It's common now for Developers to build inhouse cheat detections and safeguards. resources are usually a factor.
Searching memory for matching signatures existing in there database or a database, key will to be keeping this updated and current also automated analysis of memory is limited to its effectiveness to a degree along with other factors as you know
I am very interested in this comment "The anti cheat software I am developing also allows for remote view of the players in game screen which when a player is flagged as a cheater, a member of staff would be able to view that players game and either issue a ban, remove the flag or leave the flag in place for further monitoring" Purely because of how invasive (data privacy laws ) and resource hungry this would be .
Also this "I am actually working on a thesis for class on anti cheat technology. Where by it measures mouse movement inside menus where it knows you are not using an aimbot and compares it to mouse movements inside a match. It evaluates your play style over time and makes a decision on whether you are cheating or not."
Again extremely resource heavy , there is no way to be able to optimize scans to allow this to work , the scans already required are already so complex to cater for every system used , from entry level and mid range systems , these systems have performance limitations. ideal goals are around 200-300ms scans , but by the sounds of it all of the above i've said is running all the time the client is running , or if server side along with client side FPS and lag would be unbearable
Common cheat apps now , start befor the client , thus enabling you to control the client behaviour and values , this is why most companies scan as client starts and check mem for the sigs i said earlier. AS YOU KNOW right . So even do it when game session starts again loading times can be affected if to heavy on resources ,
This topic we could go on for hours and hours , hell weeks months :-p but you sound like you really like what you do , and you should keep that up :-)
Anyway if you could explain a bit more on my qouts that would be fantastic because what i am reading is effectively pattern scans to equate a pattern , and this can be worked around extremely easily as you know