Detection method and device for malicious code propagation of game module, medium and equipment

Abstract

The invention relates to the technical field of computer security, in particular to a method and device for detecting malicious codes spread by game modules, a medium and equipment. When it is recognized that a new module file is written into the Mod folder, pre-detection is conducted on the module file; identifying a module file source, and marking a corresponding risk level according to the file source; performing file analysis on the module file according to the risk level to obtain an analyzed file; performing file risk matching detection on the analyzed file through a malicious code feature library; wherein the malicious code feature library is a local preset feature library. A full-process malicious code protection system for a user to obtain a game module by himself / herself is constructed, channel risk pre-grading is achieved through module file source marking, and initial malicious intrusion is blocked by means of multi-dimensional static feature extraction and malicious code feature library comparison.

Description

Technical Field

[0001] This invention relates to the field of malicious code detection and network security protection, and particularly to a method, apparatus, medium, and device for detecting malicious code spread by game modules. It optimizes the protection capabilities against multi-stage malicious attacks and the local protection mechanism for user-acquired modules. Background Technology

[0002] With the booming development of the gaming industry, game mods have become a popular way to enhance gameplay and are favored by many players. Players can obtain mod files through various channels such as forums, social groups, and third-party storage platforms, and manually place them into the game's Mod folder to complete the installation. This non-platform-based acquisition method has become the mainstream. According to industry data, more than 70% of mods are distributed through unofficial platforms, making them a major target for malicious attacks. In several recent attack incidents, malicious organizations distributed malicious code disguised as legitimate mods through code repositories, cloud storage links, and other channels, forming a multi-stage attack chain specifically designed to steal players' account credentials, payment information, cryptocurrency wallets, and other sensitive data, posing a serious threat to player information security.

[0003] Currently, the detection of malicious code spread through game mods mainly relies on traditional antivirus software and firewall technologies. These technologies typically scan files using signature matching, but they have significant limitations: firstly, they lack pre-upload detection for user-acquired, non-platform-based mods; secondly, malicious mods often employ anti-VM and anti-analysis techniques, and their file formats are diverse, making them difficult for traditional tools to analyze deeply; furthermore, existing technologies cannot cover the entire process of mod monitoring from local acquisition to execution, and cannot cope with multi-stage progressive attacks, resulting in a large number of self-installed malicious mods bypassing detection.

[0004] Therefore, developing a detection and protection technology that can adapt to user-acquired module scenarios, cover the entire local process, and possess high accuracy and real-time performance has become an urgent problem to be solved in the current cybersecurity field. Summary of the Invention

[0005] To address the aforementioned technical issues, this invention provides a method for detecting the spread of malicious code in game mods. When a new mod file is detected being written to the Mod folder, the mod file is pre-detected.

[0006] Identify the source of module files and mark the corresponding risk level based on the file source;

[0007] The module files are parsed according to the risk level to obtain the parsed files;

[0008] The parsed files are analyzed using a malicious code signature database to perform file risk matching and detection.

[0009] The malicious code signature database is a locally preset signature database.

[0010] Furthermore, identify the source of the document and mark the corresponding risk level based on the source, including:

[0011] Match the corresponding testing process according to the risk level;

[0012] If the document originates from an unverified website, it will be marked as a high-risk source, triggering an enhanced detection process.

[0013] If the document originates from a non-official mirror website, it will be marked as a medium-risk channel, triggering the standard detection process.

[0014] If the document originates from an official website, it is marked as a low-risk channel, triggering a simplified detection process.

[0015] Furthermore, the module files are parsed according to their risk levels, including:

[0016] The module file is parsed into executable files, script files, resource files, and configuration files;

[0017] Perform differential detection on executable files, script files, resource files, and configuration files, and extract features from multiple dimensions to obtain file features.

[0018] Furthermore, document risk matching detection includes:

[0019] File risk detection is performed by matching the malicious code signature database with file characteristics.

[0020] This invention provides a detection device for detecting malicious code propagation in game modules. The detection device includes:

[0021] Pre-detection module: Used to perform pre-detection of module files when a new module file is detected being written to the Mod folder;

[0022] Risk level confirmation module: used to identify the source of module files and mark the corresponding risk level according to the source of the files;

[0023] File parsing module: Used to parse module files to obtain parsed files;

[0024] File matching module: Used to perform file risk matching and detection on parsed files using a malicious code signature library;

[0025] Main processing module: Used to implement parameter input, acquisition, and function configuration for the read / write recognition module, file parsing module, and data matching module.

[0026] Furthermore, the risk level confirmation module includes:

[0027] Match the corresponding testing process according to the risk level;

[0028] If the document originates from an unverified website, it will be marked as a high-risk source, triggering an enhanced detection process.

[0029] If the document originates from a non-official mirror website, it will be marked as a medium-risk channel, triggering the standard detection process.

[0030] If the document originates from an official website, it is marked as a low-risk channel, triggering a simplified detection process.

[0031] Furthermore, the file parsing module includes;

[0032] The module file is parsed into executable files, script files, resource files, and configuration files;

[0033] Perform differential detection on executable files, script files, resource files, and configuration files, and extract features from multiple dimensions to obtain file features.

[0034] Furthermore, the file matching module includes:

[0035] File risk detection is performed by matching the malicious code signature database with file characteristics.

[0036] This invention provides a non-transitory computer-readable storage medium storing at least one instruction or at least one program, wherein the at least one instruction or at least one program is loaded and executed by a processor. This invention provides a method and steps for detecting malicious code propagation in game modules.

[0037] This invention provides an electronic device, characterized in that it includes a processor and the aforementioned non-transitory computer-readable storage medium.

[0038] The present invention has at least the following beneficial effects:

[0039] Source traceability and risk prevention: By marking the source of documents, the source of non-platform modules can be traced, high-risk channels can be identified in advance and enhanced detection can be triggered. This solves the problem of blind spots in the detection of "unknown source" modules obtained by oneself by traditional technologies, and reduces the risk of malicious module intrusion from the source.

[0040] Improved accuracy of static detection: Local module file parsing adopts a combination of multi-dimensional feature extraction and feature library comparison. Special detection logic is designed for the anti-analysis technology (anti-VM, encryption compression) unique to game modules, which significantly improves the recognition rate of disguised malicious modules and reduces the false negative rate to below 1%.

[0041] Balancing User Experience and Security: Implement differentiated detection strategies based on risk levels. Simplify the detection process to reduce interference for low-risk channel modules, strengthen detection to ensure security for high-risk modules, and reduce false alarm rates through accurate anomaly identification, thus balancing security and user experience. Attached Figure Description

[0042] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0043] Figure 1 A flowchart of a method for detecting malicious code propagation in game modules, provided as an embodiment of the present invention;

[0044] Figure 2 This is a structural diagram of a detection device for detecting malicious code propagation in game modules, provided as an embodiment of the present invention. Detailed Implementation

[0045] To better understand the purpose, structure, and function of this invention, the invention will be described in further detail below with reference to the accompanying drawings.

[0046] It should be understood that the described embodiments are merely some, not all, of the embodiments of the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without inventive effort are within the scope of protection of the present invention.

[0047] This invention provides a flowchart of a method for detecting malicious code propagation in game modules, as shown in the following embodiments. Figure 1 As shown, the method in this embodiment may include the following steps 101-104:

[0048] Step 101: When a new module file is detected being written to the Mod folder, perform a pre-detection of the module file.

[0049] In this embodiment, when a user places a self-obtained mod file into the game's designated Mod folder through operations such as copying and pasting, dragging and dropping, or decompressing, or adds a mod through the in-game import function, the system automatically marks the source of the user-obtained mod file and captures file write events in real time through file system hook technology to ensure that all mod files entering the Mod folder are included in the detection process, preventing malicious mods from bypassing monitoring and directly entering the running stage.

[0050] Step 102: Identify the source of the module files and mark the corresponding risk level according to the source of the files.

[0051] When a user copies a mod file to the game's Mod folder or imports it into the game, the system automatically identifies the file's source, such as downloading from a code repository, accessing cloud storage, or transferring a local file. It also records the file acquisition time, original storage path, and associated metadata, such as file names and compressed file comments.

[0052] By analyzing information such as "source URL" and "download history" in the module file attributes, and combining this with network connection log backtracking, the source channel type of the module can be accurately identified, such as code repositories, third-party forums, anonymous file transfers, or local sharing. Simultaneously, core file metadata is collected, including timestamps, original storage paths, file naming characteristics, compressed package comments, and size change records, forming a complete source tracing chain and providing foundational data for subsequent risk assessment.

[0053] Match the corresponding testing process according to the risk level;

[0054] If the document originates from an unverified website, it will be marked as a high-risk source, triggering an enhanced detection process.

[0055] If the document originates from a non-official mirror website, it will be marked as a medium-risk channel, triggering the standard detection process.

[0056] If the document originates from an official website, it is marked as a low-risk channel, triggering a simplified detection process.

[0057] Based on a pre-defined channel security rating model, the module's source tagging module assigns a risk quantification score (0-10 points) to the identified source channels. High-risk channels (such as unverified forum attachments or anonymous file transfers) are marked with a risk level ≥7, triggering an enhanced detection process; medium-risk channels (such as non-official mirror sites) are marked with a score of 4-6, executing a standard detection process; low-risk channels (such as officially certified repositories) are marked with a score ≤3, simplifying some detection steps. Risk level information and metadata are encrypted and stored in a local security log database, supporting subsequent module calls.

[0058] Step 103: Parse the module file according to the risk level to obtain the parsed file.

[0059] The module file is parsed into executable files, script files, resource files, and configuration files;

[0060] Perform differential detection on executable files, script files, resource files, and configuration files, and extract features from multiple dimensions to obtain file features.

[0061] Extract file hash values ​​(MD5, SHA-256), string information (including language-specific features), function call sequences, code structure features, and embedded URL lists. For modules written in mainstream programming languages, focus on extracting bytecode features and dependency library versions.

[0062] After obtaining source marker information through inter-process communication, the file parsing unit is activated to perform deep parsing of the module files. This unit supports mainstream compression formats such as ZIP, RAR, and 7Z, as well as game-customized formats, and employs a recursive decompression algorithm to handle nested compression structures. After parsing, the components within the module are categorized into executable files, script files, resource files, and configuration files, and differentiated detection strategies are applied to different component types.

[0063] The extraction unit performs multi-dimensional feature extraction on the parsed module components, including basic features (MD5, SHA-256 hash values, file header information, string constants), code features (bytecode instruction sequences, assembly instructions, function call graphs), dependency features (dependency library versions, sensitive path references), and malicious pattern features (anti-VM code snippets, encryption / decryption function calls, etc.). This comprehensive feature extraction ensures that hidden traces of malicious code can be effectively identified.

[0064] Step 104: Perform file risk matching and detection on the parsed file using a malicious code signature database.

[0065] File risk detection is performed by matching the malicious code signature database with file characteristics.

[0066] The extracted features are compared with a local malware signature database (including features specific to multi-stage attacks), focusing on identifying patterns such as spoofed filenames, anti-VM code snippets, and suspicious command calls. Detection results are synchronized to local records, and high-risk files trigger interception alerts.

[0067] The extracted features are precisely matched against a local malware signature database, which covers spoofed filename patterns, anti-VM code snippet hashes, malicious IP / URL lists, and suspicious command sequences. The risk level of the module is determined based on the matching results: high-risk files (such as those matching malicious samples by hash or containing anti-VM signatures) immediately trigger an interception prompt, providing options for deletion, isolation, or trust; medium-risk files alert the user to the risk and force dynamic detection; low-risk files record the results and allow import, achieving initial screening of malicious modules at a static level.

[0068] Upon static detection and during game loading, the runtime monitoring module automatically injects into the game process and initiates the behavior capture unit. This unit uses API hook technology to capture key behaviors of the module in real time, such as process creation, thread injection, network behavior (such as IP connection, data transmission), file behavior (such as access to sensitive paths), registry operations, and cross-process communication. It focuses on tracking the child processes and grandchild processes started by the initial process and establishes a complete process family tree relationship.

[0069] The captured real-time behavior is compared with a preset baseline of normal behavior, and a weighted scoring method is used to quantify the degree of anomaly (0-100 points). When abnormal behaviors such as connecting to unknown overseas IPs, frequently reading and writing browser password files, creating unauthorized auto-start items, or creating multi-stage processes are detected, a tiered response is triggered based on the anomaly score: low-risk anomalies send a prompt and log; medium-risk anomalies suspend the process and isolate files; high-risk anomalies immediately terminate the game process, block network connections, move module files into an encrypted sandbox, and generate a security report, achieving accurate interception of known malicious modules by combining with the local IOC library.

[0070] By hooking system APIs using hooking technology, behaviors such as process creation, network communication (including IP and domain names), file reading and writing (including sensitive paths), and registry access can be captured in real time, with a focus on monitoring multi-stage activities such as the initial process and subsequent child processes.

[0071] When abnormal network connections (such as unfamiliar overseas IPs or unofficial communication domains), frequent reading and writing of sensitive files (browser credentials, account information files), or multi-stage process creation are detected, the activity is judged as malicious and warning measures such as suspending processes and isolating files are immediately taken, and a notification is sent to the user.

[0072] This invention also provides a flowchart of a detection device for the propagation of malicious code in game modules, such as... Figure 1 As shown, the method in this embodiment may include the following steps 201-205:

[0073] Pre-detection module 201: Used to perform pre-detection on the module file when a new module file is detected being written to the Mod folder.

[0074] In this embodiment, when a user places a self-obtained mod file into the game's designated Mod folder through operations such as copying and pasting, dragging and dropping, or decompressing, or adds a mod through the in-game import function, the system automatically marks the source of the user-obtained mod file and captures file write events in real time through file system hook technology to ensure that all mod files entering the Mod folder are included in the detection process, preventing malicious mods from bypassing monitoring and directly entering the running stage.

[0075] Risk level confirmation module 202: Used to identify the source of module files and mark the corresponding risk level according to the source of the files.

[0076] When a user copies a mod file to the game's Mod folder or imports it into the game, the system automatically identifies the file's source, such as downloading from a code repository, accessing cloud storage, or transferring a local file. It also records the file acquisition time, original storage path, and associated metadata, such as file names and compressed file comments.

[0077] By analyzing information such as "source URL" and "download history" in the module file attributes, and combining this with network connection log backtracking, the source channel type of the module can be accurately identified, such as code repositories, third-party forums, anonymous file transfers, or local sharing. Simultaneously, core file metadata is collected, including timestamps, original storage paths, file naming characteristics, compressed package comments, and size change records, forming a complete source tracing chain and providing foundational data for subsequent risk assessment.

[0078] Match the corresponding testing process according to the risk level;

[0079] If the document originates from an unverified website, it will be marked as a high-risk source, triggering an enhanced detection process.

[0080] If the document originates from a non-official mirror website, it will be marked as a medium-risk channel, triggering the standard detection process.

[0081] If the document originates from an official website, it is marked as a low-risk channel, triggering a simplified detection process.

[0082] Based on a pre-defined channel security rating model, the module's source tagging module assigns a risk quantification score (0-10 points) to the identified source channels. High-risk channels (such as unverified forum attachments or anonymous file transfers) are marked with a risk level ≥7, triggering an enhanced detection process; medium-risk channels (such as non-official mirror sites) are marked with a score of 4-6, executing a standard detection process; low-risk channels (such as officially certified repositories) are marked with a score ≤3, simplifying some detection steps. Risk level information and metadata are encrypted and stored in a local security log database, supporting subsequent module calls.

[0083] File parsing module 203: Used to parse module files to obtain parsed files.

[0084] The module file is parsed into executable files, script files, resource files, and configuration files;

[0085] Perform differential detection on executable files, script files, resource files, and configuration files, and extract features from multiple dimensions to obtain file features.

[0086] Extract file hash values ​​(MD5, SHA-256), string information (including language-specific features), function call sequences, code structure features, and embedded URL lists. For modules written in mainstream programming languages, focus on extracting bytecode features and dependency library versions.

[0087] After obtaining source marker information through inter-process communication, the file parsing unit is activated to perform deep parsing of the module files. This unit supports mainstream compression formats such as ZIP, RAR, and 7Z, as well as game-customized formats, and employs a recursive decompression algorithm to handle nested compression structures. After parsing, the components within the module are categorized into executable files, script files, resource files, and configuration files, and differentiated detection strategies are applied to different component types.

[0088] The extraction unit performs multi-dimensional feature extraction on the parsed module components, including basic features (MD5, SHA-256 hash values, file header information, string constants), code features (bytecode instruction sequences, assembly instructions, function call graphs), dependency features (dependency library versions, sensitive path references), and malicious pattern features (anti-VM code snippets, encryption / decryption function calls, etc.). This comprehensive feature extraction ensures that hidden traces of malicious code can be effectively identified.

[0089] File matching module 204: Used to perform file risk matching and detection on parsed files using a malicious code signature library.

[0090] File risk detection is performed by matching the malicious code signature database with file characteristics.

[0091] The extracted features are compared with a local malware signature database (including features specific to multi-stage attacks), focusing on identifying patterns such as spoofed filenames, anti-VM code snippets, and suspicious command calls. Detection results are synchronized to local records, and high-risk files trigger interception alerts.

[0092] The extracted features are precisely matched against a local malware signature database, which covers spoofed filename patterns, anti-VM code snippet hashes, malicious IP / URL lists, and suspicious command sequences. The risk level of the module is determined based on the matching results: high-risk files (such as those matching malicious samples by hash or containing anti-VM signatures) immediately trigger an interception prompt, providing options for deletion, isolation, or trust; medium-risk files alert the user to the risk and force dynamic detection; low-risk files record the results and allow import, achieving initial screening of malicious modules at a static level.

[0093] Upon static detection and during game loading, the runtime monitoring module automatically injects into the game process and initiates the behavior capture unit. This unit uses API hook technology to capture key behaviors of the module in real time, such as process creation, thread injection, network behavior (such as IP connection, data transmission), file behavior (such as access to sensitive paths), registry operations, and cross-process communication. It focuses on tracking the child processes and grandchild processes started by the initial process and establishes a complete process family tree relationship.

[0094] The captured real-time behavior is compared with a preset baseline of normal behavior, and a weighted scoring method is used to quantify the degree of anomaly (0-100 points). When abnormal behaviors such as connecting to unknown overseas IPs, frequently reading and writing browser password files, creating unauthorized auto-start items, or creating multi-stage processes are detected, a tiered response is triggered based on the anomaly score: low-risk anomalies send a prompt and log; medium-risk anomalies suspend the process and isolate files; high-risk anomalies immediately terminate the game process, block network connections, move module files into an encrypted sandbox, and generate a security report, achieving accurate interception of known malicious modules by combining with the local IOC library.

[0095] Main processing module 205: Used to implement parameter input, acquisition and function configuration of the read / write recognition module, file parsing module and data matching module.

[0096] By hooking system APIs using hooking technology, behaviors such as process creation, network communication (including IP and domain names), file reading and writing (including sensitive paths), and registry access can be captured in real time, with a focus on monitoring multi-stage activities such as the initial process and subsequent child processes.

[0097] When abnormal network connections (such as unfamiliar overseas IPs or unofficial communication domains), frequent reading and writing of sensitive files (browser credentials, account information files), or multi-stage process creation are detected, the activity is judged as malicious and warning measures such as suspending processes and isolating files are immediately taken, and a notification is sent to the user.

[0098] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0099] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0100] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a program product capable of implementing the methods described above is stored. In some possible embodiments, various aspects of the invention may also be implemented as a program product comprising program code that, when the program product is run on a terminal device, causes the terminal device to perform the steps of the various exemplary embodiments of the invention described in the "Exemplary Methods" section of this specification.

[0101] The program product may employ any combination of one or more readable media. A readable medium may be a readable signal medium or a readable storage medium. A readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of readable storage media (a non-exhaustive list) include: an electrical connection having one or more wires, a portable disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0102] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of sending, propagating, or transmitting programs for use by or in conjunction with an instruction execution system, apparatus, or device.

[0103] The program code contained on the readable medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0104] In an exemplary embodiment of this disclosure, an electronic device capable of implementing the above-described method is also provided.

[0105] Those skilled in the art will understand that various aspects of the present invention can be implemented as systems, methods, or program products. Therefore, various aspects of the present invention can be specifically implemented in the following forms: entirely in hardware, entirely in software (including firmware, microcode, etc.), or in a combination of hardware and software, collectively referred to herein as “circuit,” “module,” or “system.”

[0106] An electronic device according to this embodiment of the invention. The electronic device is merely an example and should not be construed as limiting the functionality or scope of the embodiments of the invention.

[0107] Electronic devices are manifested in the form of general-purpose computing devices. Components of an electronic device may include, but are not limited to: at least one processor, at least one memory, and buses connecting different system components (including memory and processor).

[0108] The storage device stores program code that can be executed by the processor to perform the steps described in the "Exemplary Methods" section above, according to various exemplary embodiments of the present invention.

[0109] The storage may include readable media in the form of volatile storage, such as random access memory (RAM) and / or cache memory, and may further include read-only memory (ROM).

[0110] The storage may also include programs / utilities having a set (at least one) of program modules, including but not limited to: an operating system, one or more applications, other program modules, and program data, each or some combination of these examples may include an implementation of a network environment.

[0111] A bus can represent one or more of several bus architectures, including a memory bus or memory controller, a peripheral bus, a graphics acceleration port, a processor, or a local bus that uses any of the various bus architectures.

[0112] Electronic devices can also communicate with one or more external devices (such as keyboards, pointing devices, Bluetooth devices, etc.), one or more devices that enable users to interact with the electronic device, and / or any device that enables the electronic device to communicate with one or more other computing devices (such as routers, modems, etc.). This communication can be performed through input / output (I / O) interfaces. Furthermore, electronic devices can also communicate with one or more networks (such as local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via network adapters.

[0113] Program code for performing the operations of this invention can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0114] Furthermore, the above figures are merely illustrative of the processes included in the method according to exemplary embodiments of the present invention, and are not intended to be limiting. It is readily understood that the processes shown in the above figures do not indicate or limit the temporal order of these processes. Additionally, it is readily understood that these processes may be executed synchronously or asynchronously, for example, in multiple modules.

[0115] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0116] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for detecting malicious code propagation in game modules, characterized in that, When a new module file is detected being written to the Mod folder, a preliminary detection of the module file is performed. Identify the source of module files and mark the corresponding risk level based on the file source; The module files are parsed according to the risk level to obtain the parsed files; The parsed files are analyzed using a malicious code signature database to perform file risk matching and detection. The malicious code signature database is a locally preset signature database.

2. The method as claimed in claim 1, characterized in that, Identify the source of the document and mark the corresponding risk level based on the source, including: Match the corresponding testing process according to the risk level; If the document originates from an unverified website, it will be marked as a high-risk source, triggering an enhanced detection process. If the document originates from a non-official mirror website, it will be marked as a medium-risk channel, triggering the standard detection process. If the document originates from an official website, it is marked as a low-risk channel, triggering a simplified detection process.

3. The method as described in claim 1, characterized in that, The module files are parsed according to their risk level, including: The module file is parsed into executable files, script files, resource files, and configuration files; Perform differential detection on executable files, script files, resource files, and configuration files, and extract features from multiple dimensions to obtain file features.

4. The method as described in claim 3, characterized in that, Document risk matching detection includes: File risk detection is performed by matching the malicious code signature database with file characteristics.

5. A detection device for detecting malicious code propagation in game modules, characterized in that, include: Pre-detection module: Used to perform pre-detection of module files when a new module file is detected being written to the Mod folder; Risk level confirmation module: used to identify the source of module files and mark the corresponding risk level according to the source of the files; File parsing module: Used to parse module files to obtain parsed files; File matching module: Used to perform file risk matching and detection on parsed files using a malicious code signature library; Main processing module: Used to implement parameter input, acquisition, and function configuration for the read / write recognition module, file parsing module, and data matching module.

6. The apparatus of claim 5, characterized in that, Identify the source of the document and mark the corresponding risk level based on the source, including: Match the corresponding testing process according to the risk level; If the document originates from an unverified website, it will be marked as a high-risk source, triggering an enhanced detection process. If the document originates from a non-official mirror website, it will be marked as a medium-risk channel, triggering the standard detection process. If the document originates from an official website, it is marked as a low-risk channel, triggering a simplified detection process.

7. The apparatus as claimed in claim 5, characterized in that, The module files are parsed according to their risk level, including: The module file is parsed into executable files, script files, resource files, and configuration files; Perform differential detection on executable files, script files, resource files, and configuration files, and extract features from multiple dimensions to obtain file features.

8. The method of claim 7, characterized in that, Document risk matching detection includes: File risk detection is performed by matching the malicious code signature database with file characteristics.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores at least one instruction or at least one program, which is loaded and executed by a processor to implement the method as claimed in any one of claims 1-4.

10. An electronic device, characterized in that, Includes a processor and the non-transitory computer-readable storage medium of claim 9.

Images