Game plug-in behavior monitoring method based on DNS flow characteristics

A technology of traffic characteristics and behaviors, applied in digital transmission systems, electrical components, transmission systems, etc., to achieve the effects of improving monitoring capabilities, increasing the difficulty of anti-detection and anti-monitoring, and improving accuracy

Active Publication Date: 2019-12-03
福建天晴在线互动科技有限公司
View PDF11 Cites 0 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

[0003] The above-mentioned existing game plug-in behavior monitoring scheme may be bypas

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Game plug-in behavior monitoring method based on DNS flow characteristics
  • Game plug-in behavior monitoring method based on DNS flow characteristics

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0040] The present invention will be further described below in conjunction with the accompanying drawings.

[0041] see figure 1 and figure 2 As shown, a game plug-in behavior monitoring method based on DNS traffic characteristics of the present invention, the present invention is based on Microsoft's WFP network filter driver framework, by installing a network filter at the bottom of the system to capture the plug-in network request behavior. The method includes the following steps: step S1, the client of the Windows system application layer creates a network filter driver at the driver layer;

[0042] Step S2, establish a domain name blacklist; said step S2 is further specifically: in the process of creating the network filter driver, write the domain name resolved by the plug-in request into the file of the network filter driver, load and start the network filter by the Windows system application program Driver; after the network filter driver is enabled successfully, the...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention provides a game plug-in behavior monitoring method based on DNS flow characteristics. The method comprises the following steps that S1, enabling a client of a Windows system applicationlayer to create a network filtering drive on a drive layer; S2, establishing a domain name blacklist; S3, capturing all UDP data packets in a data packet layer by the network filtering driver, comparing a domain name parameter requested to be analyzed by the UDP data packet with the domain name blacklist for judgment, if the domain name parameter is any domain name character string contained in the domain name blacklist, judging that the game player has a plug-in use behavior, and enabling the domain name blacklist to store the domain name character string requested to be analyzed by the plug-in. According to the invention, the plug-in use behavior of the known DNS flow characteristics can be efficiently monitored.

Description

technical field [0001] The invention relates to the field of computer system communication technology, software security, and game cheating detection, in particular to a method for monitoring game cheating behavior based on DNS traffic characteristics. Background technique [0002] Existing cheating behavior monitoring modules usually use a detection method based on process memory scanning, such as scanning the memory space of a process to determine whether a cheating feature code is included, etc. There is currently no public kernel-level monitoring method for game cheating behavior based on DNS traffic characteristics . [0003] The above-mentioned existing game plug-in behavior monitoring scheme may be bypassed by methods such as process hiding technology and memory polymorphism of the plug-in. The solution described in this patent can monitor the use of such plug-ins. In addition, this patent is accurate and efficient in the monitoring of plug-in usage scenarios with D...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
IPC IPC(8): H04L12/26H04L29/06H04L29/12
CPCH04L43/0876H04L69/22H04L61/4511
Inventor 刘德建任佳伟陈宏展
Owner 福建天晴在线互动科技有限公司
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap