CN111079140B

CN111079140B - Method, device and system for preventing cheating

Info

Publication number: CN111079140B
Application number: CN201811217390.2A
Authority: CN
Inventors: 翟晨阳; 戴兴邦; 任宇福; 李星; 李山秀; 唐培洪
Original assignee: China Life Insurance Co ltd
Current assignee: China Life Insurance Co ltd
Priority date: 2018-10-18
Filing date: 2018-10-18
Publication date: 2023-06-27
Anticipated expiration: 2038-10-18
Also published as: CN111079140A

Abstract

Embodiments of the present disclosure relate to a method, apparatus, and system for anti-cheating. The method includes running a check-in application on the mobile device for a swipe check-in, and detecting whether the check-in application is running on the virtualized system. The method also includes determining that there is a cheating behavior on the mobile device in response to detecting that the check-in application is running on the virtualized system. The embodiment of the disclosure can judge whether the check-in application has cheating behaviors by detecting whether the check-in application runs in the virtualized environment, thereby preventing the user from cheating check-in.

Description

Method, device and system for preventing cheating

Technical Field

Embodiments of the present disclosure relate generally to the field of computers, and more particularly, to methods, devices, and systems for anti-cheating.

Background

With the rapid development of the mobile internet, various intelligent applications are emerging on mobile terminals. Instead of traditional swipe check-in or fingerprint check-in, people begin to use mobile terminals to check in. For example, after a person clicks a face button of a check-in application, the server may verify whether the mobile terminal is in a legal place, and after passing the place verification, it may verify whether it is operated by the user himself through face recognition. In this way, use of a smart check-in service on a mobile terminal may be enabled.

Since check-in of users affects attendance, and even performance assessment and economic income of users, some users may use various methods to cheat to achieve successful check-in without reaching a prescribed location. For example, users use certain cheating tools to simulate an Application Program Interface (API) of an operating system to cheat, and the cheating tools can bypass a check-in link of the system to a check-in place as long as legal place information is successfully recorded, so that the users can check in by brushing the face at home even anywhere.

Disclosure of Invention

Embodiments of the present disclosure provide a method, apparatus and computer program product for anti-cheating.

In a first aspect of the present disclosure, a method for preventing cheating is provided. The method comprises the following steps: running a check-in application for a swipe check-in on a mobile device; detecting whether a check-in application runs on a virtualized system; and in response to detecting that the check-in application is running on the virtualized system, determining that there is a cheating behavior on the mobile device.

In a second aspect of the present disclosure, a method for preventing cheating is provided. The method comprises the following steps: obtaining an IP address of the mobile device, wherein a check-in application for brushing face check-in is running on the mobile device; detecting whether the IP address is abnormal or not; and in response to detecting that the IP address is present as an anomaly, determining that a cheating behavior is present on the mobile device.

In a third aspect of the present disclosure, a mobile device is provided. The mobile device includes a processing unit and a memory, wherein the memory is coupled to the processing unit and stores instructions. The instructions, when executed by the processing unit, perform the actions of: running a check-in application for a swipe check-in on a mobile device; detecting whether a check-in application runs on a virtualized system; and in response to detecting that the check-in application is running on the virtualized system, determining that there is a cheating behavior on the mobile device.

In a fourth aspect of the present disclosure, a server is provided. The mobile device includes a processing unit and a memory, wherein the memory is coupled to the processing unit and stores instructions. The instructions, when executed by the processing unit, perform the actions of: obtaining an IP address of the mobile device, wherein a check-in application for brushing face check-in is running on the mobile device; detecting whether the IP address is abnormal or not; and in response to detecting that the IP address is present as an anomaly, determining that a cheating behavior is present on the mobile device.

In a fifth aspect of the present disclosure, a system for preventing cheating is provided. The system includes a mobile device according to an embodiment of the present disclosure and a server according to an embodiment of the present disclosure.

The summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the disclosure, nor is it intended to be used to limit the scope of the various embodiments of the disclosure.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be apparent from the following more particular descriptions of exemplary embodiments of the disclosure as illustrated in the accompanying drawings wherein like reference numbers generally represent like elements throughout the exemplary embodiments of the disclosure.

FIG. 1 illustrates a schematic diagram of a conventional technique for cheating using a virtualization system;

FIG. 2 illustrates a schematic diagram of an example environment for anti-cheating according to an embodiment of the present disclosure;

FIG. 3 illustrates a flow chart of a method for anti-cheating according to an embodiment of the present disclosure;

FIG. 4 illustrates a flow chart of a method for adding a cheating user to a blacklist according to an embodiment of the present disclosure;

FIG. 5 shows a diagram of a Graphical User Interface (GUI) for prompting a user for cheating behavior in accordance with an embodiment of the present disclosure;

FIG. 6 illustrates a flow chart of another method for anti-cheating according to an embodiment of the present disclosure;

FIG. 7 illustrates a flowchart of an example process for anti-cheating according to an embodiment of the present disclosure; and

fig. 8 shows a schematic block diagram of an apparatus that may be used to implement embodiments of the present disclosure.

DETAILED DESCRIPTION OF EMBODIMENT (S) OF INVENTION

Preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While the present disclosure has been illustrated in the drawings and described in connection with certain specific embodiments thereof, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

The term "comprising" and variations thereof as used herein means open ended, i.e., "including but not limited to. The term "or" means "and/or" unless specifically stated otherwise. The term "based on" means "based at least in part on". The terms "one example embodiment" and "one embodiment" mean "at least one example embodiment. The term "another embodiment" means "at least one additional embodiment". The terms "first," "second," and the like, may refer to different or the same object unless explicitly indicated to be different.

To crack the verification of the user's location, some cheating tools use a virtualized space to simulate where the mobile device is located. Fig. 1 shows a schematic diagram 100 of a conventional technique for cheating using a virtualized system. After the cheating software is installed on the mobile device, a virtualized space is created in the mobile device in addition to the operating system 110 itself, in which the virtualization system 120 exists. There is an application virtualization engine in the virtualization system 120 that allows a user to install, launch, or uninstall applications in the virtualization system 120, isolated from the operating system 110. In addition, this technique is also capable of acquiring any system services of the operating system 110 and establishing proxy services corresponding to the system services in the virtualized system 120. When a check-in application running in the virtualized system 120 invokes a system service, what is actually invoked is a proxy service provided in the virtualized system 120. Check-in application 125 running in virtualization system 110 invokes system services of operating system 110, as indicated by arrow 131 in FIG. 1; the operating system 110 provides system services and sends to the proxy service module 123 as indicated by arrow 132. Next, as indicated by arrow 133, proxy service module 123 sends the replaced proxy service to check-in application 125, thereby enabling false system services to be provided to check-in application 125. Therefore, the existing cheating scheme can bypass the verification of the wireless router information by the operating system, false cheating check-in is realized, the wireless router information of the job site can be recorded and stored in the virtualized space, and then the stored wireless router information is used for forging in the subsequent check-in process, so that a user can successfully brush the face at any place.

To this end, embodiments of the present disclosure propose a new approach for anti-cheating. According to the embodiment of the disclosure, whether the check-in application has a cheating action can be judged by detecting whether the check-in application runs in the virtualized environment, so that the user is prevented from cheating. Further, embodiments of the present disclosure may also alternatively or additionally detect cheating behavior by detecting whether the IP address of the mobile device is abnormal at the server side.

The basic principles of the present disclosure and several example implementations are described below with reference to fig. 2-8. It should be understood that these exemplary embodiments are presented merely to enable one skilled in the art to better understand and practice the embodiments of the present disclosure and are not intended to limit the scope of the present disclosure in any way.

Fig. 2 illustrates a schematic diagram of an example environment 200 for anti-cheating according to an embodiment of the present disclosure. As shown in fig. 2, environment 200 includes a mobile device 210 (i.e., client) and a server 220 that are interconnected by a network 230, which network 230 may be a wired network and/or a wireless network. The mobile device 210 may be any mobile electronic device, such as a smart phone, tablet computer, etc., that typically has wireless network connectivity and camera functionality. Server 220 generally refers to a remotely located high performance processing device. It should be understood that the mobile device and server of fig. 1 may also include other components or modules not shown.

Referring to fig. 2, a check-in application 215 is running on a mobile device 210, through which a mobile network-based attendance service may be implemented by the check-in application 215. According to the embodiment of the disclosure, whether the check-in application has a cheating action can be judged by detecting whether the check-in application runs in the virtualized environment, so that the user is prevented from cheating. Further, additionally or alternatively, it may be detected at the server 220 whether the IP address of the mobile device 210 is abnormal to detect whether there is a cheating behaviour. Example implementations of how to detect cheating behavior are further described below with reference to fig. 3-8.

Fig. 3 illustrates a flow chart of a method 300 for anti-cheating according to an embodiment of the present disclosure. It should be appreciated that the method 300 may be performed by the mobile device 210 described above with reference to fig. 2. At block 302, a check-in application for a swipe-in is run on a mobile device. For example, check-in application 215 is first run on mobile device 210 for subsequent detection of cheating behavior.

At block 304, it is detected whether a check-in application is running on the virtualized system. In some embodiments, it may be detected whether a particular class in the operating system of the mobile device is provided by passing through virtualization techniques. For example, the operating system may be an android operating system and the particular class may be an Instrumentation class in the android operating system. However, the mobile device may also be other operating systems and detect specific classes in other operating systems that are related to virtualization calls.

At block 306, in response to detecting that the check-in application is running on the virtualized system, it is determined that there is a cheating behavior on the mobile device. For example, instrumentation classes differ in android operating systems and virtualization systems, and virtualization technologies cannot bypass detection to cheat. In an android operating system, the existence form of the Instrumentation class is android.app.instrumentation; in contrast, in a virtualized system, the Instrumentation class exists in the form of com. Thus, by detecting the name or presence of an Instrumentation class, it can be determined whether the check-in application is running in a virtualized system, thereby detecting whether a cheating check-in behavior exists on the mobile device.

Fig. 4 illustrates a flow chart of a method 400 for adding a cheating user to a blacklist according to an embodiment of the present disclosure. It should be appreciated that the method 400 may be performed by the mobile device 210 described above with reference to fig. 2, and may be performed after the method 300 described in fig. 3.

At block 402, a face check-in function in a check-in application is disabled on a mobile device. In some embodiments, the user of the mobile device may be prevented from using virtualization to forge the wireless router information for a face check-in. In some embodiments, the user of the mobile device may be prompted for an operational anomaly and be prompted to exit the check-in application and restart the check-in application. For example, FIG. 5 shows a diagram of a GUI 500 for prompting a user for cheating behavior according to an embodiment of the present disclosure. The user clicks a brush button 211 on the interface of the mobile device 210 and then brushes a face to check in. When it is detected that the check-in application is running in the virtualized system, a warning 212 may be prompted to the user, who may choose to restart the check-in application for retry. For users using cheating software, it is not possible to achieve a successful check-in a check-in application of a mobile device.

At block 404, the mobile device sends user account information to the server that has been logged in to the check-in application. At block 406, the server adds the user account information to the blacklist. For example, if a cheating action is detected, the mobile device will send the cheating user account information to the server, which then adds the cheating user to the blacklist.

Fig. 6 illustrates a flow chart of another method 600 for anti-cheating according to an embodiment of the present disclosure. It should be appreciated that the method 600 may be performed by the server 220 described above with reference to fig. 2. At block 602, an IP address of a mobile device is obtained, wherein a check-in application for check-in is running on the mobile device. For example, check-in application 215 is running on mobile device 210 depicted in FIG. 2.

At block 604, it is detected whether there is an exception to the IP address. In some embodiments, an IP address whitelist may be pre-set, which may be collected manually or automatically, and includes network addresses of routers of legitimate sites, such as a user's worksite and conference site, and then it may be detected whether the IP address of the mobile device is on the IP address whitelist.

In some embodiments, a Basic Service Set Identifier (BSSID) of a wireless router to which the mobile device is connected may also be obtained, and then whether an IP address is anomalous is detected based on the BSSID. In some embodiments, the most probable IP address corresponding to the BSSID may be counted; and determining whether the IP address is abnormal based on a comparison of the IP address and the most probable IP address. For example, for the same BSSID (whose IP address should be fixed and/or unique), there are two addresses for three mobile devices, namely a first device and a second device being the first address and a third device being the second address, then the address to which this BSSID corresponds should be considered the first address and the third device has a cheating behaviour. In addition, the IP address distribution of each BSSID over several days may be counted to determine the best trusted IP address for each BSSID.

At block 606, in response to detecting that the IP address is present as anomalous, it is determined that there is a cheating behaviour on the mobile device. That is, although the user side may bypass detection of BSSID through virtualization technology or the like, bypass detection of WiFi, it cannot masquerade as a real IP address to communicate with the server. For example, a mobile device that is normally connected to a corresponding BSSID should have an address that, if it appears that the mobile device connected to the BSSID is not, indicates that the device is suspected of being cheating. In general, a normal check-in corresponds to an IP address of a router in a job site, and a cheating check-in corresponds to an IP address in a home or mobile network. Thus, by detecting anomalies in the IP address of the mobile device, the user's cheating behavior may alternatively and/or additionally be detected. In some embodiments, by combining the virtualized detection at the mobile device side and the IP address anomaly detection at the server side, a dual detection anti-cheating scheme can be formed.

In some embodiments, embodiments of the present disclosure may be used for mobile internet-based smart check-in. In some embodiments, the anti-cheating scheme of the present disclosure may be used for the marketer's check-in of an insurance company so that it can be determined whether the marketer is participating by himself at the correct place and time.

Fig. 7 shows a flowchart of an example process 700 for anti-cheating according to an embodiment of the present disclosure. At block 702, a user logs in to an application using his account and password, or logs in automatically. At block 704, it is detected whether the check-in application is running in the virtualized system, e.g., the embodiments described above may be used to determine whether the check-in application is running in the virtualized system. If it is detected at block 704 that the check-in application is running in the virtualized system, then a cheating behavior is declared, and at block 720 a check-in failure is indicated.

If it is detected at block 704 that the check-in application is not running in the virtualized system, then the user clicks the point me brush face button at block 706. At block 708, the check-in application reads the WiFi information and IP address to which the mobile device is connected. At block 710, the server detects whether the IP address of the mobile device is anomalous, e.g., the embodiments described above may be used to determine whether the IP address is anomalous. If an anomaly is detected at 710 for the IP address, then a cheating action is declared, and a check-in failure is indicated at block 720.

If no anomaly is detected in the IP address at 710, it is further detected at block 712 whether the WiFi information is compliant, e.g., it may be determined whether the BSSID address of the connected wireless router is in a predetermined list. If the WiFi information is detected to be non-compliant at 712, then a cheating action is declared, and a check-in failure is indicated at block 720.

If WiFi information compliance is detected at 712, the camera is invoked to begin a user swipe at block 714. That is, the user swipe link can only be entered when both the IP address and BSSID are compliant. Next, at block 716, it is detected whether the brush face passes. For example, it is possible to detect whether or not it is a living body image, and detect whether or not the picked-up image is the user himself. If the face detection passes, a check-in is indicated at block 718, otherwise a check-in failure is indicated at block 720. It should be appreciated that the acts in process 700 may be performed in a different order than that shown in fig. 7.

Fig. 8 shows a schematic block diagram of a device 800 that may be used to implement embodiments of the present disclosure, the device 800 may be the mobile device 210 or the server 220 described above with reference to fig. 2. As shown, the device 800 includes a Central Processing Unit (CPU) 801 that can perform various suitable actions and processes in accordance with computer program instructions stored in a Read Only Memory (ROM) 802 or loaded from a storage unit 808 into a Random Access Memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The CPU 801, ROM 802, and RAM 803 are connected to each other by a bus 804. An input/output (I/O) interface 805 is also connected to the bus 804.

Various components in device 800 are connected to I/O interface 805, including: an input unit 806 such as a keyboard, mouse, etc.; an output unit 807 such as various types of displays, speakers, and the like; a storage unit 808, such as a magnetic disk, optical disk, etc.; and a communication unit 809, such as a network card, modem, wireless communication transceiver, or the like. The communication unit 809 allows the device 800 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

The various methods or processes described above may be performed by the processing unit 801. For example, in some embodiments, the method may be implemented as a computer software program tangibly embodied on a machine-readable medium, such as the storage unit 808. In some embodiments, part or all of the computer program may be loaded and/or installed onto device 800 via ROM 802 and/or communication unit 809. When the computer program is loaded into RAM 803 and executed by CPU 801, one or more steps or actions in the methods or processes described above may be performed.

In some embodiments, the methods and processes described above may be implemented as a computer program product. The computer program product may include a computer readable storage medium having computer readable program instructions embodied thereon for performing aspects of the present disclosure.

The computer readable storage medium may be a tangible device that can hold and store instructions for use by an instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer-readable storage medium would include the following: portable computer disks, hard disks, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static Random Access Memory (SRAM), portable compact disk read-only memory (CD-ROM), digital Versatile Disks (DVD), memory sticks, floppy disks, mechanical coding devices, punch cards or in-groove structures such as punch cards or grooves having instructions stored thereon, and any suitable combination of the foregoing. Computer-readable storage media, as used herein, are not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through waveguides or other transmission media (e.g., optical pulses through fiber optic cables), or electrical signals transmitted through wires.

The computer readable program instructions described herein may be downloaded from a computer readable storage medium to a respective computing/processing device or to an external computer or external storage device over a network, such as the internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmissions, wireless transmissions, routers, firewalls, switches, gateway computers and/or edge servers. The network interface card or network interface in each computing/processing device receives computer readable program instructions from the network and forwards the computer readable program instructions for storage in a computer readable storage medium in the respective computing/processing device.

The computer program instructions for performing the operations of the present disclosure can be assembly instructions, instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source or object code written in any combination of one or more programming languages, including an object-oriented programming language and conventional procedural programming languages. The computer readable program instructions may be executed entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, aspects of the present disclosure are implemented by personalizing electronic circuitry, such as programmable logic circuitry, field Programmable Gate Arrays (FPGAs), or Programmable Logic Arrays (PLAs), with state information of computer readable program instructions, which can execute the computer readable program instructions.

These computer readable program instructions may be provided to a processing unit of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer-readable medium having the instructions stored therein includes an article of manufacture including instructions which implement the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowcharts and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of devices, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two consecutive blocks may in fact be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the function involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

The foregoing description of the embodiments of the present disclosure has been presented for purposes of illustration and description, and is not intended to be exhaustive or limited to the embodiments disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the various embodiments described. The terminology used herein was chosen in order to best explain the principles of the embodiments, the practical application, or the technical improvement of the technology in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for preventing cheating, comprising:

running a check-in application for a swipe check-in on a mobile device;

detecting whether the check-in application is running on a virtualized system; and

in response to detecting that the check-in application is running on the virtualized system, determining that a cheating behavior is present on the mobile device,

wherein detecting whether the check-in application is running on the virtualized system comprises:

detecting whether a particular class in the operating system of the mobile device is provided by the virtualization system,

wherein the operating system is an android operating system and the particular class is an Instrumentation class in the android operating system.

2. The method of claim 1, further comprising:

disabling a face-brushing check-in function in the check-in application; and

user account information associated with the check-in application is sent to a server for addition to a blacklist.

3. The method of claim 2, wherein disabling a face check-in function in the check-in application comprises:

users of the mobile devices are prevented from using a virtualized environment to falsify wireless router information for face-up.

4. The method of claim 3, wherein disabling a face check-in function in the check-in application comprises:

prompting a user of the mobile device for an abnormal operation; and

prompting the user to exit the check-in application and restarting the check-in application.

5. A method for preventing cheating, comprising:

obtaining an internet protocol, IP, address of a mobile device on which a check-in application for swipe-in is running;

detecting whether the IP address is abnormal; and

in response to detecting that the IP address is present as an anomaly, determining that a cheating behavior is present on the mobile device,

wherein detecting whether the IP address has an exception comprises:

obtaining a Basic Service Set Identifier (BSSID) of a wireless router connected with the mobile device; and

detecting whether the IP address has an exception based on the BSSID,

wherein detecting whether the IP address has an exception based on the BSSID comprises:

counting the maximum probability IP address corresponding to the BSSID;

based on a comparison between the IP address and the most probable IP address, it is determined whether an anomaly exists in the IP address.

6. The method of claim 5, wherein detecting whether the IP address has an exception comprises:

detecting whether the IP address is on an IP address white list, wherein the IP address white list is collected in advance.

7. A mobile device, comprising:

a processing unit; and

a memory coupled to the processing unit and storing instructions that, when executed by the processing unit, perform the actions of:

running a check-in application for a swipe check-in on the mobile device;

8. The apparatus of claim 7, further comprising:

disabling a face-brushing check-in function in the check-in application; and

9. The apparatus of claim 8, wherein disabling a face-swipe check-in function in the check-in application comprises:

10. The apparatus of claim 9, wherein disabling a face-swipe check-in function in the check-in application comprises:

prompting a user of the mobile device for an abnormal operation; and

11. A server, comprising:

a processing unit; and

detecting whether the IP address is abnormal; and

wherein detecting whether the IP address has an exception comprises:

detecting whether the IP address has an exception based on the BSSID,

counting the maximum probability IP address corresponding to the BSSID;

12. The server of claim 11, wherein detecting whether the IP address has an exception comprises:

13. A system for anti-cheating comprising a mobile device according to any of claims 7-10 and a server according to any of claims 11-12.