Game security real-time monitoring system based on artificial intelligence and big data

Abstract

The application relates to the technical field of terminal security, in particular to a game security real-time monitoring system based on artificial intelligence and big data, which comprises a time beat monitoring module, which is used for extracting a game client reading time tag instruction value, dividing the reading time tag instruction value by a processor frequency value, obtaining a hardware beat period number, and extracting an operating system process system time return value. In the application, local tampering intrusion events and current game client running time steps are extracted, a replacement reset action is implemented to generate a countermeasure reset time beat, a conventional system interface calling operation is directly discarded for a kernel communication link, communication connection is forced to be switched to a more bottom-layer system calling interface, a connection request packet data is issued under the countermeasure reset time beat, and a local intrusion takeover feedback instruction is acquired, control right is seized at the bottom layer of the operating system, a malicious process intervention path is cut off, and real-time countermeasure success rate in a high confrontation interactive scene is improved.

Description

Technical Field

[0001] This invention relates to the field of terminal security technology, and in particular to a real-time game security monitoring system based on artificial intelligence and big data. Background Technology

[0002] In the field of endpoint security technology, we focus on a comprehensive defense system that protects various hardware nodes (such as personal computers, mobile smart devices, IoT terminals, etc.) connected to enterprise networks or operating independently from malware intrusion, unauthorized access, and various advanced persistent threats (APTs).

[0003] Current endpoint security systems heavily rely on macro-level access control policies deployed at the network boundary or operating system application layer, along with static malware signature comparison mechanisms, for defense. The inherent operational mode of extracting known threat samples to build a signature database and then comparing and intercepting running processes in the system limits the defense perspective to file hash value matching and coarse-grained process permission auditing. When faced with advanced evasion attacks in interactive environments, such as targeted dynamic memory tampering or clock acceleration, conventional defense architectures lack the means to detect subtle anomalies in the underlying hardware's operating rhythm and kernel instruction round-trip latency, easily creating large detection blind spots. Attackers can easily modify the return value of client time reading functions by injecting customized speed-changing tools. Conventional security mechanisms, if unable to find known static signatures and deeming process call permissions compliant, will directly allow underlying numerical modification. Therefore, improvements are needed. Summary of the Invention

[0004] The purpose of this invention is to address the shortcomings of existing technologies by proposing a real-time game security monitoring system based on artificial intelligence and big data.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: a game security real-time monitoring system based on artificial intelligence and big data includes: The time tick monitoring module is used to extract the game client's read time tag instruction value, divide the read time tag instruction value by the processor frequency value to obtain the hardware tick cycle number, extract the system time return value of the operating system process, store the system time return value and the hardware tick cycle number into a circular queue sequence, and calculate the clock elapse rate ratio. The request latency monitoring module is used to send probe input / output request packet data to the underlying driver, collect the round-trip time value corresponding to the probe input / output request packet data, obtain the kernel latency deviation, extract the basic latency benchmark value and the kernel latency deviation, and calculate the kernel request signal-to-noise ratio value. The local intrusion analysis module is used to extract the clock elapsed rate ratio and the kernel request signal-to-noise ratio value, calculate the variance value corresponding to the clock elapsed rate ratio, compare the variance value with the deviation threshold to obtain the time tampering anomaly identifier, and compare the kernel request signal-to-noise ratio value with the attenuation safety limit to obtain the local tampering intrusion event. The kernel interception and countermeasure module is used to extract the local tampering intrusion event, extract the current running time step corresponding to the game client, replace it to obtain the countermeasure reset time beat, perform the operation of abandoning the regular system interface call on the kernel communication link, switch the communication connection to the system call interface, extract the connection request packet data sent by the countermeasure reset time beat, and obtain the local intrusion takeover feedback instruction.

[0006] Preferably, the step of obtaining the clock elapsed rate ratio is as follows: Extract the game client's read time tag command value, read the processor frequency value, divide the read time tag command value by the processor frequency value, calculate the number of hardware tick cycles, retrieve the system time return value, and construct a circular queue sequence with initial storage space. The system time return value and hardware cycle number are input to determine whether the number of nodes is greater than the full load preset threshold. If it is greater than the full load preset threshold, discrete difference operation is performed on the circular queue sequence value to extract the time change difference and obtain the derivative value of the discrete matrix sequence. Based on the derivative value of the discrete point matrix sequence, the mean time difference of the ring queue nodes for each monitoring period is retrieved to obtain the nominal operating frequency of the hardware clock and the actual measured frequency of the hardware clock, and the ratio of clock elapse rate is calculated.

[0007] Preferably, the step of obtaining the kernel delay deviation is as follows: Send probe input / output request packet data to the underlying driver, record the timestamp parameter corresponding to the action, listen to the system's underlying feedback channel and capture the timestamp parameter at the moment the response arrives, calculate the difference between the absolute values ​​of the two timestamp parameters, collect the round-trip time value corresponding to the probe input / output request packet data, and obtain the round-trip time value. Retrieve the baseline time consumption value fixed in the system kernel space, verify whether the round-trip time value is greater than or equal to the baseline time consumption value, and if the verification is successful, subtract the baseline time consumption value from the round-trip time value, extract the timing residual data generated by the subtraction operation, and obtain the kernel delay deviation.

[0008] Preferably, the step of obtaining the time tampering anomaly identifier is as follows: Collect multiple clock elapsed rate ratios within a continuous time period for data statistics, calculate the variance value corresponding to the clock elapsed rate ratio, retrieve the deviation threshold configured by the system, compare the variance value with the deviation threshold, and perform a recording action when the variance value is greater than the deviation threshold to obtain a time tampering anomaly flag.

[0009] Preferably, the step of obtaining the local tampering intrusion event is as follows: Extract the kernel request signal-to-noise ratio value, retrieve the attenuation safety limit in the memory protection policy, compare the kernel request signal-to-noise ratio value with the attenuation safety limit value, confirm the specific operating environment where the kernel request signal-to-noise ratio value is less than the attenuation safety limit, establish a logical association between the operating environment and the time tampering anomaly identifier, and obtain the anomaly combination judgment status. Based on the abnormal combination judgment state, verify that the logical condition that the variance value is greater than the deviation threshold and the kernel request signal-to-noise ratio value is less than the attenuation safety limit is met. Under the state that the variance value is greater than the deviation threshold and the kernel request signal-to-noise ratio value is less than the attenuation safety limit, extract the time tampering anomaly identifier, perform qualitative analysis on the time tampering anomaly identifier, and obtain the local tampering intrusion event.

[0010] Preferably, the step of obtaining the counter-reset time tick is as follows: Once the system confirms receipt of the local tampering intrusion event, it extracts the current running time step corresponding to the game client, retrieves the clock data corresponding to the read time tag instruction value stored in the memory buffer, performs a memory value overwrite operation, replaces and resets the current running time step corresponding to the game client with the clock data corresponding to the read time tag instruction value, and generates a counter-reset time beat.

[0011] Preferably, the step of obtaining the local intrusion takeover feedback instruction is as follows: Based on the counter-reset time tick, the kernel communication link at the operating system's bottom layer is located, the original standard application transmission path is blocked, and the conventional system interface call operation is abandoned for the kernel communication link. The communication connection is bypassed by the intermediate application layer encapsulation, the communication connection is switched to the system call interface, and a direct secure channel with low-level execution permissions is established, forming a system-level call communication link.

[0012] Preferably, the step of obtaining the local intrusion takeover feedback instruction further includes: The counter-reset time tick is re-extracted and used as the instruction payload parameter. Connection request packet data is sent based on the system-level call communication link. The status feedback communication port of the underlying operating system is monitored in real time. The takeover confirmation execution signal returned by the connection request packet data is captured to obtain the local intrusion takeover feedback instruction.

[0013] Compared with the prior art, the advantages and positive effects of the present invention are as follows: In this invention, the hardware tick count is calculated by dividing the game client's read time tag instruction value by the processor frequency. Simultaneously, the system time return value from the operating system process is extracted and combined with the hardware tick count into a circular queue for processing. This process deduces the clock elapsed rate ratio, constructing a hardware-level time base with anti-interference capabilities, thus mitigating the risk of malicious hijacking and tampering of the application-layer time interface. Probe input / output request packets are sent to the underlying driver, and round-trip time values ​​are collected. Combined with the basic time base value, the kernel latency deviation is extracted. Based on this, the product of the corresponding logarithm and constant coefficient of the basic time base value and the kernel latency deviation is calculated to obtain the kernel request signal-to-noise ratio value. This achieves deep perception of the purity of the kernel communication link and captures communication delays caused by hidden interception hooks. This process extracts the clock elapsed rate ratio, calculates the corresponding variance value, and compares it with the deviation threshold to obtain a time tampering anomaly identifier. It also cross-compares the kernel request signal-to-noise ratio (SNR) value with the attenuation safety limit. When the variance value exceeds the deviation threshold and the kernel request SNR value is below the attenuation safety limit, it locks the local tampering intrusion event, achieving high-dimensional qualitative analysis of micro-level operational anomalies without relying on a static feature library. It extracts the local tampering intrusion event and the current running time step of the game client, implements a replacement reset action to generate a counter-reset time tick, and directly abandons conventional system interface call operations for kernel communication links, forcibly switching the communication connection to a lower-level system call interface. Based on the counter-reset time tick, it sends connection request packet data and obtains local intrusion takeover feedback instructions, seizing control at the lowest level of the operating system, cutting off the malicious process intervention path, and improving the real-time counter-attack success rate in high-adversarial interaction scenarios. Attached Figure Description

[0014] Figure 1 This is a system flowchart of the present invention. Detailed Implementation

[0015] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0016] Please see Figure 1 This invention provides a technical solution: a game security real-time monitoring system based on artificial intelligence and big data, comprising: The time tick monitoring module is used to extract the game client's read time tag instruction value, divide the read time tag instruction value by the processor frequency value to obtain the hardware tick cycle number, extract the system time return value of the operating system process, store the system time return value and the hardware tick cycle number into a circular queue sequence, and calculate the clock elapse rate ratio. The request latency monitoring module is used to send probe input / output request packet data to the underlying driver, collect the round-trip time value corresponding to the probe input / output request packet data, obtain the kernel latency deviation, extract the basic latency benchmark value and the kernel latency deviation, and calculate the kernel request signal-to-noise ratio value. The local intrusion analysis module is used to extract the clock elapsed rate ratio and the kernel request signal-to-noise ratio, calculate the variance value corresponding to the clock elapsed rate ratio, compare the variance value with the deviation threshold to obtain the time tampering anomaly flag, and compare the kernel request signal-to-noise ratio value with the attenuation safety limit to obtain the local tampering intrusion event. The kernel interception and countermeasure module is used to extract local tampering intrusion events, extract the current running time step corresponding to the game client, replace it to obtain the countermeasure reset time tick, perform the operation of abandoning the regular system interface call on the kernel communication link, switch the communication connection to the system call interface, extract the connection request packet data sent by the countermeasure reset time tick, and obtain the local intrusion takeover feedback instruction.

[0017] The steps to obtain the clock elapsed rate ratio are as follows: Extract the game client's read time tag command value, read the processor frequency value, divide the read time tag command value by the processor frequency value, calculate the number of hardware tick cycles, retrieve the system time return value, and construct a circular queue sequence with initial storage space. The system time return value and hardware cycle number are input to determine whether the number of nodes is greater than the full load preset threshold. If it is greater than the full load preset threshold, the discrete difference operation is performed on the circular queue sequence value to extract the time series change difference and obtain the derivative value of the discrete matrix sequence. Based on the derivative value of the discrete lattice sequence, the average time difference of the circular queue nodes for each monitoring period is retrieved to obtain the nominal operating frequency and the actual measured frequency of the hardware clock. The ratio of clock elapsed rate is then calculated, expressed as: ; in, For the first The ratio of clock elapsed rate for each monitoring period, For the first The derivative values ​​of the discrete lattice series for each monitoring period, For the first Mean time difference of the nodes in the circular queue for each monitoring period The nominal operating frequency of the hardware clock. The actual measured frequency of the hardware clock.

[0018] Specifically, within the runtime environment, the underlying application programming interface is called to obtain the read timestamp instruction value running within the game client. For example, the accumulated clock cycles since processor startup are obtained by calling embedded assembly instructions as the read timestamp instruction value. A valid verification range for the read timestamp instruction value is set. For example, the lower limit of the verification value is set to the minimum number of cycles required for basic loading after device startup (1,000,000), and the upper limit is set to the maximum theoretical number of cycles reached by the processor running continuously for 30 days (9,000,000,000). The obtained instruction value is compared to see if it falls within the range of 1. The value is between 000000 and 90000000000. If it is not within this range, a 10-millisecond delay is applied before re-acquiring the instruction. Then, the hardware abstraction layer interface is accessed to read the processor's base operating frequency. This requires reading the processor's nominal frequency parameters recorded in the motherboard's basic input / output system. For example, if the processor frequency is read as 2.5GHz (2500000000Hz), the frequency is checked to ensure it falls within the standard hardware range of 1GHz to 5GHz. Finally, a division operation is performed, dividing the acquired read timestamp instruction value by the processor frequency. The rate value, calculated by dividing the example read timestamp instruction value 5000000000 by the processor frequency value 2500000000Hz, yields a hardware tick cycle of 2 seconds. This value reflects the actual time span elapsed at the physical level by the processor and serves as the physical benchmark for subsequent determination of whether the time has been tampered with. Then, the current system time return value is extracted using a time acquisition function. For example, a low-level function is called to obtain a system time return value with a precision of 100 nanoseconds. This return value is multiplied by 0.0000001 to convert it into a floating-point number in seconds, and then stored in memory. A contiguous storage area is allocated, and the initial storage space size is configured according to the pre-evaluated monitoring time window and sampling frequency. For example, the sampling frequency is set to 200 samples per second, and historical state data within the past 15 seconds needs to be saved. Multiplying 200 by 15 calculates the required capacity of 3000 nodes. 16 bytes are allocated to each node to store data such as time tags and frequency. Multiplying 3000 by 16 allocates a total memory block of 48000 bytes. The head and tail pointers of the memory block are initialized to zero offset positions, and a circular queue sequence with initial storage space is constructed.

[0019] The system time return value and hardware tick count obtained earlier are paired as data pairs and fed into the memory node pointed to by the tail pointer of the previously constructed circular queue sequence in chronological order. After each data pair is fed in, the tail pointer is moved forward by one node position. If the tail pointer reaches the end of the memory block, it is reset back to the beginning to achieve circular overwriting. Simultaneously, the total number of data nodes currently stored in the circular queue sequence is incremented by one. The currently counted node quantity parameter is extracted, and it is determined whether the node quantity is greater than the full load preset threshold. The full load preset threshold is set by extracting the total safe available memory in the runtime environment and setting the safe available memory as the maximum available memory. The theoretical maximum number of nodes is calculated by dividing the total available memory by the fixed 16-byte memory capacity occupied by each data node. For example, if the detected safe available memory is 48,000 bytes, dividing it by 16 bytes yields a theoretical maximum of 3,000 nodes. To reserve sufficient buffer space and prevent memory overflow from causing program crashes, the theoretical maximum number of nodes (3,000) is multiplied by a memory safety margin factor of 0.8. This multiplication operation yields 2,400, which is used as the preset threshold for full load. Then, the current actual number of nodes, for example, 2,500, is compared with this preset threshold of 2,400. If the current number of nodes is found to be 2,500... When the load exceeds the preset threshold of 2400, a deep data extraction and calculation operation is triggered. Following the time elapsed order from the head pointer to the tail pointer, the hardware clock cycle counts recorded in all adjacent pairs of nodes in the circular queue sequence are read sequentially. Discrete difference operations are then performed on the hardware clock cycle counts of adjacent pairs of nodes. Specifically, the hardware clock cycle count of the later node is subtracted from the hardware clock cycle count of the earlier node. For example, if the value of the later node is 2.05 seconds and the value of the earlier node is 2.00 seconds, the difference of 0.05 seconds is extracted as the timing difference. This subtraction operation is repeated until... After traversing the entire fully loaded circular queue sequence, extract the timing variation difference array containing multiple elements. Then, extract the system time return values ​​of two adjacent nodes in the same way and subtract them to obtain the corresponding system time difference. For example, if the later system time return value is 1000.04 seconds and the previous system time return value is 1000.00 seconds, the difference is 0.04 seconds. Divide the previously extracted 0.05-second timing variation difference by the 0.04-second system time difference. By dividing the physical layer hardware time difference obtained by the difference operation by the operating system layer system time difference, the derivative value of the discrete lattice sequence is obtained.

[0020] The formula for calculating the ratio of clock elapsed rates introduces a cross-weighted correlation structure between the derivative value of the discrete lattice sequence and the mean of the time difference of the circular queue nodes and the frequency square. It is combined with an exponential decay penalty function based on the difference of absolute value. The beneficial effect of this design is that when the elapsed rate of time is tampered with by illegal third-party software, causing the derivative value to be abnormally amplified or reduced, the square term will amplify this abnormal deviation by a factor of two, while the exponential decay term will apply a non-linear decay penalty to the mismatch between the actual number of operating cycles and the theoretical number of cycles, thereby improving the sensitivity of identifying covert and minute time tampering operations. The derivative of a discrete lattice sequence The steps for obtaining the result are as follows: extract the specific numerical result of the derivative of the discrete lattice sequence. This result is calculated by dividing the time-series change difference obtained by the difference operation by the system time difference, and is used to reflect the transient change ratio between physical time and system time. The original values ​​of the derivatives of the discrete lattice sequence at 10 consecutive instants within a monitoring period are extracted. The average of these 10 original values ​​is calculated as the parameter used in the final calculation. For example, in the 10th... The original derivative values ​​obtained from 10 samplings within a monitoring period were 1.01, 0.99, 1.02, 0.98, 1.00, 1.01, 0.99, 1.00, 1.00, and 1.00, respectively. These 10 values ​​were added together to obtain 10.00, and then divided by the sampling number 10 to calculate the derivative. The derivative of the discrete lattice sequence for each monitoring period is 1.00.

[0021] Mean of time difference between nodes in a circular queue The steps to obtain it are: traverse the first... Within a given monitoring period, the system time return values ​​of all adjacent nodes are recorded in the circular queue. Subtraction is then performed to obtain the set of system time differences between all adjacent nodes. To smooth out minor time fluctuations caused by scheduling, an averaging method is used to average this set of time differences. The calculation formula is to sum all the system time difference values ​​in the set and then divide by the total number of difference data points in the set. For example, in the set... Within a monitoring period, the circular queue contains five system time difference data points: 0.040 seconds, 0.041 seconds, 0.039 seconds, 0.040 seconds, and 0.040 seconds. These five values ​​are summed to obtain a total of 0.200 seconds. Then, this total of 0.200 seconds is divided by the total number of data points (5) to calculate the time difference for the monitoring period. The average time difference between the nodes in the circular queue during each monitoring period is 0.04 seconds.

[0022] Hardware clock nominal operating frequency The steps for obtaining the information are as follows: By calling the underlying hardware abstraction layer management interface, a basic input / output system information query command is sent to the motherboard chipset to read the reference oscillator frequency parameter file written in the firmware when the hardware device is manufactured. The fixed frequency value representing the processor's reference operating rhythm is parsed from the parameter file. This value serves as the absolute physical reference for judging the hardware's operating status. For example, after sending a query command to the motherboard, the returned firmware parameter message is read, and the field value marked as the base clock frequency is extracted from the message. This field value is displayed as 2500000000, representing 2500000000 times per second. To ensure the stability of the value calculation and avoid overflow, the value is divided by 1000000000 to convert it into a parameter value in GHz, thus determining that the nominal operating frequency of the hardware clock is 2.50 GHz.

[0023] Actual measured frequency of hardware clock The steps to obtain it are as follows: in the current number At the start and end times of each monitoring period, a timestamp read command is sent to the processor to extract the cumulative physical clock cycle values ​​from the two actual values. The cycle difference is calculated by subtracting the cumulative physical clock cycle value at the start time from the cumulative physical clock cycle value at the end time. Then, the objective standard time span corresponding to the monitoring period is extracted. The calculated cycle difference is divided by the objective standard time span to calculate the dynamic frequency during actual operation. For example, if the cumulative clock cycle value at the start time is 10000000000 and the cumulative clock cycle value at the end time is 12500000000, the cycle difference is 2500000000 times. At the same time, the objective standard time span of the monitoring period is exactly 1 second. Dividing 2500000000 by 1 second yields 2500000000Hz. Similarly, dividing this value by 1000000000 gives an actual measured frequency of 2.50GHz for the hardware clock.

[0024] Calculations based on parameters: The derivative of the discrete lattice sequence Mean time difference of nodes in a circular queue Hardware clock nominal operating frequency Actual measured frequency of hardware clock Substitute into the calculation formula; Calculate the molecule part ; Calculate the denominator ; The result of calculating the ratio of the first term is: ; The number of molecular periods for calculating the exponent is ; The number of periods in the denominator of the exponent is calculated as follows: ; The ratio of the absolute value to the addition within the exponent is calculated as follows: ; The result of calculating the exponential decay with base to the natural logarithm is: ; Calculate the final clock elapsed rate ratio. .

[0025] This result indicates that the current number The clock elapsed rate ratio within a monitoring period is 1.00. The correlation between this value and the step results is that the obtained value of 1.00 is used as the basic feature vector for subsequent assessment of environmental security. If the calculated value is stable within the baseline healthy range of 0.95 to 1.05, it means that the current physical time is completely synchronized with the operating system time and there has been no abnormal tampering or offset. If the value drops sharply to below 0.80 or soars to above 1.20, it means that the client's internal execution time has been intercepted and accelerated, and time tampering behavior has been discovered based on this status.

[0026] The steps for obtaining kernel latency skew are as follows: Send probe input / output request packet data to the underlying driver, record the timestamp parameter corresponding to the action, listen to the system's underlying feedback channel and capture the timestamp parameter at the moment the response arrives, calculate the difference between the absolute values ​​of the two timestamp parameters, collect the round-trip time value corresponding to the probe input / output request packet data, and obtain the round-trip time value. Retrieve the baseline time consumption value fixed in the system kernel space, verify whether the round-trip time value is greater than or equal to the baseline time consumption value, and subtract the baseline time consumption value from the round-trip time consumption value if the verification is successful. Extract the timing residual data generated by the subtraction operation to obtain the kernel latency deviation.

[0027] Specifically, a probe input / output request packet is sent to the underlying driver. A 64-byte unloaded probe input / output request packet is constructed at the application layer, and a 16-bit identifier sequence number generated by a pseudo-random number generator is written into the header space of this request packet. The underlying device control communication interface is then called to send the request packet to the target security driver in the kernel layer. At the physical instant the send function is triggered, a high-precision performance counter at the hardware level is invoked to extract the number of clock cycles accumulated since the processor's power-on. The extracted clock cycle value is divided by the processor's factory-set rated frequency of 2.5GHz, and converted into an absolute physical time parameter at the nanosecond level through mathematical division. This parameter is recorded as the timestamp parameter corresponding to the action in a hash table in local memory. This parameter is stored in an entry with the index key value being the current packet sequence number. For example, if the timestamp parameter corresponding to the action is calculated to be 1700000050000 nanoseconds, then an asynchronous response is registered in the application layer memory. The mechanism monitors the port status of the underlying feedback channel. When a probe packet is received and returned intact, the asynchronous callback mechanism is triggered, and the timestamp parameter of the response packet arriving at the network card buffer queue is captured. To ensure the consistency of time measurement, the same performance counter clock cycle conversion process is executed. The latest clock cycle is read and divided again by the rated frequency of 2.5GHz. The timestamp parameter of the response arrival moment is extracted, for example, 1700000095000 nanoseconds. Then, the logic unit is called to perform algebraic subtraction operation to perform the absolute value difference operation on the two timestamp parameters. Subtracting 1700000095000 nanoseconds from 1700000050000 nanoseconds, the calculated difference value is 45000 nanoseconds. This difference value quantifies the complete time cost of the packet crossing the application layer boundary into the kernel state and returning. This cost value is stored in the temporary variable area. The round-trip time value corresponding to the probe input and output request packet data is collected to obtain the round-trip time value.

[0028] The baseline latency value stored in the kernel space is retrieved. This baseline latency value is obtained by continuously sending 1000 baseline input / output request packets (64 bytes each) to the underlying target driver using an automated test script during the device's first power-on and in a clean background running environment without interference from other processes. The round-trip latency data of these 1000 request packets is collected using a low-level counter. All round-trip latency data are summed to obtain the total latency. This total latency is then divided by the total number of test packets (1000) to calculate an average latency scale representing the baseline time of the underlying communication link. For example, if the average latency scale is calculated to be 15000 nanoseconds, this 15000 nanoseconds is stored as the baseline latency value in a protected read-only memory page in the kernel space. The baseline value is retrieved by reading the numerical information in this memory page. Then, the 45000 nanoseconds of round-trip latency collected and stored in the temporary variable area in the previous step are extracted. The round-trip time value is returned to verify whether it is greater than or equal to the baseline time value. Each record is compared with a pre-defined valid range. For example, the round-trip time is compared with the valid fluctuation range of 15,000 nanoseconds to 500,000 nanoseconds. Boolean logic comparison instructions are used to compare the difference between 45,000 nanoseconds and 15,000 nanoseconds. If it is confirmed that 45,000 nanoseconds is greater than 15,000 nanoseconds, a Boolean value is output as the verification result. If the verification is successful, the round-trip time value is subtracted from the baseline time value. The specific subtraction operation is performed by calling the operation interface, subtracting the baseline 15,000 nanoseconds from the total 45,000 nanoseconds. The 30,000 nanoseconds generated by the subtraction operation are extracted as the timing residual data. This residual data completely separates the normal physical communication link and standard flow time. This part of the extra processing increment time caused by abnormal interception or hook filtering is sorted and assigned a value to obtain the kernel latency deviation.

[0029] The steps for obtaining the kernel request signal-to-noise ratio value are as follows: Based on the kernel latency deviation, a baseline time value is extracted, and the kernel request signal-to-noise ratio is calculated using the following formula: ; in, For the first The kernel request signal-to-noise ratio value per probe cycle. The constant coefficients, Based on the baseline time consumption, For the first The kernel delay deviation per detection cycle.

[0030] Specifically, the kernel request signal-to-noise ratio calculation formula introduces the inverse ratio structure of the base time baseline value and the kernel latency deviation. At the same time, it combines the square root factor of the ratio based on the geometric mean and the average for penalty correction. Finally, it uses a logarithmic function for dimensional compression and scaling to transform the absolute time residual value into a relative signal-to-noise ratio dimensional factor. This nonlinear mathematical combination amplifies the characteristics of micro-latency fluctuations and applies a logarithmic negative offset mapping to the abnormal deviation between the actual round-trip time and the theoretical base time, thereby highlighting the numerical difference of abnormal hidden time tampering operations or malicious driving interception. constant coefficient The steps for obtaining this parameter are as follows: This parameter is used to perform amplitude-weighted transformation on the final calculated signal-to-noise ratio result. Its value is generated by collecting and calculating background noise data during the device's factory calibration phase. In a baseline test environment where the device is disconnected from the external network, a clean kernel process is run to continuously initiate 500 regular probe input / output requests. The set of time delay deviations generated in these 500 requests is recorded, and the mathematical standard deviation of the 500 deviation sets is calculated. The natural fluctuation standard deviation is calculated to be 4.5 nanoseconds. At the same time, the reference standard deviation of the device under the ideal factory environment is obtained. For example, the reference standard deviation is obtained from the hardware baseline test report as 0.225 nanoseconds. The natural fluctuation standard deviation of 4.5 nanoseconds is divided by the reference standard deviation of 0.225 nanoseconds. The time dimensions of the two cancel each other out, and the calculated pure numerical quotient is 20. This dimensionless pure coefficient of 20, calculated by calibration under the actual physical fluctuation environment, is stored as a constant coefficient in a specified field in the local configuration file. When needed, it is extracted and loaded according to the file path. For example, in this calculation, the constant coefficient of 20 is obtained by extracting the file field.

[0031] Baseline time consumption The acquisition steps are as follows: This parameter represents the theoretical value of the round-trip processing time of the data packet in the kernel under interference-free and idle state. The acquisition operation is performed in the initial pure state. During the period after the device is started and before the target monitoring software is started, 1000 probe request packets of fixed length are sent to the underlying driver. The round-trip time data of each packet is measured and recorded. The 1000 time data are accumulated and summed. The total time calculated by summing is divided by the total number of request packets, 1000, to obtain the average time. This average time is defined as the baseline time. This value is written into the read-only variable address locked in the kernel protected memory. During the calculation, the value is retrieved by following the pointer of this memory address and called through the previously obtained baseline time value acquisition process. For example, the baseline time value read from this specific variable address is 15000 nanoseconds.

[0032] No. Kernel delay deviation per probe cycle The steps to obtain this parameter are as follows: this parameter represents the current number of... The specific value by which the actual round-trip time of data packets exceeds the ideal time baseline in each detection round depends on the retrieval of the output results of the preceding monitoring steps, capturing the current round. Within each detection cycle, the timestamp parameters of the request packet sent and the timestamp parameters of the response arrival are subtracted to calculate the actual round-trip time. A baseline time value is extracted, and the actual round-trip time is subtracted from the baseline time value to extract the remaining timing residual value. This residual value is then assigned a specific value using the previously obtained kernel latency deviation extraction process. For example, in the current detection cycle... The actual round-trip time within each detection cycle is calculated to be 45,000 nanoseconds. Subtracting the baseline time of 15,000 nanoseconds from 45,000 nanoseconds, the kernel delay deviation for the current detection cycle is calculated to be 30,000 nanoseconds.

[0033] Calculations based on parameters: constant coefficients Basic time baseline value Kernel latency deviation Substitute into the calculation formula; Calculate the ratio term ; Calculate the sum of squares ; Calculate the cross product term ; Calculate the ratio inside the square root. ; Calculate the square root value ; Calculate the inner product of the logarithmic function ; Calculate the base-10 logarithm. ; Calculate the final kernel request signal-to-noise ratio value ; This result indicates that the current number The kernel request signal-to-noise ratio value for each detection cycle is -5.052. This value is positively correlated with the step results. The calculated value of -5.052 is used as a decision factor for determining whether there is an intrusion. If the calculated value is greater than 0, it means that the theoretical latency in the current environment is dominant and the deviation is within the safe threshold. If the value is less than 0 or even a deep negative value range such as less than -5 in this example, it means that the noise fluctuation caused by the latency deviation has completely covered the normal latency base, indicating that the communication link has been maliciously hooked and intercepted and a hidden redirection delay has been generated.

[0034] The steps to obtain the time tampering anomaly identifier are as follows: Collect multiple clock elapsed rate ratios within a continuous time period for data statistics, calculate the variance value corresponding to the clock elapsed rate ratio, retrieve the deviation threshold configured by the system, compare the variance value with the deviation threshold, and execute a recording action when the variance value is greater than the deviation threshold to obtain a time tampering anomaly flag.

[0035] Specifically, multiple clock elapsed rate ratios over a continuous time period are collected for statistical analysis. A sliding time window of 60 seconds is set, and 60 clock elapsed rate ratios calculated in the previous steps are continuously read from the memory variable area at a frequency of once per second. These 60 ratios are stored in a one-dimensional numerical array. All ratio values ​​in the array are iterated and summed. The sum of the 60 values ​​is then divided by the total number of extractions (60) to calculate the average value of the 60 clock elapsed rate ratios. For example, the average value of the average value is calculated as follows: The average value is 1.02. Then, each clock elapsed rate ratio in the array is extracted one by one. The average value of 1.02 is subtracted from each ratio, and the difference is squared. All 60 squared results are summed. This sum is then divided by the total number of values ​​(60). This mathematical dispersion measurement method calculates the variance of the clock elapsed rate ratio. For example, if the calculated variance is 0.015, the configured deviation threshold is retrieved. For specific settings of this deviation threshold, please refer to the documentation. Rongwei, in a clean factory state with the device disconnected from the external network and without running any third-party programs, continuously runs the protected client for 24 hours. Using the same 60-second window sliding extraction method, variance data is extracted, resulting in 1440 historical baseline variance values. The largest historical variance value among these 1440 values ​​is extracted, for example, 0.001. This largest historical variance value of 0.001 is multiplied by a tolerance factor of 1.5, and through multiplication, a deviation threshold of 0.0015 is derived and stored in the local configuration file. The variance values ​​are then compared. The deviation threshold is used to compare each variance record with a pre-defined valid range, such as comparing the variance value with the fluctuation safe range of 0 to 0.0015. It is determined whether the currently calculated variance value of 0.015 is greater than the set deviation threshold of 0.0015. In this example, 0.015 is numerically greater than the limit of 0.0015. When the variance value is greater than the deviation threshold, a recording action is performed, and a warning code string containing the current timestamp and the variance exceeding the specific value is written to the kernel log area, thus obtaining a time tampering exception flag.

[0036] The steps to obtain local tampering and intrusion events are as follows: Extract the kernel request signal-to-noise ratio (SNR) value, retrieve the attenuation safety limit within the memory protection policy, compare the kernel request SNR value with the attenuation safety limit, identify the specific operating environment where the kernel request SNR value is less than the attenuation safety limit, establish a logical association between the operating environment and the time-tampering exception identifier, and obtain the exception combination judgment status. Based on the abnormal combination judgment state, verify that the logical condition that the variance value is greater than the deviation threshold and the kernel request signal-to-noise ratio value is less than the attenuation safety limit is met. Under the state that the variance value is greater than the deviation threshold and the kernel request signal-to-noise ratio value is less than the attenuation safety limit, extract the time tampering anomaly identifier, perform qualitative analysis on the time tampering anomaly identifier, and obtain the local tampering intrusion event.

[0037] Specifically, the kernel request signal-to-noise ratio (SNR) value is extracted. The quantized value generated in the previous calculations, for example, -5.052, is read from the shared memory segment. The attenuation safety limit within the memory protection policy is retrieved. This attenuation safety limit is set by artificially initiating a large number of disk read / write processes and background intensive computing tasks in a controlled data center environment, placing the processor and I / O bus under 100% load. Under this heavy load environment, 2000 probe request packets are continuously sent. The set of request SNR values ​​under these 2000 stress tests is collected and calculated. The smallest SNR value closest to the negative extreme is selected, for example, -1.5. An empirical compensation value of -0.3 is added to this -1.5, resulting in -1.8, which is used as the attenuation safety limit. This value represents the worst-case SNR state that can be tolerated under physical limits without malicious tampering. The kernel request SNR value is compared with the attenuation safety limit value. Each extracted record is then compared with the pre-defined... The system compares the signal-to-noise ratio (SNR) within a defined effective range. For example, it compares the SNR to the standard SNR range of -1.8 to +10.0. A comparison instruction is called to determine the relationship between -5.052 and the threshold value -1.8. In this example, -5.052 is to the left of -1.8 on the numerical axis and is less than -1.8. This confirms the specific runtime environment where the kernel requests an SNR value less than the attenuation safety limit. When the value exceeds the limit, the snapshot interface is called. The system traverses the process control block list within the current operating system, intercepting the process identifier currently occupying the CPU, the corresponding main program image path, the memory resident size, and the list of loaded third-party dynamic link libraries. These environment characteristic parameters are packaged and concatenated into an environment characteristic string. A logical association is established between the runtime environment and the time tampering anomaly identifier. The previously obtained time tampering anomaly identifier is used as a foreign key node. A mapping function binds the packaged environment characteristic string to this foreign key node, generating a structure variable containing a bidirectional pointer in memory, thus obtaining the anomaly combination judgment status.

[0038] Based on the anomaly combination judgment state, the Boolean logic status bits stored inside the previously generated structure variable containing bidirectional pointers are read to verify that the logic condition of variance value being greater than the deviation threshold and kernel request signal-to-noise ratio value being less than the attenuation safety limit is met. A logical AND gate operator is used to jointly evaluate the comparison results of the two dimensions. It checks whether the variance judgment node at the clock elapsed rate level outputs a signal indicating an out-of-bounds value is true, and in parallel checks whether the signal-to-noise ratio judgment node at the communication frequency domain level outputs a signal indicating a value less than the attenuation limit is true. Only when both nodes output true simultaneously is the joint logic condition for determining a deep anomaly in the environment triggered. For example, if the previously calculated variance of 0.015 is greater than 0.0015 and the signal-to-noise ratio of -5.052 is less than -1.8, both conditions are met. Under the state where the variance value is greater than the deviation threshold and the kernel request signal-to-noise ratio value is less than the attenuation safety limit, the time tampering anomaly identifier is extracted. The pointer address in the structure variable is traced back to the log area, and the segment containing the timestamp and variance exceeding the threshold is retrieved. The warning code string and the bound environment feature string of the volume value are completely copied into a secure, isolated memory sandbox. Qualitative analysis is performed on the time tampering anomaly identifier. The parameter fields in this environment feature string are disassembled to extract the main program image path and the directory of third-party dynamic link libraries. The malware signature library downloaded and updated in advance on the local hard drive is retrieved. This library contains 10,000 hash values ​​and process name regular expression matching templates of pre-identified cheating tools. The file names in the extracted dynamic link library directory are compared one by one with the regular expression matching templates in the signature library. For example, if the extracted memory-resident file name is "Speed ​​Modifier", it is compared with the acceleration behavior template recorded in the signature library. The matching similarity reaches the judgment threshold of 95%. Combined with the clock rate and signal-to-noise ratio values ​​of the process that deviate from the normal range, it is determined that the process is performing malicious call interception and clock acceleration behavior. The analysis conclusion is packaged into a warning message according to a structured general format, and the local tampering intrusion event is obtained.

[0039] The steps to obtain the counter-reset time tick are as follows: Once the system confirms receipt of a local tampering intrusion event, it extracts the current running time step corresponding to the game client, retrieves the clock data corresponding to the read time tag instruction value stored in the memory buffer, performs a memory value overwrite operation, replaces and resets the current running time step corresponding to the game client with the clock data corresponding to the read time tag instruction value, and generates a counter-reset time tick.

[0040] Specifically, upon confirming the receipt of a local tampering / intrusion event, the process snapshot function is invoked to traverse the list of currently running processes, extract the executable filename of each process for string matching, and search for the process identifier named "game main program". After extracting the process identifier, the process open interface is called, passing in the highest privilege parameter to obtain a process handle with full access permissions. Based on the dynamic link library memory base address and three-level pointer offset obtained from reverse engineering analysis, the hexadecimal absolute address of the current runtime step in the process's virtual memory space is calculated by adding each level offset, for example, 0x00AABBCC. The memory read interface is called, passing in the absolute address and read length parameter, to read the current runtime step corresponding to the game client modified by the third-party tool from the absolute address, for example, 8500 milliseconds. The process then proceeds to the isolated memory buffer, extracts the record queue according to the global timestamp index, and retrieves the clock data corresponding to the read timestamp instruction value recorded by the hardware performance counter at that moment. For example, if the underlying hardware clock data is read as 2500 milliseconds, the virtual memory page attribute modification interface is called, passing in the absolute address and page size parameters. The access permissions of the memory page containing the target absolute address 0x00AABBCC are changed from the default read-only and execute state to read-write state. The process memory write interface is called to perform a memory value overwrite operation, writing the clock data of 2500 milliseconds read from the protected area into the memory space containing the target absolute address in the form of a binary byte stream. The abnormal acceleration value of 8500 milliseconds is erased by memory overwrite. After the overwrite operation is completed, the virtual memory page attribute modification interface is called again, passing in the read-only flag to restore the permissions of the memory page to read-only state. Then, a read request is initiated again from the memory address to extract the value just written and perform integrity verification. After confirming that the read value matches 2500 milliseconds, the clock value is concatenated and bound with the action sequence number and timestamp of the current overwrite operation to generate a counter-reset time tick.

[0041] The steps for obtaining local intrusion takeover feedback commands are as follows: Based on the counter-reset time tick, locate the kernel communication link at the bottom layer of the operating system, block the original standard application transmission path, execute the operation of abandoning the regular system interface call for the kernel communication link, bypass the intermediate application layer encapsulation of the communication connection, switch the communication connection to the system call interface, establish a direct secure channel with low-level execution permissions, and form a system-level call communication link. The counter-reset time tick is re-extracted and used as the instruction payload parameter. The connection request packet data is sent through the system-level call communication link. The status feedback communication port of the underlying operating system is monitored in real time. The takeover confirmation execution signal returned by the connection request packet data is captured to obtain the local intrusion takeover feedback instruction.

[0042] Specifically, based on the counter-reset time tick, the clock value and action sequence number contained therein are extracted. Using the action sequence number as an index key, the kernel object handle table is traversed and matched to locate the kernel communication link handle at the operating system level assigned to the current security module. At the user-mode application layer, standard network transmission functions and device control functions are intercepted. Assembly jump code returning failure is forcibly written at the entry instructions of these standard functions, blocking the original standard application transmission path. All communication requests attempting to be initiated through regular user-level dynamic link libraries are intercepted and discarded. For the kernel communication link, regular system interface calls are discarded. A block of execution pages for storing assembly instructions is dynamically allocated in memory. Without going through layers of encapsulation by the graphics subsystem or user-level application programming interfaces, the communication connection bypasses the intermediate application layer encapsulation. Assembly instructions are written into this dynamic execution page to retrieve the call number of the underlying system service. For example, the system call number of the file control interface is extracted to be hexadecimal 0x55. This hexadecimal value 0x55 is stored in a general-purpose data register. Subsequently, a software interrupt instruction or a fast system call instruction is executed to trigger a privilege level switch, switching the communication connection to the system call interface. This causes the code execution flow to jump from the user-mode ring three privilege level to the kernel-mode ring zero privilege level. In the ring zero privilege level, non-paged memory pool space is allocated, and a clean Transmission Control Protocol (TCP) communication socket object is created using the underlying driver interface. This socket object is bound to the Internet Protocol address and port of the target server. The underlying Transmission Control Block (TCP) structure is filled, and a three-way handshake is initiated to establish a direct secure channel with underlying execution permissions, forming a system-level call communication link.

[0043] The counter-reset time tick is extracted again, and the encapsulated 2500 milliseconds physical clock data and accompanying action sequence number are parsed out. A contiguous byte space is allocated in memory to construct a custom-formatted data packet structure. The counter-reset time tick is filled into the data segment of this data packet structure as an instruction payload parameter. A checksum field and the hardware identifier of the current device are appended to the header of the structure. A connection request packet is sent based on the system-level call communication link. The network sending interface is called through the previously created ring zero privileged socket object to convert the filled data packet structure into a binary data stream in network byte order. This stream is sent along the established underlying channel to the pre-hardcoded remote control server Internet Protocol address and the specified receiving port in the driver. After the transmission is completed, a non-blocking polling read loop is initialized. The system wakes up to perform a read action every 50 milliseconds, monitors the operating system's underlying status feedback communication port in real time, reads the byte backlog status in the hardware receive buffer of the zero-privilege socket, and when it determines that there are bytes greater than zero to be read in the buffer, it moves these bytes to a pre-allocated receive memory block for deserialization and parsing. It checks whether the sequence number in the parsed packet header matches the sent action sequence number. If they match, it extracts the opcode in the response data packet payload segment, for example, extracting the hexadecimal opcode 0xAA55. By comparing the opcode, it confirms that the remote control server has responded to this event, captures the takeover confirmation execution signal returned by the connection request packet data, parses the subsequent action parameters attached to the signal, such as extracting the additional instruction code to terminate the current game process, and combines these feedback information to obtain the local intrusion takeover feedback instruction.

Claims

1. A real-time game security monitoring system based on artificial intelligence and big data, characterized in that: The system includes: The time tick monitoring module is used to extract the game client's read time tag instruction value, divide the read time tag instruction value by the processor frequency value to obtain the hardware tick cycle number, extract the system time return value of the operating system process, store the system time return value and the hardware tick cycle number into a circular queue sequence, and calculate the clock elapse rate ratio. The request latency monitoring module is used to send probe input / output request packet data to the underlying driver, collect the round-trip time value corresponding to the probe input / output request packet data, obtain the kernel latency deviation, extract the basic latency benchmark value and the kernel latency deviation, and calculate the kernel request signal-to-noise ratio value. The local intrusion analysis module is used to extract the clock elapsed rate ratio and the kernel request signal-to-noise ratio value, calculate the variance value corresponding to the clock elapsed rate ratio, compare the variance value with the deviation threshold to obtain the time tampering anomaly identifier, and compare the kernel request signal-to-noise ratio value with the attenuation safety limit to obtain the local tampering intrusion event. The kernel interception and countermeasure module is used to extract the local tampering intrusion event, extract the current running time step corresponding to the game client, replace it to obtain the countermeasure reset time beat, perform the operation of abandoning the regular system interface call on the kernel communication link, switch the communication connection to the system call interface, extract the connection request packet data sent by the countermeasure reset time beat, and obtain the local intrusion takeover feedback instruction.

2. The game security real-time monitoring system based on artificial intelligence and big data according to claim 1, characterized in that, The steps for obtaining the clock elapsed rate ratio are as follows: Extract the game client's read time tag command value, read the processor frequency value, divide the read time tag command value by the processor frequency value, calculate the number of hardware tick cycles, retrieve the system time return value, and construct a circular queue sequence with initial storage space. The system time return value and hardware cycle number are input to determine whether the number of nodes is greater than the full load preset threshold. If it is greater than the full load preset threshold, discrete difference operation is performed on the circular queue sequence value to extract the time change difference and obtain the derivative value of the discrete matrix sequence. Based on the derivative value of the discrete point matrix sequence, the mean time difference of the ring queue nodes for each monitoring period is retrieved to obtain the nominal operating frequency of the hardware clock and the actual measured frequency of the hardware clock, and the ratio of clock elapse rate is calculated.

3. The game security real-time monitoring system based on artificial intelligence and big data according to claim 1, characterized in that, The steps for obtaining the kernel delay deviation are as follows: Send probe input / output request packet data to the underlying driver, record the timestamp parameter corresponding to the action, listen to the system's underlying feedback channel and capture the timestamp parameter at the moment the response arrives, calculate the difference between the absolute values ​​of the two timestamp parameters, collect the round-trip time value corresponding to the probe input / output request packet data, and obtain the round-trip time value. Retrieve the baseline time consumption value fixed in the system kernel space, verify whether the round-trip time value is greater than or equal to the baseline time consumption value, and if the verification is successful, subtract the baseline time consumption value from the round-trip time value, extract the timing residual data generated by the subtraction operation, and obtain the kernel delay deviation.

4. The game security real-time monitoring system based on artificial intelligence and big data according to claim 1, characterized in that, The steps for obtaining the time tampering anomaly identifier are as follows: Collect multiple clock elapsed rate ratios within a continuous time period for data statistics, calculate the variance value corresponding to the clock elapsed rate ratio, retrieve the deviation threshold configured by the system, compare the variance value with the deviation threshold, and perform a recording action when the variance value is greater than the deviation threshold to obtain a time tampering anomaly flag.

5. The game security real-time monitoring system based on artificial intelligence and big data according to claim 1, characterized in that, The steps for obtaining the local tampering and intrusion event are as follows: Extract the kernel request signal-to-noise ratio value, retrieve the attenuation safety limit in the memory protection policy, compare the kernel request signal-to-noise ratio value with the attenuation safety limit value, confirm the specific operating environment where the kernel request signal-to-noise ratio value is less than the attenuation safety limit, establish a logical association between the operating environment and the time tampering anomaly identifier, and obtain the anomaly combination judgment status. Based on the abnormal combination judgment state, verify that the logical condition that the variance value is greater than the deviation threshold and the kernel request signal-to-noise ratio value is less than the attenuation safety limit is met. Under the state that the variance value is greater than the deviation threshold and the kernel request signal-to-noise ratio value is less than the attenuation safety limit, extract the time tampering anomaly identifier, perform qualitative analysis on the time tampering anomaly identifier, and obtain the local tampering intrusion event.

6. The game security real-time monitoring system based on artificial intelligence and big data according to claim 1, characterized in that, The steps for obtaining the counter-reset time tick are as follows: Once the system confirms receipt of the local tampering intrusion event, it extracts the current running time step corresponding to the game client, retrieves the clock data corresponding to the read time tag instruction value stored in the memory buffer, performs a memory value overwrite operation, replaces and resets the current running time step corresponding to the game client with the clock data corresponding to the read time tag instruction value, and generates a counter-reset time beat.

7. The game security real-time monitoring system based on artificial intelligence and big data according to claim 1, characterized in that, The steps for obtaining the local intrusion takeover feedback command are as follows: Based on the counter-reset time tick, the kernel communication link at the operating system's bottom layer is located, the original standard application transmission path is blocked, and the conventional system interface call operation is abandoned for the kernel communication link. The communication connection is bypassed by the intermediate application layer encapsulation, the communication connection is switched to the system call interface, and a direct secure channel with low-level execution permissions is established, forming a system-level call communication link.

8. The game security real-time monitoring system based on artificial intelligence and big data according to claim 7, characterized in that, The steps for obtaining the local intrusion takeover feedback command also include: The counter-reset time tick is re-extracted and used as the instruction payload parameter. Connection request packet data is sent based on the system-level call communication link. The status feedback communication port of the underlying operating system is monitored in real time. The takeover confirmation execution signal returned by the connection request packet data is captured to obtain the local intrusion takeover feedback instruction.

Images