Traffic isolation method and device, electronic equipment, storage medium and product

Abstract

The disclosure provides a traffic isolation method, device, electronic equipment, storage medium and product. The method comprises: in response to a target user logging in a terminal device, obtaining device hardware features and user behavior features associated with the target user; performing protocol layer marking processing on network traffic of the target user based on a network processing device to generate network traffic carrying a user network identifier; determining a comprehensive risk score of the target user based on the device hardware features, the user behavior features and the network traffic carrying the user network identifier; in the case that the comprehensive risk score is greater than a target risk score threshold, determining a game session behavior anomaly score of the target user based on game session data of the target user; and performing an isolation operation on the network traffic of the target user based on the game session behavior anomaly score.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a traffic isolation method, apparatus, electronic device, storage medium, and product. Background Technology

[0002] Most traffic isolation solutions rely on the Internet Protocol (IP) to identify user risks across the entire network. However, they cannot accurately distinguish individual user traffic in a local area network with shared IP addresses. The risk identification dimension is limited, and relying solely on single behavioral data to determine cheating risks can easily lead to misjudgments and missed judgments. Furthermore, they generally adopt a one-size-fits-all approach to blocking and isolation, which can result in legitimate players being blocked along with cheaters in a shared network, while cheaters cannot be accurately managed. This leads to poor accuracy in game network risk control, low isolation flexibility, and a poor user experience. Summary of the Invention

[0003] This disclosure provides a flow isolation method, apparatus, electronic device, storage medium, and product to solve problems in the related art.

[0004] A first aspect of this disclosure provides a traffic isolation method, the method comprising:

[0005] In response to a target user logging into a terminal device, the device hardware characteristics and user behavior characteristics associated with the target user are obtained; The network processing device performs protocol layer tagging on the network traffic of the target user to generate network traffic carrying the user's network identifier. Based on the device hardware characteristics, the user behavior characteristics, and the network traffic carrying the user's network identifier, a comprehensive risk score for the target user is determined. If the overall risk score is greater than the target risk score threshold, an abnormal score for the target user's game behavior is determined based on the target user's game data. Based on the abnormal game behavior score, the network traffic of the target user is isolated.

[0006] In one embodiment, obtaining the device hardware characteristics and user behavior characteristics associated with the target user includes: Acquire rendering latency data, clock offset data, mouse movement trajectory data, and key operation data generated by the target user's operation of the terminal device; Based on the rendering latency data and the clock offset data, the device hardware characteristics are generated, and based on the mouse movement trajectory data and the key operation data, the user behavior characteristics are generated.

[0007] In one embodiment, the device hardware characteristics are generated based on the rendering latency data and the clock offset data, including: The rendering latency data is standardized, and the clock offset data is Fourier transformed to obtain the energy coefficient corresponding to the clock offset data. The standardized rendering latency data and the energy coefficient are encrypted to generate the device hardware characteristics.

[0008] In one embodiment, the user behavior characteristics are generated based on the mouse movement trajectory data and the key operation data, including: Extract the mouse movement angle sequence from the mouse movement trajectory data, and extract the key interval time sequence from the key operation data; The mouse movement angle sequence and the key press interval time sequence are normalized respectively, and the normalization results are encrypted to generate the user behavior features.

[0009] In one embodiment, the network traffic of the target user is subjected to protocol layer tagging processing by a network processing device to generate network traffic carrying the user's network identifier, including: The network processing device configures a corresponding initial sequence number increment pattern for each user at the transport layer. Based on the user identifier and target minutes of the target user, determine the network layer time-to-live value corresponding to the target user; Based on the initial sequence number growth pattern and the time-to-live value, the network traffic of the target user is subjected to protocol layer marking processing to generate network traffic carrying the user's network identifier.

[0010] In one embodiment, isolating the network traffic of the target user based on the game behavior anomaly score includes: If the abnormal game behavior score exceeds the target abnormal score threshold and the duration does not reach the preset duration, the network traffic of the target user is isolated at the first level. The first level isolation operation includes at least one of reducing the network bandwidth of the terminal device and pushing alarm information to the management platform. If the abnormal game behavior score exceeds the target abnormal score threshold and the duration reaches the preset duration, a second-level isolation operation is performed on the target user's network traffic. The second-level isolation operation includes at least one of the following: diverting the network traffic to the target server, blocking the target user's outbound game traffic, and marking the hardware characteristics of the terminal device.

[0011] A second aspect of this disclosure provides a flow isolation device, the device comprising: The acquisition unit is used to acquire the device hardware characteristics and user behavior characteristics associated with the target user in response to the target user logging into the terminal device. The generation unit is used to perform protocol layer marking processing on the network traffic of the target user based on the network processing device, and generate network traffic carrying the user's network identifier. The first determining unit is configured to determine the comprehensive risk score of the target user based on the device hardware characteristics, the user behavior characteristics, and the network traffic carrying the user network identifier; The second determining unit is used to determine the abnormal game behavior score of the target user based on the game data of the target user when the comprehensive risk score is greater than the target risk score threshold. An isolation unit is used to isolate the network traffic of the target user based on the game behavior anomaly score.

[0012] A third aspect of this disclosure provides an electronic device comprising: At least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor to enable the at least one processor to perform the methods described in the first aspect of this disclosure.

[0013] A fourth aspect of this disclosure provides a non-transitory computer-readable storage medium storing computer instructions, wherein the computer instructions are used to cause a computer to perform the methods described in the first aspect of this disclosure.

[0014] A fifth aspect of this disclosure provides a computer program product including a computer program that, when executed by a processor, implements the methods described in the first aspect of this disclosure.

[0015] In summary, this disclosure proposes a traffic isolation method, which includes: in response to a target user logging into a terminal device, obtaining the device hardware characteristics and user behavior characteristics associated with the target user; performing protocol layer tagging processing on the target user's network traffic based on a network processing device to generate network traffic carrying a user network identifier; determining a comprehensive risk score for the target user based on the device hardware characteristics, the user behavior characteristics, and the network traffic carrying the user network identifier; if the comprehensive risk score is greater than a target risk score threshold, determining a game behavior anomaly score for the target user based on the target user's game data; and isolating the target user's network traffic based on the game behavior anomaly score.

[0016] According to the solution provided in this disclosure, after a user logs into a terminal device, the device's hardware characteristics and user behavior characteristics are collected. A network processing device then performs protocol-layer traffic marking to generate network traffic carrying the user's network identifier. Based on the device's hardware characteristics, the user's behavior characteristics, and the network traffic carrying the user's network identifier, a comprehensive risk score is determined for initial screening. For high-risk users, game data is further combined to determine abnormal game behavior scores. Finally, corresponding traffic isolation operations are performed based on the abnormal scores. This solution addresses the shortcomings of shared IP scenarios, such as the inability to distinguish individual users, a single risk control judgment dimension, and a one-size-fits-all approach to isolation management. It avoids innocent users being banned along with the user and cheating users circumventing risk control, improving the accuracy of game traffic risk identification and the refinement of traffic isolation, thereby enhancing the user experience.

[0017] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0018] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure, and are not intended to unduly limit this disclosure.

[0019] Figure 1 A flowchart illustrating a traffic isolation method provided in an embodiment of this disclosure; Figure 2 A schematic diagram of a terminal monitoring and alarm interface provided in an embodiment of this disclosure; Figure 3 A schematic diagram of yet another terminal monitoring and alarm interface provided in an embodiment of this disclosure; Figure 4 An architecture diagram of a specific traffic isolation system provided in this disclosure embodiment; Figure 5 This is a schematic diagram of the structure of a flow isolation device provided in an embodiment of the present disclosure; Figure 6 This is a schematic diagram of the hardware composition structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0020] Embodiments of this disclosure are described in detail below. Examples of these embodiments are illustrated in the accompanying drawings, wherein the same or similar reference numerals denote the same or similar elements or elements having the same or similar functions throughout. The embodiments described below with reference to the accompanying drawings are exemplary and intended to explain this disclosure, and should not be construed as limiting this disclosure.

[0021] To facilitate a better understanding of the technical solutions described in the embodiments of this disclosure by those skilled in the art, the technical terms in the embodiments of this disclosure are explained as follows before introducing the embodiments of this disclosure.

[0022] The relevant solutions mainly rely on client-side anti-cheating detection and IP proxy rotation technology. Client-side detection involves installing a protection module on the user's terminal to identify cheating, while IP proxy technology circumvents blocking by frequently changing the exit IP address.

[0023] The above solution has the following drawbacks: First, client-side detection cannot resolve the issue of collateral bans in shared IP environments; second, frequent IP changes lead to increased network latency and connection instability; finally, traditional device fingerprints are easily forged by technologies such as virtual machines, and static detection rules are ill-equipped to handle new cheating methods. These shortcomings severely impact the gaming experience for legitimate players and the operational efficiency of internet cafes.

[0024] Most traffic isolation solutions rely on public IP addresses to identify user risks as a whole, which cannot accurately distinguish individual user traffic in local area network shared IP scenarios. The risk identification dimension is singular, relying solely on single behavioral data to determine cheating risks, which is prone to misjudgment and missed judgment. Moreover, they generally adopt a one-size-fits-all ban and isolation approach, which can easily lead to the problem of normal players being banned along with cheaters in shared networks, while cheaters cannot be accurately controlled. This results in poor accuracy of game network risk control, low isolation flexibility, and poor user experience.

[0025] To address the shortcomings of related technologies, this disclosure collects device hardware characteristics and user behavior characteristics after a user logs into the terminal device, and uses a network processing device to perform protocol layer traffic marking to generate network traffic carrying the user's network identifier. Based on the device hardware characteristics, the user behavior characteristics, and the network traffic carrying the user's network identifier, a comprehensive risk score is determined for initial screening. For high-risk users, game data is further combined to determine abnormal game behavior scores. Finally, corresponding traffic isolation operations are performed based on the abnormal scores. This can solve the shortcomings of not being able to distinguish individual users in shared IP scenarios, the single dimension of risk control judgment, and the one-size-fits-all isolation management. It avoids innocent users being banned along with others and cheating users circumventing risk control, improves the accuracy of game traffic risk identification and the refinement of traffic isolation, and thus improves the user experience.

[0026] The present disclosure will now be described in further detail with reference to the accompanying drawings and specific embodiments.

[0027] The traffic isolation method provided in this disclosure can be applied to scenarios such as game anti-cheating risk control, local area network shared IP traffic management, and internet cafe game network security protection. The executing entity of the method can be a gateway device, a network processing device, or a cloud risk control server or an edge network management platform.

[0028] like Figure 1 As shown, Figure 1 This is a flowchart illustrating a traffic isolation method provided in an embodiment of this disclosure. The traffic isolation method provided in this embodiment includes the following steps: Step 101: In response to the target user's login terminal device, obtain the device hardware characteristics and user behavior characteristics associated with the target user; In one embodiment, the target user is a game player who logs into the internet cafe terminal device and engages in online game operations.

[0029] In one embodiment, the terminal device is a client computer used by players to run games in an internet cafe setting, and may also include an electronic terminal with hardware acquisition and game running capabilities.

[0030] In one embodiment, device hardware features refer to fingerprint data that uniquely identifies the underlying hardware of a single terminal device. Device hardware features may include inherent underlying parameters of the terminal, such as graphics card rendering latency, sound card clock offset, and hard disk hardware serial number, which are used to distinguish different physical terminal devices.

[0031] In one embodiment, user behavior features refer to the temporal characteristic data of players' human-computer interaction habits. User behavior features may include interactive data such as mouse movement trajectory coordinates, mouse sliding duration, keyboard key press timestamps, and continuous click intervals, which are used to distinguish different players.

[0032] In one embodiment, a local background data collection program on the terminal can automatically capture the underlying hardware parameters and raw keyboard and mouse operation data after the user completes the login verification, and then encrypt and upload them to the network processing device.

[0033] Step 102: Based on the network processing device, perform protocol layer marking processing on the network traffic of the target user to generate network traffic carrying the user's network identifier; In one embodiment, the network processing device is an intelligent egress gateway deployed at the boundary between the intranet and the Internet, which has the capabilities of IP / Transmission Control Protocol (TCP) protocol message rewriting, traffic forwarding, and data parsing.

[0034] In one embodiment, network traffic specifically refers to game service data packets sent by the target user terminal, excluding other non-game internet traffic such as web browsing and video streaming.

[0035] In one embodiment, protocol layer marking processing, or protocol-level traffic coloring, is divided into two types of operations: transport layer TCP marking and network layer Time To Live (TTL) marking. The transport layer TCP marking configures a unique and differentiated TCP initial sequence number increment pattern for each user. It generates exclusive sequence number change rules based on user identifiers and timestamps, and rewrites the TCP handshake message sequence number to achieve transport layer identity differentiation. The network layer TTL marking generates an exclusive time to live value based on TTL dynamic encoding rules, and writes the calculated TTL value into the IP packet header to achieve network layer hierarchical marking. This encoding is dynamically refreshed every minute, and the original user identifier cannot be directly deduced from the plaintext TTL.

[0036] In one embodiment, the user network identifier is a two-layer invisible identity label composed of TCP sequence number features and TTL encoding value. The game server can only identify the shared public IP and cannot parse this identifier. Only the network processing device and the background analysis system can read it, thereby realizing the differentiation of single-person traffic in the shared IP scenario.

[0037] Step 103: Determine the comprehensive risk score of the target user based on device hardware characteristics, user behavior characteristics, and network traffic carrying the user's network identifier; In one embodiment, the comprehensive risk score is a cheating suspicion score obtained by integrating the aforementioned multi-dimensional features (i.e., device hardware features, user behavior features, and network traffic carrying user network identifiers). The higher the score, the higher the probability that the user has cheated.

[0038] In one embodiment, based on device hardware characteristics, user behavior characteristics, and network traffic carrying user network identifiers, a comprehensive risk score for the target user can be calculated using a weighted fusion model. The corresponding weighting factors can be adjusted by operations and maintenance personnel on the management platform based on historical cheating sample data.

[0039] In one embodiment, a prediction model can also be trained based on historical cheating sample data. The trained model is then input into the model, and the comprehensive risk score of the target user is directly output. The prediction model can be a gradient boosting tree model, a random forest model, a logistic regression model, a support vector machine model, or a shallow neural network model, etc.

[0040] Step 104: If the overall risk score is greater than the target risk score threshold, determine the abnormal game behavior score of the target user based on the game data of the target user. In one embodiment, the target risk score threshold is a preset global judgment threshold, which can be obtained by statistical fitting of historical normal player and cheating player sample data; if the comprehensive risk score is less than or equal to the target risk score threshold, it is determined that the user is not suspected of cheating, and the game traffic is forwarded to the game server normally.

[0041] In one embodiment, the game match data is the raw data of the user's battle behavior generated after entering the battle mode.

[0042] In one embodiment, the abnormal game behavior score is a cheat confidence score for the game's combat logic. Taking a shooting game as an example, the abnormal game behavior score is used to verify game cheat behaviors such as auto-aim, headshot lock, and rapid fire. The higher the score, the higher the degree to which the combat behavior violates the limits of human physiological operation.

[0043] In one embodiment, when the overall risk score is greater than the target risk score threshold, the game behavior abnormality score of the target user is determined based on the game data of the target user. This means that only suspected users whose overall risk score exceeds the target risk score threshold will have their game data retrieved to calculate the abnormal game behavior score. Normal users can skip this step, which can save backend computing power.

[0044] Step 105: Isolate the network traffic of the target user based on the abnormal game behavior score.

[0045] In one embodiment, the isolation operation is a differentiated traffic control method based on the duration of continuous exceeding of the abnormal score of game behavior. The isolation operation can be divided into isolation operations corresponding to low risk and isolation operations corresponding to high risk.

[0046] In one embodiment, the duration of abnormal game behavior scores exceeding the limit is continuously monitored. If the score does not exceed the limit for a preset duration, isolation operations corresponding to low risk are performed. The isolation operations corresponding to low risk include at least one of reducing the target user's game traffic transmission bandwidth and pushing risk alarm information to the internet cafe control center.

[0047] In one embodiment, if the abnormal game behavior score continues to exceed the limit for a preset time, the user is identified as a high-confidence cheating user, and isolation operations corresponding to high risk are performed. The isolation operations corresponding to high risk include at least one of the following: diverting all game traffic of the user to the honeypot server to retain complete evidence data packets, blocking the cheating user's outbound game traffic, and marking the terminal hardware fingerprint to restrict the device from repeatedly logging into the game.

[0048] In one embodiment, the honeypot server is an independently deployed deception and evidence-gathering node that does not carry normal game services. It is specifically designed to capture cheating traffic and fully store hardware characteristics, network identifiers, and battle behavior logs.

[0049] By collecting terminal hardware and player operation characteristics during user login, IP / TCP protocol traffic is colored at the egress gateway to generate a unique network identifier for each user. The above characteristics are combined to calculate a global comprehensive risk score to complete the first layer of coarse screening. For high-suspect users, game data is retrieved to calculate abnormal game behavior scores. Finally, based on the duration of abnormal game behavior scores exceeding the limit, tiered traffic isolation operations are performed. This can solve the problem of multiple terminals in internet cafes sharing a single public IP address, which leads to the entire internet cafe being banned if one person cheats. At the same time, the accuracy of cheat identification is improved by verifying device, behavior, and network characteristics, taking into account both the user experience of normal players and the game's anti-cheating control needs.

[0050] In one embodiment, obtaining the device hardware characteristics and user behavior characteristics associated with the target user includes: Acquire rendering latency data, clock offset data, mouse movement trajectory data, and key operation data generated by the target user's operation of the terminal device; Based on the rendering latency data and the clock offset data, the device hardware characteristics are generated, and based on the mouse movement trajectory data and the key operation data, the user behavior characteristics are generated.

[0051] In one embodiment, the rendering latency data is the computational delay time generated when the graphics card of the terminal device performs graphics rendering tasks. It is used to reflect the inherent computational deviation of the graphics card hardware and is not affected by software drivers or game process modifications.

[0052] In one embodiment, the clock offset data is the time offset parameter of the terminal sound card hardware crystal oscillator, which is an inherent error of the underlying hardware of the device. The offset value is different for different physical terminals.

[0053] In one embodiment, the mouse movement trajectory data is a time-series data of coordinate sequences, movement speed, and turning changes continuously collected when the user operates the mouse, used to record the player's mouse operation habits.

[0054] In one embodiment, the key operation data is the precise timestamps corresponding to the pressing and releasing of keyboard keys, including the duration of a single key press, the interval between consecutive key presses, and the timing of key combination triggers, among other interaction records.

[0055] In one embodiment, a local background data acquisition program on the terminal can silently read the rendering latency data from the graphics card's underlying interface and the clock offset data from the sound card's hardware registers after the user logs into the terminal and completes identity verification; it can also simultaneously monitor the keyboard and mouse driver interface to capture mouse movement trajectory data and key operation data in real time.

[0056] For example, after a user logs into the terminal, the data acquisition program periodically reads the underlying hardware parameters and the raw timing data of human-computer interaction, including raw hardware data, raw mouse trajectory data, and raw key operation data. The raw hardware data includes: graphics card rendering latency data and sound card clock offset data. The graphics card rendering latency data characterizes the underlying computing characteristics of the graphics card hardware; the sound card clock offset data characterizes the inherent deviation of the sound card's crystal oscillator. The raw mouse interaction data characterizes the user's hand operation habits. The raw key interaction data characterizes the user's key operation rhythm.

[0057] In one embodiment, the rendering latency data and clock offset data can be normalized in advance, and a fixed hash fusion algorithm can be used to perform weighted operations on the two types of hardware data to output a unique hardware fingerprint as the device hardware feature; simultaneously, the trajectory information entropy of the mouse movement trajectory data and the mean and variance of the key intervals of the key operation data are calculated, and the two types of interaction indicators are fused to generate a behavioral fingerprint as the user behavior feature.

[0058] In one embodiment, device hardware features are generated based on rendering latency data and clock offset data. Alternatively, a hardware feature hierarchical coding mechanism can be used to map the normalized two types of raw hardware data to a fixed-length coding interval, and the coding result is directly used as the device hardware features. For the raw interaction data of the mouse and buttons, the mouse operation coefficient and button rhythm coefficient are determined by a preset behavior feature quantification formula, and the user behavior features are obtained by splicing and combining them.

[0059] This embodiment acquires rendering latency data, clock offset data, mouse movement trajectory data, and key operation data generated by the target user's operation of the terminal device; it generates device hardware features based on rendering latency data and clock offset data, and generates user behavior features based on mouse movement trajectory data and key operation data; it constructs features from two dimensions, namely device physical hardware and user operating habits, to avoid the defects of single-dimensional features being easily tampered with and having insufficient recognition accuracy.

[0060] In one embodiment, the device hardware characteristics are generated based on the rendering latency data and the clock offset data, including: The rendering latency data is standardized, and the clock offset data is Fourier transformed to obtain the energy coefficient corresponding to the clock offset data. The standardized rendering latency data and the energy coefficient are encrypted to generate the device hardware characteristics.

[0061] In one embodiment, the standardization of rendering latency data refers to normalizing and scaling the raw latency values ​​obtained from multiple rounds of data collection by the graphics card, eliminating the data dimension deviation caused by differences in collection time and screen load, and mapping all latency values ​​to a unified value range.

[0062] In one embodiment, the clock offset data is a timing offset sequence continuously sampled by the sound card crystal oscillator. The Fourier transform is used to convert the continuously fluctuating offset data in the time domain to the frequency domain, and decompose the frequency domain components corresponding to different fluctuation frequencies.

[0063] In one embodiment, the energy coefficient is the weighted sum of the amplitudes of each frequency domain component after Fourier transform, which can uniquely characterize the inherent offset fluctuation pattern of a single sound card hardware, and the energy coefficients of different terminal devices are not repeated.

[0064] In one embodiment, the Z-Score normalization algorithm can be used to normalize the rendering latency data, and the mean and standard deviation of all sampled latency can be used to complete the numerical scaling; the Discrete Fourier Transform (DFT) can be used to perform frequency domain transformation on the clock offset timing data, and the energy coefficient can be obtained by traversing all frequency domain points to calculate the cumulative value of the frequency domain amplitude.

[0065] In one embodiment, Min-Max normalized mapping can be used to render the latency to the 0~1 range; Fast Fourier Transform (FFT) is used to improve the clock offset frequency domain conversion efficiency, and the total energy coefficient is obtained by summing the squares of each frequency point of the transformation result.

[0066] In one embodiment, the encryption process refers to concatenating the normalized time delay sequence and the frequency domain energy coefficient into a one-dimensional feature array, and then outputting a fixed-length hash string as the device hardware fingerprint through a hash encryption algorithm, i.e., the aforementioned device hardware feature.

[0067] In one embodiment, the standardized rendering latency data and the energy coefficient can be encrypted using SHA256 hash encryption to generate the device hardware features.

[0068] This embodiment standardizes the rendering latency data and performs Fourier transform on the clock offset data to obtain the energy coefficient corresponding to the clock offset data. The standardized rendering latency data and energy coefficient are then encrypted to generate device hardware features. This ensures that the hardware features of different terminal devices are distinguishable and prevents the leakage of the original plaintext data of the terminal's underlying hardware, thereby improving the stability of hardware feature recognition and data security.

[0069] In one embodiment, the user behavior characteristics are generated based on the mouse movement trajectory data and the key operation data, including: Extract the mouse movement angle sequence from the mouse movement trajectory data, and extract the key interval time sequence from the key operation data; The mouse movement angle sequence and the key press interval time sequence are normalized respectively, and the normalization results are encrypted to generate the user behavior features.

[0070] In one embodiment, the mouse movement trajectory data is a set of coordinate time sequences continuously collected when the user operates the mouse, and the mouse movement angle sequence is an ordered sequence composed of mouse sliding and turning angles calculated based on adjacent coordinate points, which can reflect the player's hand sliding and turning operation habits.

[0071] In one embodiment, the key operation data is a set of precise timestamps corresponding to keyboard press and release actions, and the key interval time sequence is an ordered sequence of durations between two adjacent key actions, which can reflect the player's keyboard typing rhythm.

[0072] In one embodiment, the mouse movement angle sequence may include the single sliding turning angle, the difference in continuous turning angle changes, the short-term angle fluctuation amplitude, and the frequency of large-amplitude turning; the key interval time sequence may include the duration of short-interval continuous clicking, the duration of long-interval pause, the average interval of continuous clicking, and the interval difference of different key combinations.

[0073] In one embodiment, mouse coordinates can be read frame by frame, the sliding turning angle can be calculated using the displacement vector between two points, and the complete mouse movement angle sequence can be obtained by concatenating the data in the order of operation. Alternatively, all key timestamps can be traversed, the time difference between adjacent keys can be calculated sequentially, and the key interval time sequence can be obtained by concatenating the data in the order of operation.

[0074] In one embodiment, raw data segments of the mouse and buttons can be captured according to a fixed sampling period, and the movement angle subsequence and button interval subsequence within the corresponding segments can be extracted in segments to characterize user operation behavior in different time periods.

[0075] In one embodiment, normalization is a standardization operation to eliminate the differences in the dimensions and numerical ranges of angle and time data, mapping both types of sequences to a unified numerical range to facilitate subsequent unified quantification and comparison.

[0076] In one embodiment, Min-Max normalization can be used to map mouse angles and button intervals to the 0~1 range; or Z-Score normalization can be used to scale the values ​​based on the sequence's own mean and standard deviation to eliminate data fluctuations caused by operation time and game scenarios.

[0077] In one embodiment, the encryption process refers to concatenating and integrating the normalized mouse angle sequence and button interval sequence into a complete behavioral feature array, and then using an irreversible hash algorithm to calculate and output a unique fixed-length string as the user behavior fingerprint, i.e., the user behavior feature.

[0078] This embodiment extracts mouse movement angle sequences from the mouse movement trajectory data and key interval time sequences from the key operation data; it then normalizes both the mouse movement angle sequences and the key interval time sequences, and encrypts the normalization results to generate the user behavior features. This comprehensively portrays the player's unique operating habits from two dimensions: mouse swiping and keyboard typing, avoiding the problem of one-sided identification based on single behavior data. Simultaneously, the encryption process protects the privacy of the original timing of user operations, ensuring the distinguishability of user behavior features and data security.

[0079] In one embodiment, the network traffic of the target user is subjected to protocol layer tagging processing by a network processing device to generate network traffic carrying the user's network identifier, including: The network processing device configures a corresponding initial sequence number increment pattern for each user at the transport layer. Based on the user identifier and target minutes of the target user, determine the network layer time-to-live value corresponding to the target user; Based on the initial sequence number growth pattern and the time-to-live value, the network traffic of the target user is subjected to protocol layer marking processing to generate network traffic carrying the user's network identifier.

[0080] In one embodiment, the initial sequence number growth pattern of the transport layer refers to the differentiated sequence iteration rule designed for TCP transport layer handshake messages, which is used to build user-specific traffic identification features in the transport layer. The initial sequence number growth patterns corresponding to different target users are independent of each other and do not repeat.

[0081] In one embodiment, the initial sequence number growth pattern may include parameters such as the base starting value of the TCP initial sequence number, the single iteration increment step size, the dynamic offset rule, and the timing refresh period.

[0082] In one embodiment, a unique sequence number iteration parameter combination can be generated based on the target user's unique user identifier and real-time timestamp through encrypted hashing, and configured as the initial sequence number growth mode for the corresponding user; alternatively, a unique TCP sequence number growth iteration strategy can be assigned to each user logging into the terminal according to preset differentiated configuration rules.

[0083] In one embodiment, a mapping table between users and sequence number growth patterns can also be established. After a user logs in, the network processing device automatically matches and binds the user to a unique growth pattern, ensuring that the transport layer characteristics of the same user remain stable over a long period of time and that the characteristics of different users are completely distinguishable.

[0084] In one embodiment, the user identifier is an account code that uniquely represents the identity of the target user; the target minutes are system minute-level time parameters obtained in real time by the network processing device.

[0085] In one embodiment, the network layer's Time to Live (TTL) value is an assignment parameter of the IP protocol's native TTL field, used to add an invisible layering mark to user traffic at the network layer.

[0086] In one embodiment, the survival time value of the appropriate matching interval can be calculated by using dynamic encoding rules that combine bitwise AND, integer division, and modulo operations between the user identifier and the target minutes; alternatively, a real-time survival time value specific to the target user can be obtained by matching the user identifier and timestamp based on a preset encoding mapping template.

[0087] In one embodiment, the initial sequence number and iterative growth pattern of the target user's game TCP handshake message can be rewritten based on the configured initial sequence number growth pattern to complete the transport layer traffic marking; at the same time, the calculated time-to-live value is written into the target user's game IP packet header to complete the network layer traffic marking.

[0088] In one embodiment, batch packet marking processing of the TCP transport layer and IP network layer can also be completed synchronously according to the preset protocol marking priority rules, and the dual-layer protocol features can be uniformly embedded into all game service traffic of the target user to generate user-specific network traffic.

[0089] This embodiment achieves differentiated marking at two protocol layers by configuring a user-specific sequence number growth mode at the transport layer and generating a dynamic time-to-live value by combining user identifiers and time parameters at the network layer. By combining static user features with dynamic time features to generate an invisible network identifier, it ensures accurate differentiation of multi-user traffic in shared public IP scenarios and avoids malicious tampering of fixed marking features to evade detection, thereby improving the uniqueness, security, and stability of traffic identifiers.

[0090] In one embodiment, isolating the network traffic of the target user based on the game behavior anomaly score includes: If the abnormal game behavior score exceeds the target abnormal score threshold and the duration does not reach the preset duration, the network traffic of the target user is isolated at the first level. The first level isolation operation includes at least one of reducing the network bandwidth of the terminal device and pushing alarm information to the management platform. If the abnormal game behavior score exceeds the target abnormal score threshold and the duration reaches the preset duration, a second-level isolation operation is performed on the target user's network traffic. The second-level isolation operation includes at least one of the following: diverting the network traffic to the target server, blocking the target user's outbound game traffic, and marking the hardware characteristics of the terminal device.

[0091] In one embodiment, the target anomaly scoring threshold is a pre-set critical score for abnormal combat behavior, used to distinguish between normal combat behavior and suspected cheating combat behavior.

[0092] In one embodiment, the duration refers to the cumulative length of time during which the abnormal game behavior score continuously exceeds the target abnormal score threshold, which is used to determine whether the user's cheating behavior is a temporary fluctuation or a stable and continuous occurrence.

[0093] In one embodiment, the preset duration is a time criterion used to distinguish between low-risk suspected cheating and high-risk confirmed cheating, and can be flexibly configured based on the statistical results of historical cheating samples.

[0094] In one embodiment, the first-level isolation operation is a low-risk early warning type of traffic control measure, which only restricts traffic transmission conditions and reports risks simultaneously, without completely cutting off the user's game communication, i.e., the isolation operation corresponding to the aforementioned low risk; the second-level isolation operation is a high-risk blocking type of traffic control measure, which performs multiple controls on cheating traffic, including isolation and evidence collection, blocking communication, and restricting device reuse, i.e., the isolation operation corresponding to high risk.

[0095] In one embodiment, the numerical status of abnormal game behavior scores can be continuously monitored in real time, and the duration of continuous timing when the score exceeds the target abnormal score threshold can be recorded. When the score is detected to have exceeded the target abnormal score threshold, timing is started, and the corresponding level of isolation operation is matched according to the relationship between the timing duration and the preset duration.

[0096] In one embodiment, abnormal game behavior scores can be sampled at fixed time slices, and it can be determined whether the threshold is exceeded on a time slice basis. The duration can be calculated by superimposing the number of consecutive time slices that exceed the threshold, and hierarchical isolation operations can be performed based on the duration interval.

[0097] In one embodiment, the target server is a stand-alone honeypot forensics server used to fully retain cheating traffic and battle behavior logs.

[0098] In one embodiment, when performing the first-level isolation operation, either bandwidth reduction or alarm push can be selected individually, or both control actions can be executed simultaneously. Similarly, when performing the second-level isolation operation, either traffic diversion, outbound traffic blocking, or hardware feature marking can be selected individually, or multiple control actions can be combined and executed simultaneously.

[0099] This embodiment determines the cheating risk level by jointly assessing two dimensions: abnormal game behavior scoring and the duration of consecutive score exceeding the limit. It then applies two differentiated traffic control operations: Level 1 warning isolation and Level 2 ban isolation. For suspected cheating users with temporary fluctuations, only mild warning control is applied. For users with continuous and stable cheating, multiple strict controls such as evidence collection, network disconnection, and device marking are implemented. This approach balances the user experience of normal gamers with the strength of game anti-cheating control, avoiding the problems of false bans and missed controls caused by a single isolation strategy.

[0100] In one embodiment, a specific traffic isolation method provided by this disclosure is implemented as follows: 1. Multimodal fingerprint acquisition, including: Users log in to the cloud internet cafe terminal, and the client silently collects the device fingerprint.

[0101] Hardware fingerprinting technology utilizes graphics card rendering latency (accurate to ±0.3ms difference) and sound card clock skew to generate a unique device ID. This ID undergoes 256-bit encrypted hashing to ensure secure device identity binding and is recorded in the cloud internet cafe backend system as a unique identifier for the device.

[0102] Behavioral fingerprinting technology focuses on recording the acceleration curve of mouse movements, specifically the natural jitter patterns of human operation. These jitters are both regular and unique. For example, in normal operation, mouse movement trajectories exhibit a certain smoothness and randomness, while mouse movements controlled by cheating software tend to be more abrupt and regular. By analyzing the acceleration changes in the mouse movement trajectory, features reflecting user operating habits and behavioral patterns can be extracted.

[0103] By analyzing key press rhythms, especially the press intervals of commonly used key combinations such as "WASD," significant differences can be found between the operations of normal players and those controlled by cheat software. The key press rhythms of normal players are diverse, influenced by personal habits and reaction speed, while cheat software often exhibits fixed key press patterns and rhythms. Analyzing the key press interval time series allows for the extraction of key press rhythm characteristics, further enriching the content of behavioral fingerprints.

[0104] Establish a hardware fingerprint quantization model:

[0105] in, Let i be the latency sample value for the i-th graphics card rendering. S represents the benchmark mean and standard deviation of GPUs of the same model. audio This is the sound card clock offset sampling value. The Fourier transform energy coefficient of the sound card clock offset. Audio feature weighting factor.

[0106] Note: Standardize graphics card rendering latency based on baseline mean and standard deviation to eliminate hardware differences and ensure comparability of sampled values.

[0107] The uniqueness of fingerprints is enhanced by capturing the clock offset characteristics of the sound card using Fourier transform energy coefficients.

[0108] The importance of weighting factor adjustment features in fingerprint generation is emphasized to ensure that the fingerprint fully reflects the device characteristics.

[0109] Finally, a 256-bit hash value is generated using SHA256 encryption, which serves as the unique identifier of the device.

[0110] Behavioral fingerprint dynamic quantization model:

[0111] in, , The mouse movement angle range is divided into 12 30° intervals, and N is the number of sampling points.

[0112] Note: The mouse movement angle and key press interval time are normalized to eliminate differences in user operating habits and ensure the comparability of sampled values.

[0113] Weighting factors are used to adjust the importance of different behavioral features in fingerprint generation, ensuring that the generated fingerprint can fully reflect the user's behavioral patterns.

[0114] Finally, a 256-bit hash value is generated using SHA256 encryption, which serves as a unique identifier for the user's behavior.

[0115] Through standardization and weighted processing, it can be ensured that device fingerprints under different hardware configurations are comparable and unique.

[0116] Key rhythm model:

[0117] in, This represents the average interval between key presses. The standard deviation of the key press interval time. This is a weighting factor used to adjust the importance of each feature in the score.

[0118] Note: The key press interval time series records the timestamp of each key press and calculates the key press interval time series, which can capture the player's operation habits and behavior patterns.

[0119] The mean reflects the average state of key press intervals. Generally speaking, the average key press interval of normal players is higher, while the average key press interval of cheating players may be lower.

[0120] Standard deviation reveals the dispersion of key press intervals. Normal players tend to have a higher standard deviation, showing greater fluctuations, while cheaters may have a lower standard deviation, showing less fluctuations.

[0121] 2. Protocol-level traffic coloring; Differentiated features are injected into each user's game data packet at the egress gateway: TCP Timing Fine-tuning: Differentiated features are injected into each user's game data packets at the egress gateway. A unique TCP initial sequence number increment pattern is set for each user. By fine-tuning the increment pattern of the TCP initial sequence number, each user's data packets have a unique identifier during network transmission. For example, an encryption algorithm based on user ID and timestamp can be used to generate the TCP initial sequence number increment pattern, ensuring the uniqueness of each user's data packets at the TCP layer.

[0122] TTL (Time To Live) layering technology uses the TTL value in IP packets to categorize and label user traffic. By assigning different TTL values ​​to packets from different users, although game servers still identify them as the same IP, network administrators such as internet cafes can effectively distinguish users based on this hidden feature.

[0123] For example, when a game server receives data packets with different TTL values, even though these packets originate from the same IP address, the difference in TTL values ​​allows us to distinguish between different users. TTL layering technology not only effectively avoids the risk of collateral bans caused by shared IPs but also provides a solid basis for cheat detection. Through this dynamic encoding rule, accurate identification of user traffic and cheat detection can be achieved without exposing user IDs.

[0124] TTL dynamic encoding rules:

[0125] in, It is a bitwise AND operation, where t is the current number of minutes and userId is the user ID.

[0126] For example, when the game server returns a blocking data packet with a TTL of 67, the userId is calculated to be 39.

[0127] Note: By setting different TTL values ​​for data packets from different users, user traffic can be stratified and marked during network transmission.

[0128] This TTL layering technology can effectively avoid the problem of being blocked due to shared IPs, and also provides an important basis for cheating detection.

[0129] By using a bitwise AND operation mask, accurate identification of user traffic and detection of cheating can be achieved without exposing the user ID.

[0130] 3. Establish a mapping relationship table; The cloud-based internet cafe's backend server maintains a mapping table in real time. This table records user IDs, hardware fingerprints, behavioral fingerprints, TCP timing characteristics, TTL values, and other information to ensure the accuracy and efficiency of server configuration. It's like creating a detailed "map" of the server, allowing maintenance personnel to clearly understand its current status and configuration details. This mapping table enables real-time monitoring and analysis of user traffic, quickly locating cheating users and taking appropriate action.

[0131] After detecting an abnormal TTL value in a user data packet, the user ID is quickly located using a mapping table, and information such as hardware fingerprints and behavioral fingerprints is integrated for a comprehensive evaluation to determine whether the user has engaged in cheating.

[0132]

[0133] Table 1 As shown in Table 1, Table 1 includes fields such as User ID, Current IP:Port, Game Name, Fingerprint Feature, and Data Packet Tag. The data packet tag contains a Time To Live (TTL) value. The table displays two data records. In the first record, the user ID is X5K9B2, the current IP:port is 192.168.1.100:5532, the game name is PUBG, the fingerprint feature is mouse trajectory mode A, and the data packet tag is Time To Live (TTL) = 65. In the second record, the user ID is Y3P7R1, the current IP:port is 192.168.1.100:5533, the game name is League of Legends, the fingerprint feature is keyboard rhythm mode B, and the data packet tag is Time To Live (TTL) = 66. This table is used to store the binding mapping relationship between user account, intranet address, game business, operation fingerprint, and Time To Live (TTL) tag, supporting single user traffic identification and game risk management in shared public IP scenarios.

[0134] Cheating detection model. This model will comprehensively consider hardware fingerprints, behavioral fingerprints, protocol-level features, and keystroke rhythm features to more comprehensively determine whether a user is cheating.

[0135]

[0136] in, This is a weighting factor used to adjust the importance of each dimension in the overall score. When the Composite_Score exceeds a preset threshold, the system determines that the user has engaged in cheating. An appropriate threshold can be determined through historical data analysis.

[0137] 4. Abnormal behavior monitoring based on artificial intelligence (AI) behavior analysis.

[0138] Different models are developed to detect abnormal behavior for different games.

[0139] Take the shooting game CSGO as an example: Shooting behavior anomaly scoring model:

[0140] in, The interval between consecutive shots (ms) The average human reaction time The average of the headshot rate over a sliding window. These are the weighting coefficients.

[0141] Explanation: By comparing the intervals between consecutive shots with the average human reaction time, it can be determined whether a player's reaction speed is abnormal.

[0142] By comparing the average headshot rate of the sliding window with the average headshot rate of normal players, it can be determined whether a player's headshot rate is abnormal.

[0143] Weighting factors are used to adjust the importance of different behavioral characteristics in the scoring model, ensuring that the scoring model can comprehensively reflect the degree of abnormality in a player's behavior.

[0144] If the score S value remains above 1.8 for 5 seconds, the system will automatically determine that the user is suspected of cheating.

[0145] When S > 1.8 for 5 consecutive seconds, the system determines that the user is cheating. For example, if the AI ​​engine detects that a user has a 98% headshot rate in CS:GO and their mouse trajectory entropy value is below a threshold, the following action is triggered: The system will immediately redirect the traffic of cheating users to a specially designed honeypot server, which is disguised as a game server and specifically used to collect evidence of cheating. This operation ensures that the gaming experience of normal players is not disturbed while conducting in-depth analysis and evidence collection of cheating behavior.

[0146] Send an alert to the management system: "User (Device ID: XK92) is suspected of aiming fraud, confidence level 92%", so that the internet cafe administrator can take further action in a timely manner.

[0147] like Figure 2 As shown, Figure 2 This is a schematic diagram of a terminal monitoring and alarm interface provided in an embodiment of this disclosure. The interface is divided into a left function bar and a right terminal display area. The upper part of the left function bar has a display and sorting module, which includes drop-down options for all rooms and drop-down options sorted by number. It also displays the number of terminals that are idle, reserved, occupied, overdue, and total. The lower part of the left function bar has four function buttons: re-login, business reports, financial management, and parameter settings. The right terminal display area presents multiple client machines in the form of computer cards. Each card is labeled with a name, status, and progress. Among them, card number 3 is labeled with user (device ID: XK92), status is normal, confidence level is 2%, and card number 7 is labeled with user (device ID: XK92), suspected of aimbot, confidence level is 92%. The bottom of the interface has operation buttons for previous page, add room, and next page. This interface can visually display the online status of all terminal devices in the internet cafe and the confidence level of game cheating risk, which is convenient for maintenance personnel to perform corresponding traffic isolation and control operations based on risk warnings.

[0148] The system updates its detection rules in real time to address the emergence of new cheats. For example, once a new cheat is detected, the system immediately prioritizes the detection of related behavioral characteristics and meticulously compares the cheat's operation mode with that of normal players to quickly identify abnormal behavior. The system connects all cloud internet cafe nodes, continuously optimizing the detection model by anonymously sharing cheat feature data. The central server simulates the latest cheating methods, generates training samples, and distributes them to each node to help local models identify potential threats in advance.

[0149] 5. Dynamically isolate cheating players, including: Initial warning: Suspected cheating. The system automatically lowers the user's network priority and limits bandwidth. This provides an initial restriction on suspected cheaters, reducing their impact on the normal gaming experience. Simultaneously, the system sends a pop-up warning to the internet cafe administrator: "User A is suspected of using cheats. Please confirm immediately." This ensures the administrator can quickly conduct a manual review of potential cheating and take appropriate action.

[0150] like Figure 3 As shown, Figure 3This is a schematic diagram of another terminal monitoring and alarm interface provided in this embodiment. The interface is divided into a left function bar, a top terminal display area, and a middle pop-up area. The upper part of the left function bar is a display and sorting area, with drop-down options for all rooms and drop-down options for sorting by number. It also displays statistics on the number of terminals that are available, reserved, occupied, overdue, and total. The lower part of the left function bar has function buttons for re-login, business reports, financial management, and parameter settings arranged in sequence. The top terminal display area displays multiple client machines in the form of computer cards, with each card labeled with its name, status, and progress. The user card labeled on machine 3 (device ID: XK92) is in normal status with a confidence level of 2%. The user card labeled on machine 7 (device ID: XK92) is suspected of aimbot activity with a confidence level of 92%. The bottom of the interface has buttons for previous page, add room, and next page. A gray pop-up window appears in the middle of the interface with the warning: User A may be cheating. Please confirm. This interface can simultaneously display the operating status of the internet cafe terminals, the confidence level of cheating risk, and pop up violation alarms, making it easy for network administrators to promptly discover terminals suspected of cheating and conduct verification and traffic isolation operations.

[0151] Advanced Ban: Upon confirmation of cheating, immediately redirect the user's game traffic to a "honeypot server." The honeypot server will then meticulously record and analyze the cheater's behavior to gather sufficient evidence of cheating. Simultaneously, the device will be flagged in the internet cafe's management system, requiring mandatory real-name authentication upon the next login to prevent the cheater from using the device again.

[0152] Precise IP blocking is employed to counter this issue. After the game server blocks an IP address, the gateway uses coloring tags to discard only the traffic of cheating users, leaving other users unaware. Through protocol-level traffic coloring technology, even when IPs are blocked, the traffic of cheating users can be accurately identified and discarded, while the traffic of legitimate users remains unaffected.

[0153] Quickly locate the cheating user: Check the logs to find the users who were active at the time of the ban, and compare them with the game company's ban reasons (such as "aiming cheat"). By analyzing the log information and the game company's ban reasons, the specific information of the cheating user can be quickly located, providing a strong basis for subsequent processing.

[0154] Dynamic IP Replacement Mechanism: The system will automatically assign unbanned backup IPs to legitimate users, while cheating users will continue to use their original IPs. This serves as punishment for their cheating behavior (forcing them to bear the consequences of being banned). Through dynamic IP replacement technology, network connectivity can be quickly restored without affecting the gaming experience of legitimate users, while cheating users continue to suffer the consequences of IP bans.

[0155] like Figure 4 As shown, Figure 4This disclosure provides an architecture diagram of a specific traffic isolation system, divided into a terminal layer, a network processing layer, an intelligent analysis layer, an execution layer, and a management platform. The terminal layer includes player terminal 1 and player terminal 2, both of which send data to the intelligent gateway via encrypted transmission. The intelligent gateway sends traffic to the network processing layer, where it undergoes preprocessing through a traffic coloring engine and dynamic routing decision-making. The preprocessed traffic enters the intelligent analysis layer, where the AI ​​behavior analysis module first parses the operation data, then inputs it into a risk scoring model to calculate a risk score, and finally sends it to the decision engine. The decision engine also receives policy configurations from the internet cafe control center. The decision engine distinguishes between normal and abnormal traffic and routes it to the execution layer. The execution layer includes a game server, a honeypot system, and an isolation control terminal. Normal traffic is sent to the game server, while abnormal traffic is sent to the honeypot system and the isolation control terminal. The honeypot system generates forensic data and pushes it to the internet cafe control center, while the isolation control terminal receives alarms from the internet cafe control center. The internet cafe control center can then send policy configurations back to the intelligent gateway, forming a complete control chain.

[0156] In summary, the solution provided in this public disclosure is as follows: By collecting device hardware characteristics and user behavior characteristics after a user logs into their terminal device, and using network processing equipment to perform protocol layer traffic labeling to generate network traffic carrying the user's network identifier, a comprehensive risk score is determined based on the device hardware characteristics, user behavior characteristics, and network traffic carrying the user's network identifier for initial screening. High-risk users are further identified by combining game data to determine abnormal game behavior scores. Finally, corresponding traffic isolation operations are performed based on the abnormal scores. This approach can solve the shortcomings of sharing IP scenarios, such as the inability to distinguish individual users, the single dimension of risk control judgment, and the one-size-fits-all isolation management. It avoids innocent users being banned along with others and cheating users circumventing risk control, improves the accuracy of game traffic risk identification and the refinement of traffic isolation, and thus improves the user experience.

[0157] To implement the traffic isolation method provided in this disclosure, this disclosure also provides a traffic isolation device, such as... Figure 5 As shown. Figure 5 This is a schematic diagram of a flow isolation device provided in an embodiment of the present disclosure. The flow isolation device 500 includes: The acquisition unit 501 is used to acquire the device hardware characteristics and user behavior characteristics associated with the target user in response to the target user logging into the terminal device. The generation unit 502 is used to perform protocol layer marking processing on the network traffic of the target user based on the network processing device, and generate network traffic carrying the user's network identifier. The first determining unit 503 is used to determine the comprehensive risk score of the target user based on the device hardware characteristics, the user behavior characteristics, and the network traffic carrying the user network identifier. The second determining unit 504 is used to determine the abnormal game behavior score of the target user based on the game data of the target user when the comprehensive risk score is greater than the target risk score threshold. Isolation unit 505 is used to isolate the network traffic of the target user based on the game behavior anomaly score.

[0158] In one embodiment, the acquisition unit 501 is specifically used for: Acquire rendering latency data, clock offset data, mouse movement trajectory data, and key operation data generated by the target user's operation of the terminal device; Based on the rendering latency data and the clock offset data, the device hardware characteristics are generated, and based on the mouse movement trajectory data and the key operation data, the user behavior characteristics are generated.

[0159] In one embodiment, the generation unit 502 is specifically used for: The rendering latency data is standardized, and the clock offset data is Fourier transformed to obtain the energy coefficient corresponding to the clock offset data. The standardized rendering latency data and the energy coefficient are encrypted to generate the device hardware characteristics.

[0160] In one embodiment, the generation unit 502 is specifically used for: Extract the mouse movement angle sequence from the mouse movement trajectory data, and extract the key interval time sequence from the key operation data; The mouse movement angle sequence and the key press interval time sequence are normalized respectively, and the normalization results are encrypted to generate the user behavior features.

[0161] In one embodiment, the generation unit 502 is specifically used for: The network processing device configures a corresponding initial sequence number increment pattern for each user at the transport layer. Based on the user identifier and target minutes of the target user, determine the network layer time-to-live value corresponding to the target user; Based on the initial sequence number growth pattern and the time-to-live value, the network traffic of the target user is subjected to protocol layer marking processing to generate network traffic carrying the user's network identifier.

[0162] In one embodiment, the isolation unit 505 is specifically used for: If the abnormal game behavior score exceeds the target abnormal score threshold and the duration does not reach the preset duration, the network traffic of the target user is isolated at the first level. The first level isolation operation includes at least one of reducing the network bandwidth of the terminal device and pushing alarm information to the management platform. If the abnormal game behavior score exceeds the target abnormal score threshold and the duration reaches the preset duration, a second-level isolation operation is performed on the target user's network traffic. The second-level isolation operation includes at least one of the following: diverting the network traffic to the target server, blocking the target user's outbound game traffic, and marking the hardware characteristics of the terminal device.

[0163] It should be noted that the traffic isolation device provided in the above embodiments is only illustrated by the division of the above program modules when performing traffic isolation. In practical applications, the above processing can be assigned to different program modules as needed, that is, the internal structure of the traffic isolation device can be divided into different program modules to complete all or part of the processing described above. In addition, the traffic isolation device provided in the above embodiments and the traffic isolation method provided in this disclosure are based on the same concept, and the specific implementation process can be found in the method embodiments, which will not be repeated here.

[0164] Figure 6 This is a schematic diagram of the hardware composition structure of the electronic device provided in the embodiments of this disclosure, such as... Figure 6 As shown, the electronic device 600 includes at least one processor 602; and a memory 601 communicatively connected to the at least one processor 602; wherein the memory 601 stores instructions executable by the at least one processor 602, the instructions being executed by the at least one processor 602 to implement the steps of the traffic isolation method of the present disclosure embodiments.

[0165] Optionally, the electronic device may specifically be a traffic isolation device in the embodiments of this application, and the electronic device may implement the corresponding processes implemented by the traffic isolation device in the various methods of the embodiments of this application. For the sake of brevity, it will not be described in detail here.

[0166] It is understood that the electronic device also includes a communication interface 603. Various components in the electronic device are coupled together via a bus system 604. It is understood that the bus system 604 is used to implement communication between these components. In addition to a data bus, the bus system 604 also includes a power bus, a control bus, and a status signal bus. However, for clarity, in... Figure 6 The general designated all buses as Bus System 604.

[0167] It is understood that memory 601 can be volatile memory or non-volatile memory, or both. Non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), ferromagnetic random access memory (FRAM), flash memory, magnetic surface memory, optical disc, or compact disc read-only memory (CD-ROM); magnetic surface memory can be disk storage or magnetic tape storage. Volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access Memory (DRAM), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), SyncLink Dynamic Random Access Memory (SLDRAM), and Direct Rambus Random Access Memory (DRRAM).The memory 601 described in this embodiment of the invention is intended to include, but is not limited to, these and any other suitable types of memory.

[0168] The methods disclosed in the above embodiments can be applied to or implemented by processor 602. Processor 602 may be an integrated circuit chip with signal processing capabilities. During implementation, each step of the above methods can be completed by integrated logic circuits in the hardware of processor 602 or by instructions in software form. Processor 602 may be a general-purpose processor, DSP, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Processor 602 can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of this invention. A general-purpose processor may be a microprocessor or any conventional processor, etc. The steps of the methods disclosed in the embodiments of this invention can be directly manifested as execution by a hardware decoding processor, or execution by a combination of hardware and software modules in the decoding processor. The software modules may be located in a storage medium, specifically memory 601. Processor 602 reads information from memory 601 and, in conjunction with its hardware, completes the steps of the aforementioned methods.

[0169] In an exemplary embodiment, the electronic device may be implemented by one or more application-specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), FPGAs, general-purpose processors, controllers, MCUs, microprocessors, or other electronic components to perform the aforementioned method.

[0170] This disclosure also provides a non-transitory computer-readable storage medium storing computer instructions, which are used to cause a computer to execute the steps of the traffic isolation method of the present invention.

[0171] Optionally, the computer-readable storage medium can be applied to the traffic isolation device in the embodiments of this application, and the computer instructions cause the computer to execute the corresponding processes implemented by the traffic isolation device in the various methods of the embodiments of this application. For the sake of brevity, they will not be described in detail here.

[0172] This disclosure also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the traffic isolation method provided in this embodiment of the invention.

[0173] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is only a logical functional division, and in actual implementation, there may be other division methods, such as: multiple units or components can be combined, or integrated into another system, or some features can be ignored or not executed. In addition, the coupling, direct coupling, or communication connection between the various components shown or discussed can be through some interfaces, and the indirect coupling or communication connection between devices or units can be electrical, mechanical, or other forms.

[0174] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected to achieve the purpose of this embodiment according to actual needs.

[0175] In addition, in the various embodiments of the present invention, each functional unit can be integrated into one processing unit, or each unit can be a separate unit, or two or more units can be integrated into one unit; the integrated unit can be implemented in hardware or in the form of hardware plus software functional units.

[0176] Those skilled in the art will understand that all or part of the steps of the above method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When the program is executed, it performs the steps of the above method embodiments. The aforementioned storage medium includes various media that can store program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0177] Alternatively, if the integrated units of this invention are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of the embodiments of this invention, or the parts that contribute to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as mobile storage devices, ROM, RAM, magnetic disks, or optical disks.

[0178] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A flow isolation method, characterized in that, include: In response to a target user logging into a terminal device, the device hardware characteristics and user behavior characteristics associated with the target user are obtained; The network processing device performs protocol layer tagging on the network traffic of the target user to generate network traffic carrying the user's network identifier. Based on the device hardware characteristics, the user behavior characteristics, and the network traffic carrying the user's network identifier, a comprehensive risk score for the target user is determined. If the overall risk score is greater than the target risk score threshold, an abnormal score for the target user's game behavior is determined based on the target user's game data. Based on the abnormal game behavior score, the network traffic of the target user is isolated.

2. The method according to claim 1, characterized in that, The acquisition of the device hardware characteristics and user behavior characteristics associated with the target user includes: Acquire rendering latency data, clock offset data, mouse movement trajectory data, and key operation data generated by the target user's operation of the terminal device; Based on the rendering latency data and the clock offset data, the device hardware characteristics are generated, and based on the mouse movement trajectory data and the key operation data, the user behavior characteristics are generated.

3. The method according to claim 2, characterized in that, The step of generating the device hardware characteristics based on the rendering latency data and the clock offset data includes: The rendering latency data is standardized, and the clock offset data is Fourier transformed to obtain the energy coefficient corresponding to the clock offset data. The standardized rendering latency data and the energy coefficient are encrypted to generate the device hardware characteristics.

4. The method according to claim 2, characterized in that, The process of generating the user behavior characteristics based on the mouse movement trajectory data and the key operation data includes: Extract the mouse movement angle sequence from the mouse movement trajectory data, and extract the key interval time sequence from the key operation data; The mouse movement angle sequence and the key press interval time sequence are normalized respectively, and the normalization results are encrypted to generate the user behavior features.

5. The method according to claim 1, characterized in that, The step of performing protocol layer tagging processing on the network traffic of the target user based on the network processing device to generate network traffic carrying the user's network identifier includes: The network processing device configures a corresponding initial sequence number increment pattern for each user at the transport layer. Based on the user identifier and target minutes of the target user, determine the network layer time-to-live value corresponding to the target user; Based on the initial sequence number growth pattern and the time-to-live value, the network traffic of the target user is subjected to protocol layer marking processing to generate network traffic carrying the user's network identifier.

6. The method according to claim 1, characterized in that, The operation of isolating the network traffic of the target user based on the abnormal game behavior score includes: If the abnormal game behavior score exceeds the target abnormal score threshold and the duration does not reach the preset duration, the network traffic of the target user is isolated at the first level. The first level isolation operation includes at least one of reducing the network bandwidth of the terminal device and pushing alarm information to the management platform. If the abnormal game behavior score exceeds the target abnormal score threshold and the duration reaches the preset duration, a second-level isolation operation is performed on the target user's network traffic. The second-level isolation operation includes at least one of the following: diverting the network traffic to the target server, blocking the target user's outbound game traffic, and marking the hardware characteristics of the terminal device.

7. A flow isolation device, characterized in that, include: The acquisition unit is used to acquire the device hardware characteristics and user behavior characteristics associated with the target user in response to the target user logging into the terminal device. The generation unit is used to perform protocol layer marking processing on the network traffic of the target user based on the network processing device, and generate network traffic carrying the user's network identifier. The first determining unit is configured to determine the comprehensive risk score of the target user based on the device hardware characteristics, the user behavior characteristics, and the network traffic carrying the user network identifier; The second determining unit is used to determine the abnormal game behavior score of the target user based on the game data of the target user when the comprehensive risk score is greater than the target risk score threshold. An isolation unit is used to isolate the network traffic of the target user based on the game behavior anomaly score.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor to enable the at least one processor to perform the method of any one of claims 1 to 6.

9. A non-transitory computer-readable storage medium storing computer instructions, characterized in that, The computer instructions are used to cause the computer to perform the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that, It includes a computer program that, when executed by a processor, implements the method of any one of claims 1 to 6.

Images