Initial commit

plugins/security-anticheat/skills/cheat-detection-patterns.md

@@ -0,0 +1,68 @@
+---
+name: 作弊检测模式
+description: 作弊类型识别和防护方法
+version: 1.0.0
+---
+
+# Cheat Detection Patterns
+
+## Common Cheat Types
+
+### 1. Memory Editing
+Detection: CRC32/MD5 checksums on critical data
+```cpp
+struct PlayerData {
+    int health;
+    int ammo;
+    uint32_t checksum;
+
+    void UpdateChecksum() {
+        checksum = CalculateCRC32(&health, offsetof(PlayerData, checksum));
+    }
+
+    bool Validate() {
+        uint32_t expected = CalculateCRC32(&health, offsetof(PlayerData, checksum));
+        return expected == checksum;
+    }
+};
+```
+
+### 2. Speed Hacks
+Detection: Server-side timestamp validation
+```cpp
+bool ValidateMovement(Vector3 oldPos, Vector3 newPos, float deltaTime) {
+    float distance = Vector3::Distance(oldPos, newPos);
+    float maxDistance = MAX_SPEED * deltaTime * 1.1f; // 10% tolerance
+    return distance <= maxDistance;
+}
+```
+
+### 3. Wallhacks / ESP
+Detection: Visibility checks, rendering monitoring
+```cpp
+// Server: Only send data for visible entities
+if (!IsVisibleFrom(player.position, entity.position)) {
+    continue; // Don't send this entity to client
+}
+```
+
+### 4. Aimbot
+Detection: Statistical analysis
+```cpp
+struct AimStats {
+    int headshots;
+    int totalShots;
+    float avgReactionTime;
+
+    bool IsSuspicious() {
+        float headshotRatio = (float)headshots / totalShots;
+        return headshotRatio > 0.7f || avgReactionTime < 50.0f; // ms
+    }
+};
+```
+
+## Defense Layers
+1. Client-side: Basic checks (easily bypassed)
+2. Driver-level: Memory protection, process monitoring
+3. Server-side: Authoritative game state
+4. Behavioral: ML-based anomaly detection