A multi-network environment simulation game server test system

Abstract

The application discloses a kind of multi-network environment simulation game server test system, it is related to information security technical field, including constructing a multi-node simulation test environment;According to the preset advanced persistent threat attack script, send the simulation service traffic that has the characteristics of covert attack fusion to target system;Dynamically trigger controllable fault injection operation to at least one security component in target system;Monitoring and recording the system behavior and security state evolution data of target system under the synergistic effect of simulation service traffic that has the characteristics of covert attack fusion and internal fault injection operation;Based on system behavior and security state evolution data, generate the evaluation result of target system security resilience.The application realizes high-fidelity, quantifiable evaluation of the security resilience of game server in complex disaster scenario;It can not only find the deep interweaving vulnerabilities of cross-business logic and security components that traditional testing cannot reach, continuously improve testing depth and efficiency.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a game server testing system that simulates multiple network environments. Background Technology

[0002] With the rapid development of the online gaming industry, game servers, as the central hub carrying core business logic and handling massive concurrent user data and interactions, are becoming increasingly complex and important. The security, stability, and resilience of game servers directly affect user experience, operator reputation, and the security of virtual assets. Therefore, it is crucial to conduct thorough testing of game servers under realistic threat environments before deployment. Currently, testing technologies for game servers mainly focus on the following aspects: Performance stress testing: By simulating a large number of concurrent user connections and basic operations, the server's throughput, response time, and resource utilization are tested. This type of testing focuses on the system's capacity limits under ideal or normal loads; Network simulation testing: Using software-defined networking or dedicated hardware devices, real network environment conditions are simulated to evaluate the robustness of game protocols and servers under network quality fluctuations. Performance and compatibility; security testing: mainly including vulnerability scanning, penetration testing, etc., aims to discover known security vulnerabilities in server software, configuration, or business logic. Some solutions will simulate basic DDoS attacks or protocol malformation attacks. However, existing technical solutions have significant shortcomings in dealing with increasingly complex modern network security threats, especially in evaluating the overall security resilience of the system: existing tests are usually conducted in isolation, with performance testing, network simulation, and single security testing separated from each other. However, advanced threats in the real world are often multi-stage composite attacks. Attackers will use various means to move laterally in the internal network, escalate privileges, or compromise defense systems while or after conducting external penetration. Traditional security test traffic often has significantly different characteristics from normal game business traffic and is easily identified by rule-based defense systems. The "degradation mode" and "recovery capability" of the system under pressure are not effectively measured.

[0003] However, current common solutions have many drawbacks, including: current game server testing technologies suffer from systemic defects such as fragmented test scenarios, lack of business concealment in attack simulations, single evaluation dimensions, and low efficiency in test case generation. These defects prevent them from truly and comprehensively evaluating the security resilience of servers when facing complex advanced threats and the combined effects of internal anomalies, and make it difficult to meet the actual needs of conducting in-depth security resilience verification of modern game servers. Summary of the Invention

[0004] The purpose of this section is to outline some aspects of embodiments of the present invention and to briefly describe some preferred embodiments. Simplifications or omissions may be made in this section, as well as in the abstract and title of this application, to avoid obscuring the purpose of these documents; however, such simplifications or omissions should not be construed as limiting the scope of the invention.

[0005] In view of the problems existing in the current game server testing system with multiple network environment simulation, the present invention is proposed.

[0006] Therefore, the purpose of this invention is to provide a game server testing system that simulates multiple network environments. This system is designed to address the systemic defects of current game server testing technologies, such as fragmented test scenarios, lack of business concealment in attack simulations, single evaluation dimensions, and low efficiency in test case generation. These defects prevent the system from truly and comprehensively evaluating the security resilience of servers when facing complex advanced threats and the combined effects of internal anomalies, and make it difficult to meet the actual needs of conducting in-depth security resilience verification of modern game servers.

[0007] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, embodiments of the present invention provide a game server testing method for multi-network environment simulation, comprising: constructing a multi-node simulation test environment; controlling a group of simulated attack nodes to send simulated service traffic with covert attack characteristics to a target system according to a preset advanced persistent threat attack script, in order to simulate an external penetration process; during the external penetration process, dynamically triggering a controllable fault injection operation against at least one security component inside the target system based on the real-time execution status of the attack script; monitoring and recording the system behavior and security status evolution data of the target system under the synergistic effect of the simulated service traffic with covert attack characteristics and the internal fault injection operation; and generating an assessment result of the security resilience of the target system based on the system behavior and security status evolution data.

[0008] As a preferred embodiment of the game server testing method for multi-network environment simulation described in this invention, the multi-node simulation test environment includes a group of simulated attack nodes for simulating external threats and at least one target system to be tested; the type and triggering timing of the fault injection operation are associated with the current stage of the attack script.

[0009] As a preferred embodiment of the game server testing method for multi-network environment simulation described in this invention, the preset advanced persistent threat attack script has attack logic arranged based on the business logic of the target game server, including at least one covert attack mode such as simulating the delivery of malicious modules using the game update mechanism and hiding command and control communication in the game chat protocol.

[0010] As a preferred embodiment of the game server testing method for multi-network environment simulation described in this invention, the dynamic triggering of a controllable fault injection operation targeting at least one security component within the target system specifically includes: receiving a trigger signal issued by the execution state of the attack script; selecting a matching fault injection operation from a predefined fault library according to the attack stage indicated by the trigger signal, wherein the fault injection operation includes at least one of: randomly terminating a specified security process, disrupting the security policy cache, simulating key management service interruption, or tampering with the security verification value in memory.

[0011] As a preferred embodiment of the game server testing method for multi-network environment simulation described in this invention, the monitoring and recording of the system behavior and security status evolution data of the target system specifically includes: synchronously collecting the target system's performance indicators, security logs, network traffic, and internal inter-process communication data; performing timestamp alignment and correlation analysis on the collected data to identify the abnormal behavior chain caused by external attack characteristics and internal faults under the synergistic effect.

[0012] As a preferred embodiment of the game server testing method for multi-network environment simulation described in this invention, the step of generating an assessment result of the security resilience of the target system based on system behavior and security state evolution data specifically includes: generating a quantitative score from multiple dimensions such as detection capability, response speed, self-recovery degree, and fault isolation effectiveness based on the detection and response status of the abnormal behavior chain; and generating a security event root cause and impact scope analysis report based on the quantitative score and the collaborative timeline of attack-fault injection.

[0013] As a preferred embodiment of the game server testing method for multi-network environment simulation described in this invention, the method involves: based on the evaluation results of historical tests, using a machine learning model to iteratively optimize the combination strategy of the advanced persistent threat attack script and the controllable fault injection operation, so as to adaptively generate test cases that are more capable of exposing deep security vulnerabilities in the target system.

[0014] Secondly, to further address the aforementioned technical problems, the present invention provides a game server testing system for multi-network environment simulation, comprising: an environment construction module for constructing a multi-node simulation testing environment; a penetration simulation module for controlling a group of simulated attack nodes to send simulated service traffic with covert attack characteristics to the target system according to a preset advanced persistent threat attack script, thereby simulating an external penetration process; a fault injection module for dynamically triggering a controllable fault injection operation against at least one security component within the target system based on the real-time execution status of the attack script during the external penetration process; a collaborative detection module for monitoring and recording the evolution data of system behavior and security status of the target system under the synergistic effect of simulated service traffic with covert attack characteristics and internal fault injection operations; and an evaluation and analysis module for generating an evaluation result of the security resilience of the target system based on the system behavior and security status evolution data.

[0015] Thirdly, embodiments of the present invention provide a computer device, including a memory and a processor, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements any step of the game server testing method for multi-network environment simulation as described in the first aspect of the present invention.

[0016] Fourthly, embodiments of the present invention provide a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the game server testing method for multi-network environment simulation as described in the first aspect of the present invention.

[0017] The beneficial effects of this invention are as follows: By combining advanced persistent threat simulation based on game business logic orchestration with dynamically triggered internally controllable fault injection and implementing multi-dimensional data correlation analysis, this invention achieves for the first time a high-fidelity, quantifiable assessment of the security resilience of game servers under complex disaster scenarios. It can not only discover deep-seated vulnerabilities that are difficult to reach through traditional testing, but also continuously improve the depth and efficiency of testing through machine learning-driven test case self-evolution. This forms a complete automated closed loop from threat simulation, collaborative pressure application, intelligent monitoring to quantitative assessment, upgrading server security testing from passive vulnerability discovery to proactive resilience building and measurement. Attached Figure Description

[0018] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort. Wherein: Figure 1 This is a flowchart illustrating the implementation of the present invention in Example 1.

[0019] Figure 2 This is a dynamic adjustment diagram of the present invention in Example 1. Detailed Implementation

[0020] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0021] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0022] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments. Example 1

[0023] Reference Figure 1 and Figure 2 This is the first embodiment of the present invention, which provides a game server testing method for simulating multiple network environments, including the following steps: S1: Construct a multi-node simulation test environment.

[0024] Preferably, the multi-node simulation test environment includes a group of simulated attack nodes for simulating external threats and at least one target system to be tested.

[0025] Specifically, the multi-node simulation test environment is built on a cloud computing platform or a privately deployed virtualization technology.

[0026] Furthermore, the simulated attack node group consists of multiple lightweight container or virtual machine instances, each instance carrying an agent program that can execute attack scripts; the target system to be tested is a complete game server suite deployed on a separate virtual machine or physical server.

[0027] Specifically, the nodes are connected via software-defined networking (SDN). The SDN controller is used to dynamically configure network policies during testing and simulate various network impairment conditions, including latency, packet loss, and bandwidth limitations, in order to build a realistic 'multi-network environment'.

[0028] Preferably, a high-fidelity, dynamically orchestratable multi-node simulation test environment was constructed based on cloud-native architecture and software-defined networking technology. This environment not only simulates network layer damage conditions, but more importantly, it provides an isolated, controllable, and highly realistic experimental field for subsequent complex collaborative attack tests. This environment can accurately reproduce various network fluctuation scenarios that game servers may face in production networks, ensuring that the security pressures applied subsequently have a real network context. As a result, the test results have higher credibility and reference value when evaluating the resilience performance of servers in real network environments.

[0029] For example, the multi-node simulation test environment is built on a public cloud (such as Alibaba Cloud or AWS). The simulated attack node group consists of a group of Kubernetes Pods (containers) across availability zones. Each Pod runs a customized "attack agent" microservice. The target system to be tested is deployed on an independent cloud server (ECS) instance with resource configuration simulating a production environment. The game's gateway, logic services, and database services are fully installed on it. By calling the cloud service provider's SDNAPI (such as Alibaba Cloud VPC routing table or AWS Transit Gateway), the test console can dynamically create policies during the test. For example, during the attack penetration phase, a constant latency of 100ms and a random packet loss of 2% can be injected into the subnet where the target system is located to simulate the real network conditions of cross-regional attacks.

[0030] S2: Controls a group of simulated attack nodes to send simulated service traffic with covert attack characteristics to the target system according to a preset advanced persistent threat attack script, in order to simulate the external penetration process.

[0031] Preferred, pre-defined advanced persistent threat attack scripts have attack logic arranged based on the business logic of the target game server, including at least one covert attack mode such as simulating the delivery of malicious modules using the game update mechanism and hiding command and control communication in the game chat protocol.

[0032] Specifically, the pre-defined Advanced Persistent Threat (APT) attack scripts are defined in a structured scripting language (such as YAML or JSON), which includes the attack phase sequence, the attack vector plugins to be called at each phase, and the signal points that trigger fault injection.

[0033] Furthermore, the penetration simulation module loads the script and controls the execution of agents in the simulated attack node group. 'Simulated business traffic with covert attack characteristics' is generated in the following way: The proxy program first generates basic business traffic that conforms to the game client protocol specifications (such as login requests and mobile synchronization packages). Then, according to the script, it calls a specific attack vector plugin. This plugin embeds or replaces non-critical or variable fields (such as chat content, character names, and extended data segments) in the business traffic protocol with malicious payloads (such as encoded commands and control instructions), thereby forming a hybrid traffic that appears compliant but contains attack characteristics.

[0034] For example, an advanced persistent threat (APS) attack script defines a sequence called "malicious update penetration." The script first instructs the emulated attack node to simulate a normal player logging in and entering the game lobby. Then, in the "check for updates" phase, a specially built "update package poisoning" plugin is invoked. This plugin generates a pseudo response packet that conforms to the game update protocol format. After the legitimate version description field, a shellcode payload that has been Base64 encoded and XOR obfuscated is appended. The proxy program sends this response packet to the target server's update service, thereby simulating the stealthy penetration process of an attacker compromising the update server or performing a man-in-the-middle attack to distribute a malicious update program to the client (simulated by the emulated node).

[0035] S3: During the external penetration process, based on the real-time execution status of the attack script, dynamically trigger a controlled fault injection operation targeting at least one security component inside the target system.

[0036] Preferably, the type and timing of the fault injection operation are associated with the current stage of the attack script.

[0037] Furthermore, dynamically triggering controlled fault injection operations targeting at least one security component within the target system, specifically including: Receive trigger signals from the execution status of the attack script; Based on the attack phase indicated by the trigger signal, a matching fault injection operation is selected from a predefined fault library. The fault injection operation includes at least one of the following: randomly terminating a specified security process, disrupting the security policy cache, simulating a key management service interruption, or tampering with a security check value in memory.

[0038] Furthermore, the attack script predefines multiple 'fault injection signal points', each of which is associated with a specific attack phase (e.g., after 'successful privilege escalation'). When the script engine executes to the signal point, it sends a structured trigger signal (containing information such as the target system identifier and the type of component to be injected with faults) to the fault injection module.

[0039] Specifically, the fault injection module is deployed on the host machine of the target system or a nearby node reachable through the management network. It has a built-in predefined fault library. After receiving a trigger signal, the module performs the corresponding fault injection operation according to the signal content by calling the debugging interface provided by the operating system, sending control commands to the target container, or simulating network interruption. For example, 'randomly terminating a specified security process' is achieved by sending a SIGKILL signal to the process; 'disrupting the security policy cache' is achieved by sending specific invalid or conflicting configuration commands to the security subsystem of the target system.

[0040] Preferably, an extreme test scenario of "stress-vulnerability resonance" is actively constructed. By combining highly covert external penetration based on business logic with precise fault injection targeting internal security components that is dynamically triggered at critical stages of the attack, this solution can systematically explore and expose the deep vulnerabilities and logical defects of the target system under complex and sequential threats. This synergistic pressure of "internal and external attack" can reveal the security blind spots and failure modes that the system is always hidden under a single threat or random failure, such as the intertwined risks that are difficult to find by traditional testing, such as the bypassing of business logic verification due to the instantaneous failure of security components.

[0041] For example, after the attack script completes the "update package poisoning" phase, a pre-defined "fault injection signal point" is triggered. The script engine sends a signal to the fault injection module with the content {"target":"game-server-01","phase":"post_update_poison","fault_type":"security_process_kill"}. The fault injection module, based on the predefined mapping, parses the operation matching this phase as "randomly terminate the anti-cheat core process". Subsequently, the module connects to the target host machine via SSH or a proxy and executes the command pkill -f'acs.exe' (assuming acs.exe is the anti-cheat process). This artificially creates a window of failure for a critical security component at a sensitive moment when malicious update traffic may have triggered the execution of malicious code in memory, testing whether other parts of the system (such as the behavior analysis engine) can effectively take over or issue an alert.

[0042] S4: Monitor and record the evolution of the target system's behavior and security status under the combined effect of simulated business traffic with covert attack characteristics and internal fault injection operations.

[0043] Preferably, the system behavior and security status evolution data of the target system are monitored and recorded, specifically including: Synchronously collect the target system's performance metrics, security logs, network traffic, and internal inter-process communication data; The collected data is time-stamped and correlation-analyzed to identify abnormal behavior chains caused by a combination of external attack characteristics and internal faults under synergistic effects.

[0044] Furthermore, the collaborative detection module achieves synchronous data collection by deploying a lightweight acquisition agent (such as eBPF-based technology) within the target system and external distributed traffic probes.

[0045] Furthermore, the collected data is uniformly sent to a time-series database for storage. The 'timestamp alignment and correlation analysis' is completed by the data analysis submodule, which adopts a rule-based and statistical correlation engine: First, all incoming data streams are stamped with a high-precision unified timestamp; then, a time window is set. Within this window, if an external attack feature is successfully parsed (such as a specific malicious payload being restored), and a specific fault event triggered by the fault injection module occurs within the target system at a similar time point (e.g., within 5 seconds before and after) (such as a security process exiting), the analysis engine correlates these two events and initiates a pattern scan of all logs and performance indicators of the target system in the subsequent time period to trace the abnormal behavior chain caused by this, such as a surge in the error rate of a service or abnormal external connection attempts.

[0046] Preferably, it achieves a leap from discrete "symptom monitoring" to systematic "causal graph construction". By synchronously collecting and correlating multi-dimensional data such as performance indicators, security logs, network traffic and inter-process communication based on high-precision timestamps, it can automatically identify and reconstruct the complete abnormal behavior chain caused by the collaboration of external attacks and internal failures. This can not only greatly shorten the time spent on root cause analysis of security incidents, but also clearly reveal from the data level how attack vectors use internal failures as "stepping stones" or "amplifiers" to evolve into a dynamic process of substantive security incidents, providing unprecedented data insights for precise hardening.

[0047] For example, during test execution, an eBPF probe deployed at the target system kernel layer continuously captures the execve system calls and network connection events of all processes. At the same time, a DPDK probe deployed in a bypass mode mirrors all network traffic entering and leaving the target system. All events and traffic packets are appended with nanosecond-precision timestamps and flow into a central TimescaleDB (time-series database). The correlation analysis engine has a preset rule: if a specific payload matching the characteristics of "malicious update penetration" is identified in the network traffic within a 5-second time window and an abnormal exit event of the anti-cheat process (abnormal exit code) appears in the system call log, then the correlation is triggered. The engine then scans all database logs for a period of time thereafter and successfully discovers an encrypted outbound connection behavior initiated by the game's main process after the anti-cheat process exits, which is directed to an abnormal overseas IP address. This completely outlines an abnormal behavior chain of "penetration → security component failure → data leakage".

[0048] S5: Based on system behavior and security state evolution data, generate an assessment result of the security resilience of the target system.

[0049] Specifically, based on system behavior and security state evolution data, an assessment result of the security resilience of the target system is generated, including: Based on the detection and response to abnormal behavior chains, quantitative scores are generated from multiple dimensions, including detection capability, response speed, self-recovery level, and fault isolation effectiveness. Based on the collaborative timeline of quantitative scoring and attack-fault injection, a report analyzing the root causes and scope of impact of security incidents is generated.

[0050] It should be noted that, based on the evaluation results of historical tests, machine learning models are used to iteratively optimize the combination strategy of advanced persistent threat attack scripts and controlled fault injection operations in order to adaptively generate test cases that are more able to expose deep security vulnerabilities in the target system.

[0051] Furthermore, the quantitative scores and root cause reports generated by the evaluation and analysis module are fed back to the test case optimization engine as training data. This engine employs a reinforcement learning model (e.g., Deep Q-Network), where State is defined as a summary of the target system's current configuration characteristics and historical test performance; Action is defined as adjustments to parameters such as attack vector selection, fault injection point location, and fault type in the attack script; and Reward is calculated based on the 'security resilience assessment results' generated by subsequent tests (e.g., a high reward for discovering new vulnerabilities and a low reward for repeated tests that fail to discover them). By continuously trying different 'state-action' combinations, the model learns strategies to maximize cumulative rewards, thereby automatically generating more effective attack-fault combination test cases.

[0052] Preferably, the one-off testing task is transformed into a continuously self-evolving "adaptive security resilience optimization" closed loop. First, by generating quantitative scores and root cause reports from four dimensions—detection, response, recovery, and isolation—it provides a measurable and comparable objective evaluation system for the abstract concept of "security resilience," guiding security construction from meeting compliance baselines to pursuing resilience capabilities. Second, the test case self-optimization mechanism based on reinforcement learning enables the system to autonomously explore more effective "attack-failure" combination strategies, thereby achieving intelligent deepening of test coverage and continuous improvement in efficiency. This transforms security testing from a passive mode relying on expert experience to a proactive and adaptive exploration mode driven by data and algorithms.

[0053] For example, after this test was completed, the evaluation and analysis module calculated various scores based on the abnormal behavior chain discovered by S4: the detection capability score was low (because the system did not actively alert to malicious update traffic); the response speed score was zero (the system did not automatically isolate the abnormal process); but the fault isolation effectiveness score was medium (the game service did not completely crash). These scores, along with the original attack-fault parameters, served as an empirical sample and were input into a reinforcement learning model based on the PPO (Proximity Policy Optimization) algorithm. After dozens of iterations, the model discovered that combining "update package poisoning" with "disrupting the security policy cache" (instead of terminating the process) and triggering it with a 300-millisecond delay after penetration could more likely cause the game logic server to be misconfigured, thereby exposing new business logic vulnerabilities. Based on this, the system automatically generated and executed optimized test cases, realizing the adaptive evolution of the test strategy.

[0054] In summary, this invention combines advanced persistent threat simulation based on game business logic orchestration with dynamically triggered internally controlled fault injection, and implements multi-dimensional data correlation analysis. For the first time, it achieves a high-fidelity, quantifiable assessment of the security resilience of game servers under complex disaster scenarios. It can not only discover deep-seated vulnerabilities that are difficult to reach through traditional testing, but also continuously improve the depth and efficiency of testing through machine learning-driven test case self-evolution. This forms a complete automated closed loop from threat simulation, collaborative stress application, intelligent monitoring to quantitative assessment, upgrading server security testing from passive vulnerability discovery to proactive resilience building and measurement.

[0055] Example 2, an embodiment of the present invention, provides a game server testing system for multi-network environment simulation, comprising: an environment construction module for constructing a multi-node simulation test environment; a penetration simulation module for controlling a group of simulated attack nodes to send simulated service traffic with covert attack characteristics to the target system according to a preset advanced persistent threat attack script, in order to simulate an external penetration process; a fault injection module for dynamically triggering a controllable fault injection operation against at least one security component inside the target system based on the real-time execution status of the attack script during the external penetration process; a collaborative detection module for monitoring and recording the evolution data of system behavior and security status of the target system under the synergistic effect of simulated service traffic with covert attack characteristics and internal fault injection operation; and an evaluation and analysis module for generating an evaluation result of the security resilience of the target system based on the system behavior and security status evolution data.

[0056] Example 3 is an embodiment of the present invention, which differs from the previous embodiment in that: If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0057] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-including system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0058] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0059] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0060] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A method for testing game servers in a multi-network environment simulation, characterized in that: include: Construct a multi-node simulation test environment; Control the simulated attack node group and send simulated service traffic with covert attack characteristics to the target system according to the preset advanced persistent threat attack script to simulate the external penetration process. During the external penetration process, based on the real-time execution status of the attack script, a controlled fault injection operation is dynamically triggered against at least one security component inside the target system. Monitor and record the system behavior and security status evolution data of the target system under the combined effect of the simulated service traffic with covert attack characteristics and the internal fault injection operation; Based on the system behavior and security state evolution data, an assessment result of the security resilience of the target system is generated.

2. The game server testing method for multi-network environment simulation as described in claim 1, characterized in that: The multi-node simulation test environment includes a group of simulated attack nodes for simulating external threats and at least one target system to be tested. The type and timing of the fault injection operation are associated with the current stage of the attack script.

3. The game server testing method for multi-network environment simulation as described in claim 2, characterized in that: The preset advanced persistent threat attack scripts are based on the business logic of the target game server and include at least one covert attack mode such as simulating the delivery of malicious modules using the game update mechanism and hiding command and control communication in the game chat protocol.

4. The game server testing method for multi-network environment simulation as described in claim 1, characterized in that: The dynamically triggered controllable fault injection operation targeting at least one security component within the target system specifically includes: Receive the trigger signal issued by the execution status of the attack script; Based on the attack phase indicated by the trigger signal, a matching fault injection operation is selected from a predefined fault library. The fault injection operation includes at least one of the following: randomly terminating a specified security process, disrupting the security policy cache, simulating a key management service interruption, or tampering with a security check value in memory.

5. The game server testing method for multi-network environment simulation as described in claim 1, characterized in that: The monitoring and recording of the system behavior and security status evolution data of the target system specifically includes: Synchronously collect the target system's performance metrics, security logs, network traffic, and internal inter-process communication data; The collected data is time-stamped and correlation-analyzed to identify the abnormal behavior chain caused by the combined effects of external attack features and internal faults.

6. The game server testing method for multi-network environment simulation as described in claim 1, characterized in that: The assessment results of the security resilience of the target system, generated based on system behavior and security state evolution data, specifically include: Based on the detection and response to the abnormal behavior chain, a quantitative score is generated from multiple dimensions, including detection capability, response speed, self-recovery degree, and fault isolation effectiveness. Based on the quantitative scoring and the collaborative timeline of attack-fault injection, a root cause and impact analysis report of the security incident is generated.

7. The game server testing method for multi-network environment simulation as described in claim 1, characterized in that: Based on the evaluation results of historical tests, the combination strategy of the advanced persistent threat attack script and the controlled fault injection operation is iteratively optimized using a machine learning model to adaptively generate test cases that are more capable of exposing deep security vulnerabilities in the target system.

8. A game server testing system simulating multiple network environments, based on the game server testing method simulating multiple network environments as described in any one of claims 1 to 7, characterized in that: include, The environment building module is used to build a multi-node simulation test environment. The penetration simulation module is used to control a group of simulated attack nodes and send simulated business traffic with covert attack characteristics to the target system according to a preset advanced persistent threat attack script, so as to simulate the external penetration process. The fault injection module is used to dynamically trigger a controllable fault injection operation against at least one security component inside the target system based on the real-time execution status of the attack script during the external penetration process. The collaborative detection module is used to monitor and record the evolution data of the target system's system behavior and security status under the combined effect of simulated business traffic with covert attack characteristics and internal fault injection operations. The assessment and analysis module is used to generate assessment results of the security resilience of the target system based on system behavior and security state evolution data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the game server testing method for multi-network environment simulation as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the game server testing method for multi-network environment simulation as described in any one of claims 1 to 7.

Images