the malicious recharge test scenario to generate a test report.

[0013] Secondly, embodiments of this application provide an automated testing system for simulating malicious top-ups, comprising: The first processing module is used to collect historical recharge data, perform cluster analysis on the historical recharge data through an unsupervised learning algorithm, and build a recharge knowledge base. The historical recharge data includes data generated by normal recharge behavior and abnormal recharge behavior. The second processing module is used to construct a three-dimensional attack simulation space based on the recharge knowledge base, and generate malicious recharge test scenarios in the three-dimensional attack space. The third processing module is used to convert the malicious recharge test scenario into test traffic in the game test environment and inject the test traffic into the game recharge system. The fourth processing module is used to monitor status changes in the game recharge system and generate response sequences. The fifth processing module is used to evaluate the game recharge system based on the response sequence.

[0014] Thirdly, embodiments of this application provide a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the above-described automated testing method for simulating malicious recharge.

[0015] Fourthly, embodiments of this application provide a computer-readable storage medium, including a computer program stored in the computer-readable storage medium, which, when executed by a processor, implements the aforementioned automated testing method for simulating malicious recharge.

[0016] The beneficial effects of the embodiments in this application compared with the prior art are: This application discloses an automated testing method for simulating malicious recharge, integrating three types of data: payment transaction data, user operation behavior sequences, and device environment fingerprints. This covers multi-dimensional information such as behavior trajectory, transaction attributes, and device characteristics, eliminating the limitations of a single data source. Simultaneously, it constructs behavioral profiles and device risk profiles for the testing process, and uses these to generate malicious recharge test scenarios. This allows the test to cover both known and unknown attacks. Furthermore, by constructing a three-dimensional attack simulation space based on payment data, user behavior sequence, and device information dimensions, the testing dimension is elevated from a single attack dimension to a multi-dimensional, interconnected three-dimensional level. This enables the testing of game recharge systems to systematically cover cross-dimensional collaborative attack scenarios, significantly improving the coverage and effectiveness of the test. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart illustrating an automated testing method for simulating malicious recharge, provided by an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of an automated testing system for simulating malicious recharge provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0019] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0020] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0021] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0022] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0023] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0024] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0025] Please see Figure 1 As shown, this invention is an automated testing method for simulating malicious recharge, comprising the following steps: S100. Collect historical recharge data, perform cluster analysis on the historical recharge data using an unsupervised learning algorithm, and construct a recharge knowledge base. The historical recharge data includes data generated by normal recharge behavior and abnormal recharge behavior. This application integrates three types of data: payment transaction data, user operation behavior sequence, and device environment fingerprint, thereby covering multi-dimensional information such as behavior trajectory, transaction attributes, and device characteristics, and eliminating the limitations of a single data source.

[0026] In some embodiments, step S100 above includes: Multi-dimensional raw data is collected from game servers, payment gateways, and client devices. The multi-dimensional raw data includes payment transaction data, user operation behavior sequence data, and device environment fingerprint data. The multidimensional raw data is cleaned, denoised, normalized, and correlated and aligned to form standardized behavioral flow data; Based on the standardized behavioral flow data, static and dynamic features are extracted to construct a behavioral profile. At the same time, the device information in the device environment fingerprint data is abstracted to generate a device risk profile. The characteristics of the behavioral profile and the device risk profile are represented as feature vectors, and corresponding metadata is attached and stored in the recharge database.

[0027] In this embodiment, multi-dimensional raw data is collected from the game server, payment gateway, and client devices. The multi-dimensional raw data includes payment transaction data, user operation behavior sequence data, and device environment fingerprint data. Specifically, the payment transaction data comes from the order system of the payment gateway and the game server, and includes order ID, amount, currency type, payment status, payment channel, and timestamp. The user operation behavior sequence data comes from the logs of the client devices and the session records of the game server, and includes ordered events such as login, logout, browsing the store, selecting goods, initiating payment, and receiving items. The device environment fingerprint data is collected by the client devices through SDK to obtain data including device model, operating system, IP address and geographical location, and application client version.

[0028] Furthermore, the aforementioned multi-dimensional raw data undergoes cleaning, noise reduction, normalization, and correlation alignment processing to form standardized behavioral flow data. Specifically, missing values ​​in the multi-dimensional raw data are processed, while obviously invalid data is removed. Data from different sources under the same user in the same session are aligned and merged using a unified session ID or user ID to form a complete "behavioral flow". At the same time, features of different dimensions, such as amount and operation interval, need to be standardized to eliminate differences between values ​​and ensure data standardization. For example, in one embodiment, the series of discrete events of user with user ID UID-123 in Session-A, namely "login from iPhone device with IP-BJ -> browse 648 yuan gift pack -> initiate payment through Alipay -> payment successful -> receive 6480 diamonds", are associated into a standardized behavioral flow data with time sequence.

[0029] More specifically, static and dynamic features are extracted from the standardized behavioral data to construct behavioral profiles. Static features include the user's total historical recharge amount and commonly used payment channels, while dynamic features include the frequency of operations within the real-time session, the distribution of recharge amounts, and the average time taken from "selecting a product" to "initiating payment".

[0030] More specifically, feature abstraction is performed on device-related data in the device environment fingerprint data to generate a device risk profile. Specifically, a device fingerprint is generated based on the device model, operating system, and IP address to identify the device's uniqueness. Simultaneously, the proportion of a device associated with malicious behavior across all historical sessions, as well as the variability of the device environment, are calculated to assess its stability. Specifically, the frequency of the device fingerprint in historical malicious behavior records is calculated to determine the device's malicious behavior score. Furthermore, a risk score for the device environment is determined by combining the device's IP change frequency and the matching of IMEI and IMSI. Here, IMEI (International Mobile Equipment Identity) is the device's unique hardware identifier, and IMSI (International Mobile Subscriber Identity) is the user's identity identifier. By checking whether the device's IMEI and IMSI match, it is determined whether there is a risk of device theft or tampering. If they match completely, the device identity matching score is 1; if they do not match, the device identity matching score is 0. Therefore, the risk score = a × device malicious behavior score + b × IP change frequency + c × device identity matching score, where a, b, and c represent weighting coefficients, and a + b + c = 1.

[0031] More specifically, various characteristic information of the device, such as the user's historical payment amount, payment amount deviation, and IP geographical stability, are constructed into a device feature vector. For example, for a device, its device feature vector can be represented as [Payment amount: 648, Payment amount deviation: +498, Operation sequence entropy: 0.2, IP geographical stability: low]. Furthermore, the above device feature vector is combined with risk scores and basic device information to generate a device risk profile. The basic device information includes, but is not limited to, device fingerprint, device model, and operating system. It can be understood that the device risk profile can be presented in the form of text, charts, or structured data to intuitively display the risk status and characteristics of the device.

[0032] More specifically, the representations in the behavioral profile and the device risk profile are all high-dimensional feature vectors. At the same time, rich metadata is attached to each high-dimensional feature vector and stored in the recharge knowledge base. This knowledge base serves as the data foundation for subsequent test scenarios. In some embodiments, the metadata includes timestamps, confidence weights, and frequency of occurrence. Moreover, the recharge knowledge base can learn in real time from new data and test feedback, and has the ability to continuously evolve.

[0033] In some embodiments, the construction of the behavioral profile includes: Based on static and dynamic features, a Gaussian mixture model is used to perform density estimation and clustering of normal recharge behavior to form a normal user behavior profile, which includes multiple behavior cluster centers. The isolated forest algorithm is used to detect outliers based on the standardized behavioral flow data. The detected outliers are then clustered in a second stage to determine malicious behavior patterns and form malicious behavior feature clusters.

[0034] In this embodiment, static and / or dynamic features generated by historical normal recharge behavior are filtered from standardized behavioral transaction data. Based on these static and dynamic features, a Gaussian mixture model is trained. In the Gaussian mixture model, it is assumed that the normal behavior data of users is composed of several Gaussian distributions, i.e., "behavioral clusters". The Gaussian mixture model can classify users into different clusters and give the probability of belonging to each cluster, thereby outputting multiple behavioral profiles of "typical normal users". Each profile is defined by the cluster center and the covariance matrix. Specifically, in training the Gaussian mixture model, the model parameters are initialized, such as the number of Gaussian distributions, the mean of each Gaussian distribution, the covariance matrix, and the mixing coefficients. The number of Gaussian distributions can be determined according to business needs and data. The model is configured according to its characteristics, and during training, the parameters are continuously adjusted through the Expectation-Maximization algorithm to optimize the model's fit to the data. Specifically, the Expectation-Maximization algorithm consists of an expectation step and a maximization step. In the expectation step, the posterior probability of each data point belonging to each Gaussian distribution is calculated based on the current model parameters. In the maximization step, the model parameters, including the mean, covariance matrix, and mixing coefficients, are updated based on the posterior probabilities calculated in the expectation step. Thus, the trained Gaussian mixture model can perform density estimation on normal recharge behavior data, that is, calculate the probability density of each data point under different Gaussian distributions. At the same time, based on the posterior probability of each data point belonging to each Gaussian distribution, the data points are assigned to the cluster corresponding to the Gaussian distribution with the highest probability, thereby achieving data clustering.

[0035] More specifically, after clustering using the Gaussian mixture model, the normal recharge behavior data is divided into multiple clusters. The center of each cluster, which is the mean of all data points in that cluster, is calculated as the behavior cluster center. The behavior cluster center represents the typical characteristics of this type of normal user behavior. For example, a certain behavior cluster center may correspond to "high-frequency small-amount recharge users", whose characteristics include a high operation frequency and a small average distribution of recharge amount.

[0036] Furthermore, multiple behavioral cluster centers and their related feature information are integrated to form a normal user behavior profile. This profile is stored in the form of structured data, such as JSON or database tables, to record the central features of each behavioral cluster, the number of data points, and other parameter information. At the same time, visualization technology can be used to display the distribution of behavioral cluster centers and data in the form of charts, making it easier to intuitively understand and analyze the behavioral patterns of normal users. Furthermore, the parameter information of each cluster in the normal user behavior profile is represented as a high-dimensional feature vector and stored in the recharge knowledge base.

[0037] More specifically, a feature is randomly selected from the standardized behavioral flow data. Then, a split value is randomly selected between the maximum and minimum values ​​of the feature. The data space corresponding to the feature is divided into two subspaces. The above random division process is repeated for each subspace until the subspace contains only one data point or reaches the preset maximum depth of the tree, thus constructing an isolation tree. For each feature in the standardized behavioral flow data, multiple isolation trees are constructed using the above method to form an isolation forest. It can be understood that the construction process of each tree is independent and uses different random subsamples. In addition, the features in the standardized behavioral flow data are specifically the above-mentioned static features and dynamic features.

[0038] Furthermore, for each data point in the standardized behavioral pipeline data, its path length across all isolated trees in the isolated forest is calculated. This is typically measured by the number of edges along the path from the root node to the leaf node containing the data point. Anomaly scores for each data point are then calculated based on these path lengths. Specifically, the anomaly score is calculated using the following formula: Where s(x, n) represents the anomaly score of data point x, n represents the total number of data points, E(h(x)) represents the average path length of data point x on all isolation trees, and c(n) represents the average path length of n data points, which is used to normalize the anomaly score. It can be understood that the closer the anomaly score is to 1, the more likely the data point is to be an anomaly; the closer it is to 0, the more likely the data point is to be a normal point.

[0039] Furthermore, based on a preset outlier threshold, data points with abnormal scores exceeding the outlier threshold are marked as outliers. Simultaneously, secondary clustering is performed on each outlier to determine malicious behavior patterns. For example, in one embodiment, the K-Means algorithm is used for secondary clustering, dividing each outlier into K different clusters, where each cluster represents a possible malicious behavior pattern. Thus, each cluster and its contained outliers are defined as a malicious behavior feature cluster. For each malicious behavior feature cluster, statistical information of its static and dynamic features, such as mean, variance, maximum value, and minimum value, is extracted to describe the feature information of the malicious behavior pattern. For example, for a malicious recharge behavior feature cluster, the mean and variance of its recharge amount distribution, the maximum and minimum values ​​of the operation frequency, etc., can be extracted. Based on the extracted feature information, a detailed description is generated for each malicious behavior feature cluster, such as "fraudulent payment feature cluster", "data tampering feature cluster", and "conditional race attack feature cluster". In some embodiments, it can also be described according to the type of malicious behavior, such as fraudulent recharge cluster, malicious order brushing cluster, etc., or according to the feature performance, such as high-frequency large-amount recharge cluster, abnormal operation sequence cluster, etc., or according to the impact of malicious behavior, such as damage to the platform economy, interference with other users, etc.

[0040] S200. Based on the recharge knowledge base, construct a three-dimensional attack simulation space, and generate a malicious recharge test scenario in the three-dimensional attack space; In this application, behavioral profiles and device risk profiles are constructed for the testing process, and malicious recharge test scenarios are generated based on these profiles. This enables the test to cover both known and unknown attacks. Furthermore, by constructing a three-dimensional attack simulation space based on payment data, user behavior sequence, and device information dimensions, the testing dimension is elevated from a single attack dimension to a multi-dimensional, interconnected three-dimensional level. This allows the testing of the game recharge system to systematically cover cross-dimensional collaborative attack scenarios, significantly improving the coverage and effectiveness of the test.

[0041] In some embodiments, step S200 above includes: Based on the aforementioned recharge knowledge base, feature vectors are extracted from three dimensions: payment data, user behavior sequences, and device information, to construct a three-dimensional attack simulation space. In the three-dimensional attack simulation space, the malicious behavior feature cluster is sampled in a targeted manner to generate a combination of target feature vectors. The combination of target feature vectors is then input into a pre-trained CGAN model to generate a malicious attack scenario. In the three-dimensional attack simulation space, based on the normal user behavior profile, data perturbation is performed to generate hybrid attack scenarios; By combining the malicious attack scenarios and the hybrid attack scenarios, a test scenario set is generated, and each malicious recharge test scenario in the test scenario set is equipped with a corresponding malicious intent.

[0042] In this embodiment, the generation of the malicious recharge test scenario needs to be constructed from three dimensions: payment data, user behavior sequence, and device information. The generated test scenario is specifically a recharge request with specific payment, behavior, and device characteristics. The payment data dimension includes payment amount, payment frequency, payment channel, currency type, order number pattern, etc. The user behavior sequence dimension includes the operation path from login to recharge, the duration of screen dwell, and the behavioral context before recharge. Specifically, the user's operation from starting the game to completing the recharge is abstracted into a timestamped sequence, such as [start the App -> click the activity pop-up -> browse the store for 3 seconds -> select "648 yuan diamond pack" -> complete payment authorization within 2 seconds]. Features such as operation path, screen dwell time, and behavioral context before recharge are extracted from this sequence. The device information dimension includes device fingerprint, IP address and geographic information, operating system version, device model, application client version, etc.

[0043] More specifically, the generation of malicious recharge test scenarios is based on malicious behavior feature clusters and normal user behavior profiles, combined with a three-dimensional attack simulation space, to generate corresponding malicious attack scenarios and hybrid attack scenarios.

[0044] Specifically, for malicious attack scenarios, in the three-dimensional attack simulation space, target feature vector combinations are obtained by directional sampling of known malicious behavior feature clusters. That is, in the vicinity of the malicious behavior feature clusters, target feature vector combinations that conform to the three-dimensional attack simulation space are collected to generate a highly coordinated and realistic malicious recharge test scenario in terms of payment data, user behavior, and device information.

[0045] In some embodiments, the center vector of the malicious behavior feature cluster is used as the anchor point, and the dynamic sampling radius is calculated using the formula R=R_base*(1+C_Weight)*(1-Density), where R_base represents the base radius, C_Weight represents the confidence weight, and Density represents the sample density, i.e., the number of samples in the malicious behavior cluster. The higher C_Weight and the lower Density, the larger the sampling radius. Based on the dynamic sampling radius, random sampling is performed from the malicious behavior feature cluster to obtain a combination of target feature vectors used to simulate and generate malicious attack scenarios. The sampled combination of target feature vectors is then used as a condition and input into the pre-trained CGAN model to generate malicious attack scenarios. It can be understood that the combination of target feature vectors specifically consists of feature vectors in three dimensions: payment data, user behavior sequence, and device information.

[0046] In some embodiments, during the random sampling process, variant feature vectors of known malicious behavior feature clusters can be generated. For example, sampling near the "small amount and frequency recharge cluster" can generate variants with slightly larger amounts and slightly lower frequencies to achieve in-depth testing of the game recharge system and improve the practicality of the test.

[0047] Furthermore, for the CGAN model, it receives a combination of target feature vectors and random noise, and outputs a structured malicious attack scenario. The conditional input of the CGAN model's generator is a combination of target feature vectors sampled from a three-dimensional attack simulation space. This vector combination simultaneously encodes payment anomaly patterns, behavior sequence anomaly patterns, and device fingerprint anomaly patterns. Thus, it ultimately generates a test scenario that is consistent across the three dimensions of payment data, user behavior sequence, and device information. The discriminator of the CGAN model then makes a judgment based on the consistency of the generated test scenario across the three dimensions of payment data, user behavior sequence, and device information, as well as the system responses it triggers. Understandably, while judging whether the data is "real," the discriminator also judges whether the payment data, user behavior sequence, and device information are logically consistent, thereby forcing the generator to learn deeper real-world patterns and generate truly deceptive scenarios, avoiding the generation of meaningless and invalid scenarios.

[0048] More specifically, for hybrid attack scenarios, based on the characteristics of normal user behavior profiles in the three dimensions of payment data, user behavior sequence, and device information, hybrid attack scenarios are generated by perturbing one or more dimensions of the data in payment data, user behavior sequence, and device information, making them difficult to be identified by single-dimensional risk control rules. It can be understood that the data perturbation in hybrid attack scenarios includes single-dimensional mutations and inter-dimensional correlation mutations.

[0049] Specifically, single-dimensional variation involves inserting, deleting, replacing, or obfuscating steps within any dimension. For example, in one embodiment, a typical normal recharge process sequence is randomly selected from the normal user behavior profile in the recharge knowledge base, such as: [Login -> Enter the store -> Select product A -> Initiate payment -> Payment successful -> Receive items]. The strategies for perturbing this normal recharge process sequence include step insertion, step deletion, step replacement, time-sequence tampering, and parameter obfuscation. Step insertion specifically involves inserting a malicious step into the normal process, such as inserting a fake payment success callback after initiating payment. Step deletion specifically involves deleting key steps, such as skipping the payment initiation step and directly attempting to call the item receiving interface. Step replacement specifically involves replacing a normal step with a malicious step, such as replacing selecting product A with... Instead of selecting product A but passing in the ID of product B and the price of product A, for time-series tampering, this involves compressing the time interval between normal requests to simulate a high-speed attack, or lengthening the time interval to simulate a slow attack to bypass risk control. For parameter obfuscation, it usually needs to be combined with fuzz testing, such as using a genetic algorithm. The request parameters are regarded as "genes," and the triggering of system anomalies (such as 500 errors, validation bypass) are regarded as "adaptable individuals." Through selection, crossover, mutation, and iterative evolution, the malicious parameters that can best expose program defects are generated. For example, in one embodiment, for a normal recharge sequence, "parameter obfuscation" mutation is applied. For the "order amount" field, the genetic algorithm may evolve a request with a value of -1, 0, 999999999, or 1.001 to test the server's boundary value handling and data type validation.

[0050] More specifically, malicious top-ups in reality are usually not just single-dimensional mutations, but often involve mutations across multiple dimensions. Therefore, the generation process of hybrid attack scenarios also needs to involve cross-dimensional linkages to generate corresponding test scenarios to meet testing requirements. This involves inter-dimensional correlation mutations, deliberately creating data contradictions or logical gaps between dimensions, including but not limited to discrepancies between the payment region and the device login region, discrepancies between the payment device fingerprint and the commonly used devices in the behavior sequence, and large payments accompanied by low-value purchase behaviors. For example, in one embodiment, the amount field in the payment data is mutated to an abnormal value, such as a huge number, while simultaneously mutating the device information dimension, modifying its device fingerprint to a known emulator fingerprint or batch-registered device fingerprint to simulate the typical attack characteristics of a black market team; or a normal top-up behavior data is selected, its device information is mutated to a low-end device fingerprint, and the amount in its payment data is modified to an extremely high value. This is used to test whether the game recharge system can monitor situations where the device value and spending power are mismatched; or to mutate the IP address in the device information of normal recharge behavior data to an IP address far away from the original common location, while compressing the time interval between "login" and "initiate payment" in the user behavior sequence to an extremely short length, to test whether the linkage between login risk control and payment risk control is timely; or to uniformly mutate the device information of multiple normal recharge behavior data to the same simulator fingerprint, and make their payment data, such as order numbers, show regularity and user behavior sequences highly consistent, to test the game recharge system's ability to detect batch and automated operations. Through the above linkage mutation strategies, relevant scenarios are generated to simulate the camouflage strategies adopted by advanced persistent threats to bypass risk control. Understandably, the settings of linkage mutation strategies are set according to actual testing needs to improve the practicality and richness of the test samples.

[0051] Understandably, each malicious recharge test scenario generated based on malicious behavior feature clusters and normal user behavior profiles has a corresponding malicious intent, which is used for subsequent verification of the test results.

[0052] S300. In the game testing environment, the malicious recharge test scenario is converted into test traffic, and the test traffic is injected into the game recharge system; In some embodiments, step S300 above includes: Based on the malicious recharge test scenario, combined with the pre-configured simulation engine, a specific protocol stack is selected for adaptation, and the corresponding client behavior model and protocol rules are loaded. Based on the client behavior model and the protocol rules, network data packets for test traffic are generated. When generating the network data packet, the session context is dynamically dimensioned and updated, and the session context includes the user session token, transaction serial number, and client status identifier. The network data packets are injected into the game recharge system, and timing disturbances are introduced, including network latency disturbances, request interval disturbances, and packet reordering and packet loss retransmission.

[0053] In this embodiment, a simulation engine supporting multiple game communication protocols is configured. This engine can select and adapt to the specific protocol stack used by the target game based on the device information of each malicious recharge test scenario generated in step S200, and load the corresponding client behavior model and protocol rules. The protocol rules include serialization and deserialization rules. Game communication protocols include, but are not limited to, TCP long connections, HTTP / HTTPS short connections, WebSocket, and custom UDP protocols. The client behavior model is used to simulate the standard behavior of a game client, such as automatically replying with a confirmation packet after receiving a specific instruction from the server. For example, in one embodiment, test game A uses a custom binary protocol based on TCP, while game B uses HTTP / 2 and JSON. By loading the corresponding client behavior model and protocol rules, the simulation engine can seamlessly simulate these two game clients respectively, generating test traffic that fully conforms to their protocol specifications.

[0054] More specifically, the test traffic generated by the simulation engine includes network packets for data transmission. Simultaneously, when generating each network packet, the session context is dynamically maintained and updated. This session context includes, but is not limited to, user session tokens, transaction serial numbers, and client state identifiers to ensure that the generated test traffic maintains consistency with the real client at the protocol level. The generated test traffic is then injected into the game recharge system, introducing timing perturbations such as network latency perturbations, request interval perturbations, or packet reordering and retransmission to test the game recharge system's fault tolerance and robustness against abnormal protocols. The network latency perturbation is based on a normal or Pareto distribution fitted to historical real network latency data, injecting random latency into each packet. The request interval perturbation simulates the non-uniform operation intervals of real users based on user behavior dimensions in the three-dimensional attack simulation space. Packet reordering and retransmission simulate network congestion environments, randomly reordering packets with low probability or triggering the simulated client's retransmission mechanism.

[0055] Specifically, when injecting test traffic into the game recharge system, a corresponding recharge request is generated based on the malicious recharge test scenario. At the same time, the simulation engine generates the corresponding network data packets and the corresponding session context. For example, in the "payment success callback" scenario, the simulation engine will first simulate the "initiate payment" request and parse the order number and session token from the server's response, store them in the context, and then fill these parameters into the correct fields of the data packet when generating the "forged callback request" to simulate the payment success callback scenario.

[0056] S400: Monitor status changes in the game recharge system and generate a response sequence; In some embodiments, step S400 above includes: Security probes are deployed at key business logic nodes in the game recharge system to collect system status data. The key business logic nodes include request entry gateways, business logic services, data layers, and external service call boundaries. A globally unique tracking identifier is attached to the system status data, and all monitoring data of the same malicious recharge test scenario are associated to form a response sequence.

[0057] In this embodiment, based on the call chain analysis of the game recharge system, security probes are deployed at the following key business logic nodes, specifically including the request entry gateway, business logic services, and external service call boundaries. The request entry gateway is used to monitor the original parameters of all inbound recharge-related requests; the business logic services specifically include recharge verification services, virtual asset issuance services, and user rights update services; the data layer is used to monitor the order database, user asset database, etc.; and the external service call boundaries are used to monitor interaction requests and responses with third-party payment platforms and risk control systems.

[0058] Specifically, the input parameters, return values, exceptions thrown, and execution time of the security probe are recorded using instrumentation technology. Before and after the request is submitted, the before and after images of the affected data are recorded. The request content, response status code, and response body summary of the external payment interface call are also recorded. In addition, a globally unique tracking identifier is attached to all collected data to ensure that all monitoring data from the same test scenario can be accurately correlated, thereby generating a response sequence.

[0059] In one embodiment, a structured data storage unit is generated for the response sequence triggered by each malicious recharge test scenario. This data storage unit includes: trigger scenario ID, response sequence, associated complete function call stack, related database change records, etc. Then, the data storage units of each test scenario are serialized and indexed for storage, which facilitates subsequent rapid data query and analysis, thereby evaluating the game recharge system.

[0060] S500. Based on the response sequence, evaluate the game recharge system.

[0061] In some embodiments, step S500 above includes: The system status data is compared with the preset malicious intent. From the three dimensions of business consistency, data integrity and logical completeness, it is determined whether the actual response of the game recharge system has reached the abnormal state corresponding to the malicious recharge test scenario. If an abnormal state is reached, the propagation process of system state data in the response sequence is analyzed to identify vulnerabilities in the game recharge system. These vulnerabilities are then associated with the malicious recharge test scenario to generate a test report.

[0062] In this embodiment, the response sequence generated from the system status data is compared with the malicious intent preset in the malicious attack test scenario corresponding to step S200. Based on the preset malicious intent, the actual response of the system is judged from three dimensions: business consistency, data integrity, and logical completeness, to determine whether the system's actual response has reached the abnormal state that the test scenario attempts to trigger. This confirms whether the vulnerability of the preset game recharge system has been successfully exploited. If the vulnerability has been successfully exploited, the vulnerability is correlated with the malicious recharge test scenario to generate a test report to meet the testing requirements of the game recharge system.

[0063] Specifically, each malicious attack test scenario generated in step S200 is accompanied by metadata of a malicious intent. For example, scenario A has an expected target: to attack the logical integrity of the game recharge system, causing an over-allocation of resources. Another example is scenario B, which has an expected target: to attack the business consistency of the game recharge system, causing an asset-amount deviation greater than 0. Yet another example is scenario C, which has an expected target: to attack the data integrity of the game recharge system, causing a parsing error in the server protocol. Therefore, during the testing process, the response sequence corresponding to the system status data can be compared with the malicious intent from three dimensions: business consistency, data integrity, and logical integrity, to determine whether a corresponding abnormal state has occurred. If a corresponding abnormal state has occurred, it is determined that the game recharge system has a corresponding vulnerability, and it is then correlated with the malicious recharge test scenario for analysis.

[0064] In some embodiments, the features generated by mutations of normal user behavior profiles or malicious behavior feature clusters in malicious recharge test scenarios are divided into three dimensions: payment data, user behavior sequences, and device information to generate attack vectors. The abnormal states that appear in the response sequence are associated with the attack vectors. By analyzing the propagation and deformation of the attack vectors in the processing chain of the game recharge system, the root cause of the vulnerability is accurately located, and the causal correlation strength between the vulnerability and the attack method of the test scenario is determined. Then, a test report with the corresponding vulnerability is generated. The test report is associated with the test scenario ID that triggered the vulnerability and the corresponding vulnerability instance. The test report also includes the attack vector that caused the vulnerability and reproduces the attack method of the attack vector.

[0065] In one embodiment, the malicious recharge test scenario involves inserting a fake payment success callback after the payment is initiated. The corresponding attack vector is "injecting additional payment status parameters into the HTTP Header". At this time, the attack vector is compared with system status data such as "the payment verification service reads the tampered Header parameters and updates the order status accordingly". When the two are logically consistent, it can be confirmed that the attack vector caused the vulnerability. When the test report is generated, the attack method corresponding to the malicious recharge test scenario is synchronized to the test report.

[0066] In another example, the test scenario involved tampering with the price parameter sent by the game client to a negative number, ultimately resulting in an increase in diamonds in the user's account. During the causal correlation strength analysis, backtracking revealed that the server-side price verification function validatePrice received a negative number, but its verification logic had a flaw, such as if(price > 0). This verification logic missed the case where price <= 0, resulting in a vulnerability in the game recharge system. At this point, the attack vector of "price tampering" was strongly correlated with the root cause of the vulnerability due to incomplete verification logic to determine the cause of the vulnerability. The corresponding root cause and remediation plan were then specified in the test report.

[0067] In some embodiments, the method further includes automatically generating a batch of new test scenarios in the vicinity of the identified vulnerability in a three-dimensional attack simulation space as seeds for the next round of testing, in order to ensure the integrity of the testing of the game recharge system.

[0068] Please see Figure 2 As shown, the present invention also provides an automated testing system for simulating malicious recharge, the system comprising: First processing module 201: used to collect historical recharge data, perform cluster analysis on the historical recharge data through an unsupervised learning algorithm, and build a recharge knowledge base. The historical recharge data includes data generated by normal recharge behavior and abnormal recharge behavior. The second processing module 202 is used to construct a three-dimensional attack simulation space based on the recharge knowledge base, and generate a malicious recharge test scenario in the three-dimensional attack space. The third processing module 203 is used to convert the malicious recharge test scenario into test traffic in the game test environment and inject the test traffic into the game recharge system. Fourth processing module 204: used to monitor status changes in the game recharge system and generate a response sequence; Fifth processing module 205: used to evaluate the game recharge system based on the response sequence.

[0069] It is understandable that, such as Figure 1 The content of the automated testing method embodiment for simulating malicious recharge shown is applicable to the automated testing system embodiment for simulating malicious recharge. The specific functions implemented by the automated testing system embodiment for simulating malicious recharge are the same as those shown below. Figure 1 The automated testing method for simulating malicious top-ups shown is the same as the example, and the beneficial effects achieved are the same as those described above. Figure 1 The beneficial effects achieved by the automated testing method embodiment for simulating malicious recharge shown are also the same.

[0070] It should be noted that the information interaction and execution process between the above systems are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0071] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0072] Please see Figure 3 As shown, this embodiment of the invention also provides a computer device 3, including: a memory 302 and a processor 301, and a computer program 303 stored on the memory 302. When the computer program 303 is executed on the processor 301, it implements the automated testing method for simulating malicious recharge as described in any of the above methods.

[0073] The computer device 3 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that... Figure 3 The computer device 3 is merely an example and does not constitute a limitation on the computer device 3. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0074] The processor 301 may be a Central Processing Unit (CPU), or it may be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor.

[0075] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may be an external storage device of the computer device 3, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 3. Furthermore, the memory 302 may include both internal and external storage units of the computer device 3. The memory 302 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0076] This invention also provides a computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements an automated testing method for simulating malicious recharge as described in any of the above methods.

[0077] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographic device / computer device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0078] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application, and should all be included within the protection scope of this application.

Claims

1. An automated testing method for simulating malicious recharge, characterized in that, include: Collect historical recharge data, perform cluster analysis on the historical recharge data using an unsupervised learning algorithm, and construct a recharge knowledge base. The historical recharge data includes data generated by normal recharge behavior and abnormal recharge behavior. Based on the aforementioned recharge knowledge base, a three-dimensional attack simulation space is constructed, and malicious recharge test scenarios are generated in the three-dimensional attack space. In the game testing environment, the malicious recharge test scenario is transformed into test traffic, and the test traffic is injected into the game recharge system; The system monitors status changes and generates response sequences within the game recharge system. The game recharge system is evaluated based on the response sequence.

2. The method as described in claim 1, characterized in that, The collected historical recharge data is clustered using an unsupervised learning algorithm to construct a recharge knowledge base. This historical recharge data includes both normal and abnormal recharge behaviors, including: Multi-dimensional raw data is collected from game servers, payment gateways, and client devices. The multi-dimensional raw data includes payment transaction data, user operation behavior sequence data, and device environment fingerprint data. The multidimensional raw data is cleaned, denoised, normalized, and correlated and aligned to form standardized behavioral flow data; Based on the standardized behavioral flow data, static and dynamic features are extracted to construct a behavioral profile. At the same time, feature abstraction is performed on equipment information to generate an equipment risk profile. The characteristics of the behavioral profile and the device risk profile are represented as feature vectors, and corresponding metadata is attached and stored in the recharge database.

3. The method as described in claim 2, characterized in that, The construction of the behavioral profile includes: Based on static and dynamic features, a Gaussian mixture model is used to perform density estimation and clustering of normal recharge behavior to form a normal user behavior profile, which includes multiple behavior cluster centers. The isolated forest algorithm is used to detect outliers based on the standardized behavioral flow data. The detected outliers are then clustered in a second stage to determine malicious behavior patterns and form malicious behavior feature clusters.

4. The method as described in claim 3, characterized in that, Based on the recharge knowledge base, a three-dimensional attack simulation space is constructed, and malicious recharge test scenarios are generated in the three-dimensional attack space, including: Based on the aforementioned recharge knowledge base, feature vectors are extracted from three dimensions: payment data, user behavior sequences, and device information, to construct a three-dimensional attack simulation space. In the three-dimensional attack simulation space, the malicious behavior feature cluster is sampled in a targeted manner to generate a target feature vector. The target feature vector is then input into a pre-trained CGAN model to generate a malicious attack scenario. In the three-dimensional attack simulation space, based on the normal user behavior profile, data perturbation is performed to generate hybrid attack scenarios; By combining the malicious attack scenarios and the hybrid attack scenarios, a test scenario set is generated, and each malicious recharge test scenario in the test scenario set is equipped with a corresponding malicious intent.

5. The method as described in claim 1, characterized in that, In the game testing environment, the malicious recharge test scenario is transformed into test traffic, and the test traffic is injected into the game recharge system, including: Based on the malicious recharge test scenario, combined with the pre-configured simulation engine, a specific protocol stack is selected for adaptation, and the corresponding client behavior model and protocol rules are loaded. Based on the client behavior model and the protocol rules, network data packets for test traffic are generated. When generating the network data packet, the session context is dynamically dimensioned and updated, and the session context includes the user session token, transaction serial number, and client status identifier. The network data packets are injected into the game recharge system, and timing disturbances are introduced, including network latency disturbances, request interval disturbances, and packet reordering and packet loss retransmission.

6. The method as described in claim 1, characterized in that, The step of monitoring status changes and generating a response sequence in the game recharge system includes: Security probes are deployed at key business logic nodes in the game recharge system to collect system status data. The key business logic nodes include request entry gateways, business logic services, data layers, and external service call boundaries. A globally unique tracking identifier is attached to the system status data, and all monitoring data of the same malicious recharge test scenario are associated to form a response sequence.

7. The method as described in claim 1, characterized in that, The evaluation of the game recharge system based on the response sequence includes: The system status data is compared with the preset malicious intent. From the three dimensions of business consistency, data integrity and logical completeness, it is determined whether the actual response of the game recharge system has reached the abnormal state corresponding to the malicious recharge test scenario. If an abnormal state is reached, the propagation process of system state data in the response sequence is analyzed to identify vulnerabilities in the game recharge system. These vulnerabilities are then associated with the malicious recharge test scenario to generate a test report.

8. An automated testing system for simulating malicious recharge, characterized in that, include: The first processing module is used to collect historical recharge data, perform cluster analysis on the historical recharge data through an unsupervised learning algorithm, and build a recharge knowledge base. The historical recharge data includes data generated by normal recharge behavior and abnormal recharge behavior. The second processing module is used to construct a three-dimensional attack simulation space based on the recharge knowledge base, and generate malicious recharge test scenarios in the three-dimensional attack space. The third processing module is used to convert the malicious recharge test scenario into test traffic in the game test environment and inject the test traffic into the game recharge system. The fourth processing module is used to monitor status changes in the game recharge system and generate response sequences. The fifth processing module is used to evaluate the game recharge system based on the response sequence.

9. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 7.

Images