KR100968268B1 - Method for detecting automatically generated input - Google Patents

Abstract

The automatic input detection method includes driving an event monitoring device driver in a computer operating system capable of monitoring an event generated by an input means, by the input means transmitted to an application program in the form of a message or direct input. Driving an application module for monitoring the generated event in the computer operating system, and if the event is delivered to the application module, checking whether the event is due to an event passing through the event monitoring device driver And processing the event as a normal event if the event is caused by an event passing through the event monitoring device driver, and otherwise determining as an abnormal event generated by an automatic input means.

Auto Input, Auto Mouse, Mouse, Keyboard

Description

How to automatically detect mouse and keyboard input {METHOD FOR DETECTING AUTOMATICALLY GENERATED INPUT}

The present invention relates to a method for detecting mouse and keyboard automatic input, and more particularly, only events transmitted through the device driver associated with the mouse and keyboard are regarded as normal events, and otherwise, are generated by software automation. The present invention relates to a method of detecting and detecting mouse and keyboard input.

Due to the recent development of high-speed Internet network technology, the number of Internet users has exploded and the communication technology related to the Internet is continuously evolving into a new shape. In particular, network games, in which a large number of users can simultaneously access the Internet and play games, have become very popular, and game developers are releasing various network games based on such popularity.

Among the various Internet network games, a game called massively multiplayer online role playing game (MMORPG) is a game in which a large number of users simultaneously access a game server and play their roles in a fantasy or mystery world set by the game. Players in MMORPG games manipulate their assigned characters and navigate through the various events that occur within the continuous storyline provided by the game as if it were happening in the real world. In other words, the user can raise the level by training a character representing himself through hunting or battle, form a guild by forming a relationship with other players, form a team to battle as a group, You can also buy items. In most MMORPG games, in order to increase your character's level or experience, you have to repeat missions such as hunting monsters, fighting enemies, visiting specific areas, and so on. These repetitive missions can be performed through constant and regular mouse movements, repetitive clicks, repetitive and regular inputs to specific keys on the keyboard, and the like.

On the other hand, automatic input programs such as auto mouse or auto play are being developed to perform such repetitive missions by automatically generating an event of a mouse or a keyboard without a user's actual input. Some game players use this automatic input program to raise their character level or experience, which is a problem. Using auto-input programs or auto-input devices, you can perform repetitive missions without direct input, so you can quickly increase the level or experience of your character. Not only does it destroy the game's balance by destroying fair game progress, but it is also used by organizations that illegally sell game items offline, causing serious social problems.

In order to prevent automatic input of a mouse or keyboard, hooking an API (Application Programming Interface), which is currently used to generate a mouse or keyboard event programmatically in an automatic input program, when the event affects a game We are using a method that causes an event to fail. For example, an API called SendInput provides the ability to programmatically trigger mouse or keyboard events. If you have an automatic input program that uses these APIs to deceive mouse or keyboard events, hooking the SendInput API to auto-input You do this by causing the program to fail when calling the SendInput API.

However, this defense method of the API hooking method has all the limitations of the hooking method itself. For example, if the auto-input program uses a function other than the hooked function, or if the API returns the program to an unhooked initial state, the auto-input cannot be prevented. In addition, when generating an auto-input event at the hardware level using a device driver rather than an API hooking method or generating an event by using the auto-input hardware rather than the auto-input software, the defense cannot be performed at all. There is this.

On the other hand, in addition to the defense method of the above-described API hooking method, the pattern of the input events is analyzed and generated by automatic input when the pattern has a very regular periodicity or sequence so that the pattern cannot be directly input by a human. There is a method of determining that it is an event. That is, the interval between mouse clicks, the distance between key inputs, the distance from the position where the mouse is clicked to the position where the next click is made, and the pattern of the order in which the keyboard keys are input are monitored for a certain period of time. If the input is repeated repeatedly with a precise period that is difficult to see as being input, or if the key input pattern having a specific order is repeated for a predetermined time or more, the event is not generated by the user's direct input, but instead to the automatic input program or the automatic input device. It is a method of determining that an event has occurred.

However, since there are cases where a specific pattern cannot be found in the input events according to the type of game, there is a limit that cannot be prevented even by a defense method by such a pattern analysis.

The present invention was devised to overcome the problems and limitations of the conventional automatic input detection method. The technical problem to be achieved by the present invention is that a mouse or keyboard event input to an application program passes through a mouse or keyboard device driver. Automatic input detection method that can overcome the limitations of automatic input defense method through API hooking method and the defense method by pattern analysis by judging normal input only when it is delivered and automatic input by software otherwise. To provide.

The objects of the present invention are not limited to the above-mentioned objects, and other objects that are not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, the automatic input detection method according to an embodiment of the present invention, the event monitoring device driver that can monitor the event generated by the user input means by the mouse or keyboard in the computer operating system Driving, in the computer operating system, an application module for monitoring the event delivered to an application in the form of a message or direct input, if the event is delivered to the application module, the event is the event Checking whether the event is due to an event passing through the monitoring device driver, and if the event is due to an event passing through the event monitoring device driver, treating the event as a normal event; Caused by And determining the abnormal event.

In order to achieve the above object, the automatic input detection method according to another embodiment of the present invention, an event monitoring device driver that can monitor an event generated by a user input means by a mouse or a keyboard in a computer operating system Driving, in the computer operating system, an application module for monitoring an event generated by the input means delivered to an application program in the form of a message or direct input, the device driver for event monitoring for a predetermined time; Counting the number of events passing through, counting the number of events delivered in the form of a message or direct input to the application module during the predetermined time, and determining the number of events passing through the event monitoring device driver. Number and application modules Comparing the number of delivery events; And when the number of events passed through the event monitoring device driver and the number of events delivered to the application module are the same, process as normal input, and otherwise determine as abnormal input generated by the automatic input means. It includes.

In order to achieve the above object, the automatic input sensing method according to the embodiments of the present invention can be implemented in the form of a program that can be executed on a computer, in the form of a computer-readable recording medium storing the program May also be implemented.

Specific details of other embodiments are included in the detailed description and the drawings.

According to the automatic input detection method of the present invention as described above has one or more of the following effects.

First, it is judged as normal input only when the mouse or keyboard event input to the application is passed through the device driver of the mouse or keyboard. Otherwise, it is judged as software automatic input. Even the automatic input signal generated by hardware can be detected and defended by using a driver.

Second, even if it is an automatic input that cannot detect a certain pattern, there is an advantage that it can detect it.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout the specification.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram illustrating the concept of a computer operating system for performing an automatic input detection method according to an embodiment of the present invention.

The computer operating system 10 for operating a computer may be divided into a kernel level 20 and a user level 30. The kernel level 20 is an integral part of the operating computer operating system residing in the main memory of the computer. It provides special processes, process monitors, environment exchanges and new processes to handle the initialization and interruption of the system. It contains the modules that it generates. In addition, device drivers for processing the interrupt signal of the input means 40 connected to the computer are located. On the other hand, at the user level 30, various application programs are run in the computer operating system, and processes and interrupts processed at the kernel level 20 are delivered to the application program. At this time, the processes and interrupts delivered to the application program are processed in various forms and delivered to the application program, which may be delivered in the form of a message by a message queue, or may not be processed in the form of a message. It can also be delivered directly.

For example, when a user generates an input event using an input means 40 such as a keyboard or a mouse, the event is interrupt service routine (ISR) located at the kernel level 20 of the computer's operating system. ) Is processed as an interrupt signal. The event processed in the ISR is processed through the device driver stack 50 in which a plurality of device drivers driving the input means are gathered, and then delivered to the user level 30. Events delivered to the user level 30 may themselves be delivered to the application 60 or in the form of messages by the message queue 80. When delivered in the form of a message, it is delivered to the application 60 in the form of a message through a message queue 80 such as a System Message Queue (SMQ) or a Thread Message Queue (TMQ). In response to receiving the message, the application program 60 performs a corresponding process.

On the other hand, automatic input programs such as auto mouse and auto play generally generate automatic input signals through message hooking, API call, etc. at the user level 30, and deliver them to the application program 60, or the kernel level 20. In the step of going to the user level 30 in the inserted automatically generated events to be delivered to the application (60).

Accordingly, according to the automatic input sensing method according to the embodiment of the present invention, the event monitoring device driver 55 is placed on the device driver stack 50 of the kernel level 20, and the event monitoring device driver 55 is placed. By determining that only the event passing through) can be processed by the application program 60 as a normal event, it is possible to defend the automatic input events generated by the automatic input program without going through the device driver.

In more detail, an event monitoring device driver 55 capable of monitoring an event is placed on a device driver stack 50 related to an input means 40 such as a mouse or a keyboard. Events generated by the input means 40, such as a mouse or keyboard, are necessarily passed to the user level 30 through this event monitoring device driver 55 located on the device driver stack 50. The event monitoring device driver 55 is a kind of filter driver capable of filtering an event generated by the input means 40, and is optional on the device driver stack 50 so as to filter an event of the input means 40. Can be driven at the position of. Alternatively, the event monitoring device driver 55 may be a kind of hooking driver that monitors an event of the input means 40 by hooking any driver existing on the device driver stack 50.

Meanwhile, at the user level 30, an application module 70 capable of monitoring an event or a message transmitted to the application program 60 is located. The application module 70 may be driven at any location on the user level 30 to monitor events or messages delivered to the application program 60. The event passed through the event monitoring device driver 55 may be delivered directly to the application 60 in the form of DirectInput, or may be processed in the form of a message in the message queue 80 and delivered to the application 60. have. Or, it may be transformed into another type of event and delivered. In this case, the application module 70 monitors an event or a message delivered to the application program 60. The application module 70 checks through the event monitoring device driver 55 located at the kernel level 20 whether or not the event or message has passed the event monitoring device driver 55 for every event or message transmitted. Thus, if it is caused by an event passing through the event monitoring device driver 55, it is treated as a normal event, otherwise it is determined as an abnormal event generated by the automatic input means. That is, since the event is monitored from the kernel level 20 and only the event passing through the device driver is processed as a normal event, the user level 30 can detect all the automatic inputs generated by the API call. Even if it is a hardware-generated automatic input at the kernel level 20 using a driver, an effective defense against this can be performed.

On the other hand, in addition, it is possible to drive the analysis engine 90 to analyze the pattern for a certain time of the input events to perform a more reliable automatic input detection. The analysis engine 90 may be located at any location within the computer operating system 10. That is, it can be located at any level of kernel level 20 or user level 30. The analysis engine 90 analyzes an input pattern of input events and determines whether the input pattern is caused by a user or by an automatic input device.

For example, whether a time interval between events input by the analysis engine 90 is equal to or more than a predetermined number of times, whether a time difference of occurrence of an up / down event due to a mouse button click is equal to or more than a predetermined number of times, or a keyboard key scan code Can be analyzed whether the same pattern, more than a predetermined threshold number of times in the same time interval. The pattern analysis method of the analysis engine 90 may have various forms.

In this way, it is determined that the event is automatically input by the event monitoring device driver 55 and the application module 70, or generated by an automatic input program or an automatic input device other than the user by the analysis engine 90. If it is determined that the event, it is possible to ignore the event delivered to the application 60, or terminate the application 60 itself to defend the automatic input. Alternatively, the number of times determined to be an abnormal event by the automatic input means may be counted, and when the counted number exceeds the predetermined threshold, the application program 60 may be terminated to perform defense.

Hereinafter, with reference to Figures 2 to 6, the automatic input detection method according to an embodiment of the present invention will be described in detail step by step.

2 to 6 are flowcharts illustrating an automatic input sensing method according to an embodiment of the present invention.

First, an event monitoring device driver 55 capable of monitoring an event generated by an input means 40 such as a keyboard or a mouse is driven in the computer operating system 10 (S210). The event monitoring device driver 55 is located and driven on the device driver stack 50 associated with the input means 40.

Then, the application module 70 for monitoring the event generated by the input means 40 transmitted to the application program 60 in the form of a message or direct input is driven in the computer operating system 10 (S220). ). The application module 70 may be driven at any location on the user level 20 of the computer operating system 10 capable of monitoring the event delivered to the application program 60.

If an event is delivered to the application module 70 in the form of a message through the message queue 80 or an event is delivered to the application module in the form of a direct input, the event is the event monitoring device. It is checked whether the event is caused by passing the driver 55 (S230).

In this case, referring to FIG. 3, the application module 70 sends a query message to the event monitoring device driver 55 inquiring whether all events have passed through the event monitoring device driver 55. Transfer to (S231). The event monitoring device driver 55 checks whether an event delivered to the application 60 in the form of the message or direct input is an event transmitted through the event monitoring device driver 55 and then the application program 60. To be transmitted (S232).

Alternatively, referring to FIG. 4, the event monitoring device driver 55 informs the application module 70 whether each event passes the event monitoring device driver 55 at every event (S233). In operation S234, the event transmitted to the application program 60 may be identical to the event passing through the event monitoring device driver 55.

If it is determined that the event is caused by an event that has passed through the event monitoring device driver 55, the event is processed as a normal event by a user's input (S240). It is determined that the abnormal event generated by (S241).

On the other hand, even if the event is determined to be caused by the event passed through the event monitoring device driver is determined to be a normal event by the user's input (S240), even if the automatic input is more reliably detected by additional inspection You can also pay.

5 is a flowchart illustrating a method of more reliably detecting an automatic input by an additional test according to an embodiment of the present invention.

That is, referring to FIG. 5, the analysis engine 90 for analyzing a pattern for a predetermined time of the event input by the input means is driven (S251), and the pattern of the event analyzed by the analysis engine 90 is performed. It may be determined whether the automatic input according to (S252). For example, if an event pattern is analyzed and input with a precise pattern that is hardly seen as being input by a person, it is determined as an abnormal event by an automatic input means such as an automatic input program or an automatic input device, not a user ( S253). The analysis engine 90 determines whether a time interval between input events is equal to or more than a predetermined number of times, whether a time difference of occurrence of an up / down event due to a mouse button click is equal to or more than a predetermined number of times, or a pattern having the same key scan code of a keyboard, At the same time interval, it is possible to analyze whether or not a predetermined threshold number of times occurs. In addition, there may be various methods for analyzing patterns of events.

In this way, the event is automatically determined by the event monitoring device driver 55 and the application module 70, or the event generated by the automatic input program or automatic input device other than the user by the analysis engine 90 If it is determined that the message is an abnormal event by the automatic input means, the event can be ignored by the application program 60 or the application program 60 can be terminated (S260).

Alternatively, referring to FIG. 6, whenever an abnormal event is determined by the automatic input means, the monitoring counter is incremented by one (S271), and when the monitoring counter reaches a predetermined threshold or more (S272), the application program is executed. In operation S273, a defense against automatic input may be performed.

Hereinafter, an automatic input sensing method according to another embodiment of the present invention will be described with reference to FIG. 7.

7 is a flowchart illustrating an automatic input sensing method according to another embodiment of the present invention.

First, an event monitoring device driver 55 capable of monitoring an event generated by the input means 40 is driven in the computer operating system 10 (S310). The event monitoring device driver 55 is located and driven on the device driver stack 50 associated with the input means 40.

Then, the application module 70 for monitoring an event generated by the input means 40 transmitted to the application program 60 in the form of a message or in the form of a direct input is driven in the computer operating system 10. (S320). The application module 70 may be driven at any location on the user level 20 of the computer operating system 10 capable of monitoring the event delivered to the application program 60.

In operation S330, the number of events passing through the event monitoring device driver 55 and the number of events delivered to the application module 70 are counted.

In addition, by comparing the number of events passed through the event monitoring device driver 55 with the number of events transmitted to the application module 70 (S340), the event passes through the event monitoring device driver 55. If the number of times and the number of events delivered to the application module 70 is the same as the normal input (S351), otherwise it is determined as an abnormal input generated by the automatic input means (S352).

As described above, since a mouse or keyboard event input to an application is passed through a device driver of a mouse or keyboard, it is determined to be normal input. Otherwise, it is determined as software automatic input. In addition to automatic input signals generated by software, even automatic input signals generated by hardware using device drivers rather than API calling methods can be detected and defended, and automatic inputs that cannot detect certain patterns. Even if you can detect this is an advantage. In addition, the automatic detection of automatic input in two stages is possible through the analysis engine, so that automatic input can be defended more reliably.

The present invention can be embodied as computer readable codes on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CO-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (e.g., transmission over the Internet). It also includes. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. I can understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

1 is a conceptual diagram illustrating a concept of a computer operating system in which an automatic input sensing method is performed according to an embodiment of the present invention.

2 is a flowchart illustrating an automatic input sensing method according to an embodiment of the present invention.

3 is a flowchart illustrating an example of a method for checking whether each event passes a device driver for event monitoring in an automatic input sensing method according to an embodiment of the present invention.

FIG. 4 is a flowchart illustrating still another example of a method for checking whether each event passes a device driver for event monitoring in an automatic input sensing method according to an embodiment of the present invention.

5 is a flowchart illustrating a method of detecting an automatic input more reliably by an additional test in the automatic input sensing method according to an embodiment of the present invention.

6 is a flowchart illustrating a method of detecting an automatic input by increasing a detection counter in the automatic input sensing method according to an embodiment of the present invention.

7 is a flowchart illustrating an automatic input sensing method according to another embodiment of the present invention.

Claims (22)

Driving an event monitoring device driver in a computer operating system capable of monitoring an event generated by a user input means by a mouse or a keyboard; Running in said computer operating system an application module for monitoring said event delivered to an application in the form of a message or direct input; If the event is delivered to the application module, checking whether the event is due to an event passing through the event monitoring device driver; And If the event is caused by an event passing through the event monitoring device driver, processing the event as a normal event; otherwise, processing the event as an abnormal event generated by an automatic input means. Automatic input detection method comprising a. The method of claim 1, The event monitoring driver is located and driven on a device driver stack in the computer operating system associated with the input means. Automatic input detection method. The method of claim 2, The event monitoring driver is a filter driver driven at an arbitrary position on the device driver stack to filter the events of the input means. Automatic input detection method. The method of claim 2, The event monitoring driver is a hooking driver that monitors an event of the input means by hooking an arbitrary driver existing on the driver stack. Automatic input detection method. The method of claim 1, The application module is driven at an arbitrary location within a user level of the computer operating system to monitor the event delivered to the application program. Automatic input detection method. The method of claim 1, The step of checking whether the event is caused by the event passing through the event monitoring device driver, Transmitting, by the application module, a query message to the event monitoring device driver at every event; And Determining whether an event delivered to the application is the same event that passed the event monitoring device driver; Automatic input detection method. The method of claim 1, The step of checking whether the event is caused by the event passing through the event monitoring device driver, The event monitoring device driver notifying the application module whether each event has passed the event monitoring device driver at every event; And Determining whether an event delivered to the application is the same event that passed the event monitoring device driver; Automatic input detection method. The method of claim 1, If it is determined that the abnormal event by the automatic input means, further comprising the step of ignoring the event or terminating the application program Automatic input detection method. The method of claim 1, If it is determined that the abnormal event by the automatic input means, incrementing a monitoring counter; And Terminating the application if the monitoring counter reaches a predetermined threshold or more; Automatic input detection method. delete The method of claim 1, Driving an engine for analyzing a pattern for a predetermined time of an event input by the input means; And Determining whether the automatic input is performed according to the pattern of the event analyzed by the engine. Automatic input detection method. A computer-readable recording medium storing a computer program for performing the method of any one of claims 1 to 9 or 11. Driving an event monitoring device driver capable of monitoring an event generated by a user input means by a mouse or a keyboard; Running an application module in a computer operating system for monitoring an event generated by said user input means delivered to an application program in the form of a message or direct input; Counting the number of events that have passed through the event monitoring device driver for a predetermined time; Counting the number of events delivered in the form of a message or direct input to the application module during the predetermined time; Comparing the number of events passed to the event monitoring device driver with the number of events delivered to the application module; And If the number of events passed through the event monitoring device driver and the number of events delivered to the application module are the same, the event generated by the user input means is treated as a normal input. Otherwise, the user input means Determining the event generated by the abnormal input generated by the automatic input means Automatic input detection method comprising a. The method of claim 13, The event monitoring driver is located and driven on a device driver stack in the computer operating system associated with the input means. Automatic input detection method. The method of claim 14, The event monitoring driver is a filter driver driven at an arbitrary position on the device driver stack to filter the events of the input means. Automatic input detection method. The method of claim 14, The event monitoring driver is a hooking driver that monitors an event of the input means by hooking an arbitrary driver existing on the driver stack. Automatic input detection method. The method of claim 13, The application module is driven at an arbitrary location within a user level of the computer operating system to monitor the event delivered to the application program. Automatic input detection method. The method of claim 13, If it is determined that the abnormal input by the automatic input means, further comprising the step of ignoring the input by the event or terminating the application program; Automatic input detection method. The method of claim 13, If it is determined that the abnormal input by the automatic input means, incrementing the monitoring counter; And Terminating the application if the monitoring counter reaches a predetermined threshold or more; Automatic input detection method. delete The method of claim 13, Driving an engine for analyzing a pattern for a predetermined time of an event input by the input means; And Determining whether the automatic input is performed according to the pattern of the event analyzed by the engine. Automatic input detection method. A computer-readable recording medium storing a computer program for performing the method of any one of claims 13 to 19 or 21.

Images