CN111079140A

CN111079140A - Method, device and system for preventing cheating

Info

Publication number: CN111079140A
Application number: CN201811217390.2A
Authority: CN
Inventors: 翟晨阳; 戴兴邦; 任宇福; 李星; 李山秀; 唐培洪
Original assignee: China Life Insurance Co Ltd China
Current assignee: China Life Insurance Co Ltd China
Priority date: 2018-10-18
Filing date: 2018-10-18
Publication date: 2020-04-28
Anticipated expiration: 2038-10-18
Also published as: CN111079140B

Abstract

Embodiments of the present disclosure relate to a method, apparatus, and system for anti-cheating. The method includes running a check-in application for swishing a face check-in on the mobile device, and detecting whether the check-in application is running on the virtualized system. The method also includes determining that a cheating action exists on the mobile device in response to detecting that the check-in application is running on the virtualized system. The embodiment of the disclosure can judge whether cheating behaviors exist in the check-in application by detecting whether the check-in application runs in the virtualization environment, thereby preventing cheating check-in of users.

Description

Method, device and system for preventing cheating

Technical Field

Embodiments of the present disclosure relate generally to the field of computers, and more particularly, to methods, devices, and systems for anti-cheating.

Background

With the rapid development of the mobile internet, various intelligent applications are emerging on the mobile terminal. Instead of the conventional card-swiping check-in or fingerprint check-in, people began to use mobile terminals to check-in. For example, after a person clicks a face brushing button of a check-in application, the server can verify whether the mobile terminal is in a legal place, and after the place verification is passed, whether the mobile terminal is operated by the user himself or herself can be verified through face recognition. In this manner, use of the smart check-in service on the mobile terminal may be enabled.

Since check-in by a user affects attendance and even performance and economic revenue for the user, some users may employ various methods to cheat to achieve a successful check-in without reaching a specified location. For example, users can cheat by simulating an Application Program Interface (API) of an operating system by using some cheating tool, and the cheating tool can bypass the verification link of the system for the check-in place only after the legal place information is successfully recorded, so that the users can swipe faces and check in at home or even anywhere.

Disclosure of Invention

Embodiments of the present disclosure provide a method, apparatus, and computer program product for anti-cheating.

In a first aspect of the disclosure, a method for anti-cheating is provided. The method comprises the following steps: running a check-in application on the mobile device for swiping a face and checking in; detecting whether a check-in application is running on a virtualized system; and in response to detecting that the check-in application is running on the virtualized system, determining that a cheating action is present on the mobile device.

In a second aspect of the disclosure, a method for anti-cheating is provided. The method comprises the following steps: obtaining an IP address of a mobile device, wherein a check-in application for face-brushing check-in is running on the mobile device; detecting whether the IP address is abnormal or not; and determining that a cheating action exists on the mobile device in response to detecting that the IP address is anomalous.

In a third aspect of the disclosure, a mobile device is provided. The mobile device includes a processing unit and a memory coupled to the processing unit and storing instructions. The instructions, when executed by a processing unit, perform the following acts: running a check-in application on the mobile device for swiping a face and checking in; detecting whether a check-in application is running on a virtualized system; and in response to detecting that the check-in application is running on the virtualized system, determining that a cheating action is present on the mobile device.

In a fourth aspect of the disclosure, a server is provided. The mobile device includes a processing unit and a memory coupled to the processing unit and storing instructions. The instructions, when executed by a processing unit, perform the following acts: obtaining an IP address of a mobile device, wherein a check-in application for face-brushing check-in is running on the mobile device; detecting whether the IP address is abnormal or not; and determining that a cheating action exists on the mobile device in response to detecting that the IP address is anomalous.

In a fifth aspect of the present disclosure, a system for anti-cheating is provided. The system includes a mobile device according to an embodiment of the present disclosure and a server according to an embodiment of the present disclosure.

This summary is provided to introduce a selection of concepts in a simplified form that are further described below in the detailed description. This summary is not intended to identify key features or essential features of the disclosure, nor is it intended to limit the scope of various embodiments of the disclosure.

Drawings

The foregoing and other objects, features and advantages of the disclosure will be apparent from the following more particular descriptions of exemplary embodiments of the disclosure as illustrated in the accompanying drawings wherein like reference numbers generally represent like elements throughout the exemplary embodiments of the disclosure.

FIG. 1 illustrates a schematic diagram of a conventional technique for cheating using a virtualization system;

FIG. 2 shows a schematic diagram of an example environment for anti-cheating, according to an embodiment of the present disclosure;

FIG. 3 shows a flow diagram of a method for anti-cheating according to an embodiment of the present disclosure;

FIG. 4 illustrates a flow diagram of a method for adding a cheating user to a blacklist in accordance with an embodiment of the present disclosure;

FIG. 5 shows a diagram of a Graphical User Interface (GUI) for prompting a user for cheating behavior, according to an embodiment of the present disclosure;

FIG. 6 illustrates a flow diagram of another method for anti-cheating according to an embodiment of the present disclosure;

FIG. 7 shows a flowchart of an example process for anti-cheating, according to an embodiment of the present disclosure; and

FIG. 8 shows a schematic block diagram of a device that may be used to implement embodiments of the present disclosure.

DETAILED DESCRIPTION OF EMBODIMENT (S) OF INVENTION

Preferred embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. While certain specific embodiments of the present disclosure are shown in the drawings, it should be understood that the present disclosure may be embodied in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

The term "include" and variations thereof as used herein is meant to be inclusive in an open-ended manner, i.e., "including but not limited to". Unless specifically stated otherwise, the term "or" means "and/or". The term "based on" means "based at least in part on". The terms "one example embodiment" and "one embodiment" mean "at least one example embodiment". The term "another embodiment" means "at least one additional embodiment". The terms "first," "second," and the like may refer to different or the same items unless explicitly indicated to be different.

To break the check on the user's location, some cheating tools use a virtualized space to simulate where the mobile device is located. FIG. 1 illustrates a schematic diagram 100 of a conventional technique for cheating using a virtualization system. After the installation of the cheating software on the mobile device, a virtualized space is created in the mobile device in addition to the operating system 110 itself, and a virtualization system 120 is present in the virtualized space. An application virtualization engine exists in the virtualization system 120 that allows a user to install, start, or uninstall applications in the virtualization system 120, while isolated from the operating system 110. In addition, this technique is also capable of acquiring any system services of the operating system 110 and establishing proxy services corresponding to the system services in the virtualized system 120. When a check-in application running in virtualization system 110 invokes a system service, it is the proxy service provided in virtualization system 120 that is actually invoked. As indicated by arrow 131 in FIG. 1, check-in application 125 running in virtualization system 110 calls a system service of operating system 110; the operating system 110 provides system services and sends them to the proxy service module 123 as indicated by arrow 132. Next, as indicated by arrow 133, the proxy service module 123 sends the replaced proxy service to the check-in application 125, thereby enabling the provision of fake system services to the check-in application 125. Therefore, the existing cheating scheme can bypass the check of the operating system on the wireless router information, false cheating sign-in is realized, the wireless router information of a workplace can be recorded and stored in a virtualized space, and then the stored wireless router information is used for counterfeiting in the subsequent sign-in process, so that a user can successfully swipe the face at any place.

To this end, embodiments of the present disclosure propose a new scheme for anti-cheating. According to the embodiment of the disclosure, whether cheating behaviors exist in the check-in application can be judged by detecting whether the check-in application runs in the virtualization environment, so that the cheating check-in of a user is prevented. Further, embodiments of the present disclosure may alternatively or additionally detect cheating by detecting at the server-side whether the IP address of the mobile device is abnormal.

The basic principles and several example implementations of the present disclosure are explained below with reference to fig. 2-8. It should be understood that these exemplary embodiments are given solely for the purpose of enabling those skilled in the art to better understand and thereby implement the embodiments of the present disclosure, and are not intended to limit the scope of the present disclosure in any way.

Fig. 2 illustrates a schematic diagram of an example environment 200 for anti-cheating, according to an embodiment of the present disclosure. As shown in FIG. 2, environment 200 includes a mobile device 210 (i.e., a client) and a server 220, which are interconnected via a network 230, where network 230 may be a wired network and/or a wireless network. The mobile device 210 may be any mobile electronic device, such as a smartphone, tablet computer, etc., which typically has wireless networking and camera functionality. Server 220 generally refers to a remotely located high-performance processing device. It should be understood that the mobile devices and servers of fig. 1 may also include other components or modules not shown.

Referring to fig. 2, a check-in application 215 is running on a mobile device 210, through which check-in application 215 a mobile network-based attendance service may be implemented. According to the embodiment of the disclosure, whether cheating behaviors exist in the check-in application can be judged by detecting whether the check-in application runs in the virtualization environment, so that the cheating check-in of a user is prevented. Additionally or alternatively, the presence of cheating may be detected at the server 220 by detecting whether the IP address of the mobile device 210 is abnormal. Example implementations of how to detect cheating behavior are further described below with reference to fig. 3-8.

Fig. 3 illustrates a flow diagram of a method 300 for anti-cheating, according to an embodiment of the present disclosure. It should be understood that the method 300 may be performed by the mobile device 210 described above with reference to fig. 2. At block 302, a check-in application for swishing face check-in is run on the mobile device. For example, check-in application 215 is first run on mobile device 210 for subsequent cheating action detection.

At block 304, it is detected whether the check-in application is running on the virtualized system. In some embodiments, it may be detected whether a particular class in the operating system of the mobile device is provided by virtualization techniques. For example, the operating system may be an android operating system and the particular class may be an Instrumentation class in the android operating system. However, the mobile device may also be another operating system and detect a particular class in the other operating system that is associated with the virtualization call.

At block 306, in response to detecting that the check-in application is running on the virtualized system, it is determined that a cheating action is present on the mobile device. For example, Instrumentation differs between android operating systems and virtualization systems, and virtualization technologies cannot circumvent detection. In an android operating system, an Instrumentation class exists in the form of android. In contrast, in virtualized systems, the Instrumentation class exists in the form com. Therefore, by detecting the name or existence form of the Instrumentation class, whether the check-in application runs in the virtualization system can be judged, and whether cheating check-in behaviors exist on the mobile device can be detected.

FIG. 4 illustrates a flow diagram of a method 400 for adding a cheating user to a blacklist in accordance with an embodiment of the present disclosure. It should be understood that the method 400 may be performed by the mobile device 210 described above with reference to fig. 2, and may be performed after the method 300 described in fig. 3.

At block 402, a swipe check-in function in a check-in application is disabled on a mobile device. In some embodiments, a user of a mobile device may be prevented from using virtualization to forge wireless router information for a swipe check-in. In some embodiments, a user of the mobile device may be prompted for a run exception and for exiting the check-in application and restarting the check-in application. For example, fig. 5 shows a diagram of a GUI 500 for prompting a user for cheating, according to an embodiment of the disclosure. The user clicks a brush button 211 on the interface of the mobile device 210 and then swipes the face to check in. When it is detected that the check-in application is running in the virtualized system, the user may be prompted for an alert 212, and the user may choose to restart the check-in application for a retry. For users using cheating software, they cannot achieve a successful check-in the check-in application of the mobile device.

At block 404, the mobile device sends to the server the user account information that has been logged in the check-in application. At block 406, the server adds the user account information to the blacklist. For example, if a cheating action is detected, the mobile device will send the cheating user account information to the server, which then adds the cheating user to the blacklist.

Fig. 6 illustrates a flow diagram of another method 600 for anti-cheating, in accordance with an embodiment of the present disclosure. It should be appreciated that method 600 may be performed by server 220 as described above with reference to fig. 2. At block 602, an IP address of a mobile device is obtained, where a check-in application for a check-in is running on the mobile device. For example, a check-in application 215 is running on the mobile device 210 depicted in FIG. 2.

At block 604, it is detected whether an IP address is anomalous. In some embodiments, an IP address white list may be preset, which may be collected manually or automatically and includes network addresses of routers of legitimate locations such as the user's workplace and conference site, and then it may be detected whether the IP address of the mobile device is on the IP address white list.

In some embodiments, a Basic Service Set Identifier (BSSID) of a wireless router to which the mobile device is connected may also be obtained, and then whether an anomaly exists in the IP address may be detected based on the BSSID. In some embodiments, the most probable IP address corresponding to the BSSID may be counted; and determining whether the IP address is anomalous based on a comparison of the IP address to the most probable IP address. For example, if there are two addresses for three mobile devices with respect to the same BSSID (the IP address of the mobile device should be fixed and/or unique), that is, the first device and the second device are the first address, and the third device is the second address, it can be considered that the address corresponding to the BSSID should be the first address, and the third device has cheating behavior. Further, the IP address distribution for each BSSID over several days may be counted to determine the best trusted IP address for each BSSID.

At block 606, in response to detecting that the IP address is anomalous, it is determined that cheating is present on the mobile device. That is, although the user terminal may bypass detection of BSSID and detection of WiFi by virtualization technology or the like, it cannot masquerade as a real IP address to communicate with the server. For example, a mobile device connected to a corresponding BSSID should normally have a certain address, and if it appears that the mobile device connected to the BSSID is not this address, it indicates that this device has a suspicion of cheating. In general, a normal check-in corresponds to an IP address of a router in the workplace, while a cheat check-in corresponds to an IP address in the home or in the mobile network. Thus, by detecting anomalies in the IP address of the mobile device, cheating activities by the user may alternatively and/or additionally be detected. In some embodiments, by combining virtualization detection at the mobile device side and IP address anomaly detection at the server side, a double detection anti-cheating scheme may be formed.

In some embodiments, embodiments of the present disclosure may be used for mobile internet based intelligent check-in. In some embodiments, the anti-cheating scheme of the present disclosure may be used for the attended check-in of marketers of insurance companies, so that it can be determined whether the marketers are attended by themselves at the correct place and time.

Fig. 7 shows a flowchart of an example process 700 for anti-cheating, according to an embodiment of the present disclosure. At block 702, the user logs in to the check-in application using their account and password, or logs in automatically. At block 704, it is detected whether the check-in application is running in the virtualized system, for example, whether the check-in application is running in the virtualized system may be determined using the embodiments described above. If the check-in application is detected to be running in the virtualized system at block 704, indicating that cheating is present, a check-in failure is indicated at block 720.

If it is detected at block 704 that the check-in application is not running in the virtualized system, at block 706 the user clicks the click-me-to-brush button. At block 708, the check-in application reads the WiFi information and IP address to which the mobile device is connected. At block 710, the server detects whether the IP address of the mobile device is anomalous, such as may be determined using the embodiments described above. If an anomaly in the IP address is detected at 710, indicating that cheating is present, a check-in failure is indicated at block 720.

If it is detected at 710 that there is no anomaly in the IP address, it is further detected at 712 whether the WiFi information is compliant, e.g., it can be determined whether the BSSID address of the connected wireless router is in a predetermined list. If the WiFi information is detected as not compliant at 712, indicating that cheating is present, a check-in failure is indicated at block 720.

If WiFi information compliance is detected at 712, the camera is invoked to begin user face brushing at block 714. That is, the user face brushing link can only be entered when both the IP address and BSSID are compliant. Next, at block 716, it is detected whether the brush face passes. For example, it is possible to detect whether it is a living body image, and detect whether the captured image is the user himself. If the face swipe detection passes, then a successful check-in is indicated at block 718, otherwise a failed check-in is indicated at block 720. It should be understood that the actions in process 700 may be performed in a different order than illustrated in fig. 7.

Fig. 8 shows a schematic block diagram of a device 800 that may be used to implement embodiments of the present disclosure, the device 800 may be the mobile device 210 or the server 220 described above with reference to fig. 2. As shown, device 800 includes a Central Processing Unit (CPU)801 that may perform various appropriate actions and processes in accordance with computer program instructions stored in a Read Only Memory (ROM)802 or loaded from a storage unit 808 into a Random Access Memory (RAM) 803. In the RAM803, various programs and data required for the operation of the device 800 can also be stored. The CPU 801, ROM 802, and RAM803 are connected to each other via a bus 804. An input/output (I/O) interface 805 is also connected to bus 804.

A number of components in the device 800 are connected to the I/O interface 805, including: an input unit 806, such as a keyboard, a mouse, or the like; an output unit 807 such as various types of displays, speakers, and the like; a storage unit 808, such as a magnetic disk, optical disk, or the like; and a communication unit 809 such as a network card, modem, wireless communication transceiver, etc. The communication unit 809 allows the device 800 to exchange information/data with other devices via a computer network such as the internet and/or various telecommunication networks.

Various methods or processes described above may be performed by the processing unit 801. For example, in some embodiments, the methods may be implemented as a computer software program tangibly embodied in a machine-readable medium, such as storage unit 808. In some embodiments, part or all of the computer program can be loaded and/or installed onto device 800 via ROM 802 and/or communications unit 809. When loaded into RAM803 and executed by CPU 801, a computer program may perform one or more steps or actions of the methods or processes described above.

In some embodiments, the methods and processes described above may be implemented as a computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions embodied thereon for carrying out various aspects of the present disclosure.

The computer readable storage medium may be a tangible device that can hold and store the instructions for use by the instruction execution device. The computer readable storage medium may be, for example, but not limited to, an electronic memory device, a magnetic memory device, an optical memory device, an electromagnetic memory device, a semiconductor memory device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: a portable computer diskette, a hard disk, a Random Access Memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a Static Random Access Memory (SRAM), a portable compact disc read-only memory (CD-ROM), a Digital Versatile Disc (DVD), a memory stick, a floppy disk, a mechanical coding device, such as punch cards or in-groove projection structures having instructions stored thereon, and any suitable combination of the foregoing. Computer-readable storage media as used herein is not to be construed as transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission medium (e.g., optical pulses through a fiber optic cable), or electrical signals transmitted through electrical wires.

The computer-readable program instructions described herein may be downloaded from a computer-readable storage medium to a respective computing/processing device, or to an external computer or external storage device over a network, such as the internet, a local area network, a wide area network, and/or a wireless network. The network may include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers and/or edge servers. The network adapter card or network interface in each computing/processing device receives computer-readable program instructions from the network and forwards the computer-readable program instructions for storage in a computer-readable storage medium in the respective computing/processing device.

The computer program instructions for carrying out operations of the present disclosure may be assembly instructions, Instruction Set Architecture (ISA) instructions, machine-related instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including an object oriented programming language, as well as conventional procedural programming languages. The computer-readable program instructions may execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet service provider). In some embodiments, the electronic circuitry that can execute the computer-readable program instructions implements aspects of the present disclosure by utilizing the state information of the computer-readable program instructions to personalize the electronic circuitry, such as a programmable logic circuit, a Field Programmable Gate Array (FPGA), or a Programmable Logic Array (PLA).

These computer-readable program instructions may be provided to a processing unit of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, create means for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks. These computer-readable program instructions may also be stored in a computer-readable storage medium that can direct a computer, programmable data processing apparatus, and/or other devices to function in a particular manner, such that the computer-readable medium storing the instructions comprises an article of manufacture including instructions which implement various aspects of the function/act specified in the flowchart and/or block diagram block or blocks.

The computer readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatus or other devices to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus or other devices implement the functions/acts specified in the flowchart and/or block diagram block or blocks.

The flowchart and block diagrams in the figures illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flowchart or block diagrams may represent a module, segment, or portion of instructions, which comprises one or more executable instructions for implementing the specified logical function(s). In some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently, or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and/or flowchart illustration, and combinations of blocks in the block diagrams and/or flowchart illustration, can be implemented by special purpose hardware-based systems which perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.

Having described embodiments of the present disclosure, the foregoing description is intended to be exemplary, not exhaustive, and not limited to the disclosed embodiments. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is chosen in order to best explain the principles of the embodiments, the practical application, or technical improvements to the technology in the marketplace, or to enable others of ordinary skill in the art to understand the embodiments disclosed herein.

Claims

1. A method for anti-cheating, comprising:

running a check-in application on the mobile device for swiping a face and checking in;

detecting whether the check-in application is running on a virtualized system; and

in response to detecting that the check-in application is running on the virtualization system, determining that a cheating action is present on the mobile device.

2. The method of claim 1, wherein detecting whether the check-in application is running on a virtualized system comprises:

detecting whether a particular class in an operating system of the mobile device is provided by the virtualization system.

3. The method of claim 2, wherein the operating system is an android operating system and the particular class is an Instrumentation class in the android operating system.

4. The method of claim 1, further comprising:

forbidding a face brushing check-in function in the check-in application; and

sending user account information associated with the check-in application to a server for addition to a blacklist.

5. The method of claim 4, wherein disabling a swipe check-in function in the check-in application comprises:

preventing a user of the mobile device from using the virtualized environment to forge wireless router information for a swipe check-in.

6. The method of claim 5, wherein disabling a swipe check-in function in the check-in application comprises:

prompting a user of the mobile device for an operational anomaly; and

and prompting the user to quit the check-in application and restarting the check-in application.

7. A method for anti-cheating, comprising:

obtaining an Internet Protocol (IP) address of a mobile device on which a check-in application for swishing a face to check-in is running;

detecting whether the IP address is abnormal or not; and

in response to detecting that the IP address is anomalous, determining that cheating is present on the mobile device.

8. The method of claim 7, wherein detecting whether an anomaly exists for the IP address comprises:

obtaining a Basic Service Set Identifier (BSSID) of a wireless router to which the mobile device is connected; and

detecting whether there is an abnormality in the IP address based on the BSSID.

9. The method of claim 8, wherein detecting whether the IP address is anomalous based on the BSSID comprises:

counting a maximum probability IP address corresponding to the BSSID;

determining whether there is an anomaly in the IP address based on a comparison between the IP address and the most probable IP address.

10. The method of claim 7, wherein detecting whether an anomaly exists for the IP address comprises:

detecting whether the IP address is on an IP address white list, wherein the IP address white list is collected in advance.

11. A mobile device, comprising:

a processing unit; and

a memory coupled to the processing unit and storing instructions that, when executed by the processing unit, perform the following:

running a check-in application on the mobile device for swishing faces and checking in;

12. The apparatus of claim 11, wherein detecting whether the check-in application is running on a virtualized system comprises:

13. The device of claim 12, wherein the operating system is an android operating system and the particular class is an Instrumentation class in the android operating system.

14. The apparatus of claim 11, further comprising:

forbidding a face brushing check-in function in the check-in application; and

15. The device of claim 14, wherein inhibiting a swipe check-in function in the check-in application comprises:

16. The device of claim 15, wherein inhibiting a swipe check-in function in the check-in application comprises:

prompting a user of the mobile device for an operational anomaly; and

17. A server, comprising:

a processing unit; and

detecting whether the IP address is abnormal or not; and

18. The server of claim 17, wherein detecting whether an anomaly exists for the IP address comprises:

detecting whether there is an abnormality in the IP address based on the BSSID.

19. The server of claim 18, wherein detecting whether the IP address is anomalous based on the BSSID comprises:

counting a maximum probability IP address corresponding to the BSSID;

20. The server of claim 17, wherein detecting whether an anomaly exists for the IP address comprises:

21. A system for anti-cheating comprising a mobile device according to any of claims 11-16 and a server according to any of claims 17-20.