KR102187941B1 - Method and apparatus for determining illegal user in a game - Google Patents

Abstract

In order to determine the fraudulent user account, a target user account is determined, a plurality of user accounts having a transaction record with the target user account are determined, and a first candidate among the plurality of user accounts based on the creation time of the target user account A user account is determined, a first candidate user account is registered in a suspicious user group, a first suspicious transaction ratio of the target user account is calculated based on the suspicious user group, and the calculated first suspicious transaction ratio is set in advance. If it exceeds the threshold ratio, the target user account is determined as an illegal user account.

Description

Method and device for determining fraudulent users in the game {METHOD AND APPARATUS FOR DETERMINING ILLEGAL USER IN A GAME}

The following embodiments relate to a technique for determining or detecting an illegal user in a game.

In the online game, the user can purchase other items or goods by using the items or goods they own. Recently, in order to secure a specific item or a large amount of goods, a transaction has occurred in which items or goods are acquired using a plurality of user accounts and the acquired items or goods are driven to a specific user account. The system used to carry out such transactions may be referred to as a workshop. The game provider needs to detect the user accounts used in the workplace so that the workplace cannot be operated.

An embodiment may provide a method and apparatus for determining an illegal user in a game.

Another embodiment may provide a method and apparatus for detecting a workplace in a game.

According to an aspect, a method for determining a fraudulent user account, performed by a server, includes determining a target user account, determining a plurality of user accounts having a transaction record with the target user account, and Determining a first candidate user account from among the plurality of user accounts based on the creation time, registering the first candidate user account with a suspicious user group, and selecting the target user account based on the suspicious user group 1 calculating a suspicious transaction ratio, and when the calculated first suspicious transaction ratio is greater than or equal to a predetermined first threshold ratio, determining the target user account as an illegal user account.

The determining of the target user account may include determining one of the user accounts having a transaction record within a preset time as the target user account.

The determining of a first candidate user account from among the plurality of user accounts includes calculating a difference between the creation time of each of the plurality of user accounts and the creation time of the target user account, and the calculated difference is first It may include determining the first candidate user account that is less than a threshold value.

The method for determining the fraudulent user account includes determining a second candidate user account from among the plurality of user accounts based on the creation time of the first candidate user account, and assigning the second candidate user account to the suspicious user group. It may further include the step of registering.

The method for determining the fraudulent user account further includes, when the plurality of user accounts are determined, arranging the plurality of user accounts based on the creation time of each of the plurality of user accounts, and the first candidate user account And the second candidate user accounts may be user accounts adjacent to each other.

The fraudulent user account determination method includes obtaining a plurality of Internet Protocol (IP) addresses used by each of the plurality of user accounts during a transaction, and selecting IP addresses within a preset range among the plurality of IP addresses. Setting a suspicious IP address group, and calculating a second suspicious transaction ratio of the target user account based on the suspicious IP address group, wherein the determining of the target user account as a fraudulent user account comprises: And determining the target user account as an illegal user account when the calculated second suspicious transaction ratio is greater than or equal to a preset second threshold ratio.

The IP address within the preset range may be the same C class of the IP address.

The second threshold ratio may be smaller than the first threshold ratio.

According to another aspect, the server for determining the fraudulent user account includes a memory in which a program for determining the fraudulent user account is recorded, and a processor that executes the program, wherein the program comprises: determining a target user account, Determining a plurality of user accounts having a transaction record with the target user account, determining a first candidate user account from among the plurality of user accounts based on the creation time of the target user account, the first candidate Registering a user account with a suspicious user group, calculating a first suspicious transaction ratio of the target user account based on the suspicious user group, and wherein the calculated first suspicious transaction ratio is greater than or equal to a preset first threshold ratio In this case, a step of determining the target user account as an illegal user account is performed.

The determining of the target user account may include determining one of the user accounts having a transaction record within a preset time as the target user account.

The determining of a first candidate user account from among the plurality of user accounts includes calculating a difference between the creation time of each of the plurality of user accounts and the creation time of the target user account, and the calculated difference is first It may include determining the first candidate user account that is less than a threshold value.

The program includes determining a second candidate user account from among the plurality of user accounts based on the creation time of the first candidate user account, and registering the second candidate user account with the suspicious user group. You can do more.

When the plurality of user accounts are determined, the program further performs the step of arranging the plurality of user accounts based on the creation times of each of the plurality of user accounts, and the first candidate user account and the second The candidate user accounts may be user accounts adjacent to each other.

According to another aspect, a method for determining an illegal user account, performed by a server, includes determining a target user account, determining a plurality of user accounts having a record of transactions with the target user account, the plurality of Acquiring a plurality of Internet Protocol (IP) addresses used by each of the user accounts in a transaction, setting IP addresses within a preset range among the plurality of IP addresses as a suspect IP address group, the suspicious Calculating a second suspicious transaction ratio of the target user account based on an IP address group, and determining the target user account as an illegal user account when the calculated second suspicious transaction ratio is greater than or equal to a preset second threshold ratio It may include steps.

The determining of the target user account may include determining one of the user accounts having a transaction record within a preset time as the target user account.

The IP address within the preset range may be the same C class of the IP address.

The method for determining an illegal user account may include determining a first candidate user account from among the plurality of user accounts based on the creation time of the target user account, registering the first candidate user account with a suspicious user group, And calculating a first suspicious transaction ratio of the target user account based on the suspicious user group, wherein the determining of the target user account as an illegal user account includes the calculated first suspicious transaction ratio When the ratio is greater than or equal to the first preset threshold ratio, determining the target user account as an illegal user account.

The determining of a first candidate user account from among the plurality of user accounts includes calculating a difference between the creation time of each of the plurality of user accounts and the creation time of the target user account, and the calculated difference is first It may include determining the first candidate user account that is less than a threshold value.

The method for determining the fraudulent user account includes determining a second candidate user account from among the plurality of user accounts based on the creation time of the first candidate user account, and assigning the second candidate user account to the suspicious user group. It may further include the step of registering.

The method for determining the fraudulent user account further includes, when the plurality of user accounts are determined, arranging the plurality of user accounts based on the creation time of each of the plurality of user accounts, and the first candidate user account And the second candidate user accounts may be user accounts adjacent to each other.

According to another aspect, the server for determining the fraudulent user account includes a memory in which a program for determining the fraudulent user account is recorded, and a processor that executes the program, wherein the program includes determining a target user account , Determining a plurality of user accounts having a transaction record with the target user account, obtaining a plurality of Internet Protocol (IP) addresses used by each of the plurality of user accounts during a transaction, the plurality of Setting IP addresses within a preset range of IP addresses as a suspect IP address group, calculating a second suspicious transaction ratio of the target user account based on the suspicious IP address group, and the calculated second When the suspicious transaction ratio is greater than or equal to a preset second threshold ratio, determining the target user account as an illegal user account is performed.

The determining of the target user account may include determining one of the user accounts having a transaction record within a preset time as the target user account.

The IP address within the preset range may be the same C class of the IP address.

A method and apparatus for determining an unauthorized user in a game may be provided.

A method and apparatus for detecting a workplace in a game can be provided.

1 illustrates a method of transacting items or goods of users through an exchange provided by a server according to an example.
2 is a block diagram of a server for determining an illegal user according to an embodiment.
3 is a flowchart of a method for determining an illegal user according to an exemplary embodiment.
4 is a flowchart of a method of determining a first candidate user account according to an example.
5 is a flowchart of a method of registering a second candidate user account to a suspicious user group according to an example.
6 illustrates a target user account and transaction details between a plurality of user accounts according to an example.
7 is a flowchart of a method of determining an illegal user account based on IP addresses of a plurality of user accounts according to an example.
8 illustrates a target user account and transaction details between a plurality of user accounts according to another example.
9 is a block diagram of a server for determining an illegal user according to another exemplary embodiment.
10 is a flowchart of a method of determining an illegal user account based on a user account creation time according to an example.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. However, since various changes may be made to the embodiments, the scope of the rights of the patent application is not limited or limited by these embodiments. It should be understood that all changes, equivalents, or substitutes to the embodiments are included in the scope of the rights.

The terms used in the examples are used for illustrative purposes only and should not be interpreted as limiting. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present specification, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof, does not preclude in advance.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiment belongs. Terms as defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in this application. Does not.

In addition, in the description with reference to the accompanying drawings, the same reference numerals are assigned to the same components regardless of the reference numerals, and redundant descriptions thereof will be omitted. In describing the embodiments, when it is determined that a detailed description of related known technologies may unnecessarily obscure the subject matter of the embodiments, the detailed description thereof will be omitted.

1 illustrates a method of transacting items or goods of users through an exchange provided by a server according to an example.

The server 110 providing the game provides the exchange 112 in the game to users of the game. The user can access the server 110 through a user account. Hereinafter, the operation performed by the user account may be understood as an operation performed by the user through the user terminal.

The first user 120 may exchange game items or goods held by the user account with other users 130, 140, 150 through the exchange 112. For example, a target item held by a first user account and a product held by a second user account may be exchanged. When the first user 120 is a buyer of the workplace, and the second user 130, the third user 140, and the fourth user 150 are sellers of the workplace, the first user 120 ) May accumulate goods by selling the item to the second user 130, the third user 140, and the fourth user 150.

Transaction records between users 120 to 150 may be generated as log information. The server 110 may determine the user account of the first user 120 as an illegal user account by analyzing the transaction record. The server 110 may impose a penalty to a user determined as an illegal user account. Additionally, a penalty may be given to a user account (for example, the second user 130) determined to be closely related to the illegal user account. For example, the penalty may be a suspension of using a game by an illegal user account.

As conditions for detecting the workplace, i) the sequentiality of user account creation and ii) the locality of the user account may be considered. A method of determining an illegal user account in consideration of the above conditions is set in detail with reference to FIGS. 2 to 10 below.

2 is a block diagram of a server for determining an illegal user according to an embodiment.

The server 200 for determining an illegal user account includes a communication unit 210, a processor 220, and a memory 230. For example, the server 200 may correspond to the server 110 described above with reference to FIG. 1. As another example, the server 200 may be a separate server or electronic device that is physically separated from the server 110.

The communication unit 210 is connected to the processor 220 and the memory 230 to transmit and receive data. The communication unit 210 may be connected to other external devices to transmit and receive data. Hereinafter, the expression "transmitting/receiving A" may indicate transmitting/receiving "information or data representing A".

The communication unit 210 may be implemented as a circuitry in the server 200. For example, the communication unit 210 may include an internal bus and an external bus. As another example, the communication unit 210 may be an element that connects the server 200 and an external device. The communication unit 210 may be an interface. The communication unit 210 may receive data from an external device and transmit the data to the processor 220 and the memory 230.

The processor 220 processes data received by the communication unit 210 and data stored in the memory 230. The “processor” may be a data processing device implemented in hardware having a circuit having a physical structure for executing desired operations. For example, desired operations may include code or instructions included in a program. For example, a data processing device implemented in hardware is a microprocessor, a central processing unit, a processor core, a multi-core processor, and a multiprocessor. , Application-Specific Integrated Circuit (ASIC), and Field Programmable Gate Array (FPGA).

The processor 220 executes computer-readable code (eg, software) stored in a memory (eg, memory 230) and instructions induced by the processor 220.

The memory 230 stores data received by the communication unit 210 and data processed by the processor 220. For example, the memory 230 may store a program (or application or software). The stored program may be a set of syntaxes that are coded to determine an illegal user account and executed by the processor 220.

According to an aspect, the memory 230 may include one or more volatile memories, nonvolatile memories and random access memories (RAM), flash memories, hard disk drives, and optical disk drives.

The memory 230 stores an instruction set (eg, software) for operating the server 200. The instruction set for operating the server 200 is executed by the processor 220.

The communication unit 210, the processor 220, and the memory 230 will be described in detail with reference to FIGS. 3 to 10 below.

3 is a flowchart of a method for determining an illegal user according to an exemplary embodiment.

The steps 310 to 380 below are performed by the server 200 described above with reference to FIG. 2.

In step 310, the server 200 receives the transaction record of the exchange. For example, the transaction record may be content that has been traded through an exchange during a preset period. The transaction record may include information of a seller, information of a buyer, and information of an item for sale.

In step 320, the server 200 determines a target user account among the user accounts shown in the transaction record. For example, one of the user accounts that are sellers may be determined as the target user account. Any one of the user accounts having a transaction record within a preset time may be determined as the target user account.

In step 330, the server 200 determines a plurality of user accounts with records of transactions with the target user account. That is, user accounts that purchase items sold by the target user account may be determined.

In step 340, the server 200 determines a first candidate user account from among the plurality of user accounts based on the creation time of the target user account. A method of determining a first candidate user account will be described in detail with reference to FIGS. 4 and 6 below.

In step 350, the server 200 registers the first candidate user account with the suspicious user group. The suspicious user group may include a plurality of candidate user accounts.

In step 360, the server 200 calculates a first suspicious transaction ratio of the target user account based on the suspicious user group. For example, a ratio of the number of times the target user account has transacted with a suspicious user group may be calculated. A method of calculating the first suspicious transaction ratio will be described in detail with reference to FIG. 6 below.

In step 370, the server 200 determines whether the first suspicious transaction ratio is greater than or equal to the first threshold ratio. The first threshold ratio may be adjusted by the administrator of the server 200.

In step 380, when the first suspicious transaction ratio is greater than or equal to the first threshold ratio, the server 200 determines the target user account as an illegal user account. For example, a fraudulent user account may be named a banker, and a user account in a suspicious user group may be named a farmer.

4 is a flowchart of a method of determining a first candidate user account according to an example.

According to one aspect, the step 340 described above with reference to FIG. 3 may include the following steps 410 and 420.

In step 410, the server 200 calculates a difference between the creation time of each of the plurality of user accounts and the creation time of the target user account. For example, the creation time of the target user account is 12:40:00 on January 1, 2019, and the creation time of any one of the plurality of user accounts is 12:41 on January 1, 2019. In the case of 10 seconds, the difference is 1 minute and 10 seconds.

In step 420, the server 200 determines a first candidate user account whose calculated difference is less than a first threshold value. For example, when the first threshold value is 2 minutes, since the difference between the user account in the example above is 1 minute and 10 seconds, the user account may be determined as the first candidate user account.

5 is a flowchart of a method of registering a second candidate user account to a suspicious user group according to an example.

According to one aspect, the steps 510 to 530 below may be performed in parallel with the steps 340 to 350 described above with reference to FIG. 3.

In step 510, the server 200 sorts the plurality of user accounts based on the creation time of each of the plurality of user accounts. For example, a plurality of user accounts may be arranged so as to precede the creation time earlier. As a plurality of user accounts are arranged, two adjacent user accounts may have mutual correlation.

In step 520, the server 200 determines a second candidate user account from among the plurality of user accounts based on the creation time of the first candidate user account. For example, among user accounts adjacent to the first candidate user account (for example, preceding or following), the second user account in which the difference between the creation time of the first candidate user account and the creation time of the user account is less than a preset difference. Can be determined as a candidate user account. For example, the preset difference may be the same as the first threshold value. A method of determining the second candidate user is determined in detail with reference to FIG. 6 below.

In step 530, the server 200 registers the second candidate user account with the suspicious user group.

6 illustrates a target user account and transaction details between a plurality of user accounts according to an example.

The server 200 may arrange the target user account 610 and the plurality of user accounts 620 having a transaction history based on the account creation time.

For example, when the creation time of the target user account 610 is 12:40:00 on January 01, 2019, the first among the plurality of user accounts 620 differs within 2 minutes from the creation time. A candidate user account 622 may be determined.

After the first candidate user account 622 is determined, the creation time of the first candidate user account 622 among the user accounts adjacent to the first candidate user account 622 (January 01, 2019 12:41:10 ) And the second candidate user account 624 that is different within 2 minutes or less may be determined. If there is no user account created within the threshold value and the creation time of the first candidate user account 622, an additional candidate user account may not be determined.

Additionally, after the second candidate user account 624 is determined, the creation time of the second candidate user account 624 among user accounts adjacent to the second candidate user account 624 (January 01, 2019 at 12:43 p.m. 00 seconds) and within 2 minutes, the third candidate user account 626 may be determined.

Since the difference between the creation time of the third candidate user account 625 and the creation time of the user account 626 adjacent to the third candidate user account 625 is 2 minutes or more, the user account 626 is not determined as a candidate user account. May not.

In the above embodiment, the suspicious user group includes a first candidate user account 622, a second candidate user account 624 and a third candidate user account 625. The total number of transactions made by the target user account 610 with the plurality of user accounts 620 is 25, and among them, the number of transactions with the suspicious user group is 24. Accordingly, the first suspicious transaction ratio may be calculated as 24/25=0.96. For example, when the first threshold ratio is set to 0.75, the target user account whose first suspicious transaction ratio is 0.96 is determined as an illegal user account.

7 is a flowchart of a method of determining an illegal user account based on IP addresses of a plurality of user accounts according to an example.

The steps 710 to 730 below may be performed in parallel with the steps 340 to 370 with reference to FIG. 3. In the following steps 710 to 730, an Internet Protocol (IP) address used by a user account may be used to detect a workplace. Since the workplace is likely to occur in a geographically similar place, additional IP addresses can be used to reflect this connection environment.

In step 710, the server 200 acquires a plurality of IP addresses used by each of the plurality of user accounts during a transaction. One user account can also access the server 200 using two or more IP addresses. Even in this case, individual IP addresses can be obtained.

In step 720, the server 200 sets IP addresses within a preset range among the plurality of IP addresses as a suspicious IP address group. For example, an IP address within a preset range may be the same C class of IP addresses. In general, IP addresses have similar values as they are geographically similar. Accordingly, IP addresses of workplaces that share similar geographic locations may be similar.

In step 730, the server 200 calculates a second suspicious transaction ratio of the target user based on the suspicious IP address group. A method of calculating the second suspicious transaction ratio will be described in detail with reference to FIG. 8 below.

Step 380 described above with reference to FIG. 3 may include step 740.

In step 740, when the calculated second suspicious transaction ratio is equal to or greater than a preset second threshold ratio, the server 200 determines the target user account as an illegal user account. That is, if the first suspicious transaction ratio is greater than or equal to the first threshold ratio (satisfied with the creation time condition), and the second suspicious transaction ratio is equal to or greater than the second threshold ratio (the geographic condition is satisfied), Can be determined. The second threshold ratio may be adjusted by the administrator of the server 200. For example, the second threshold ratio may be smaller than the first threshold ratio.

8 illustrates a target user account and transaction details between a plurality of user accounts according to another example.

The server 200 may acquire the target user account 810 and a plurality of IP addresses of the plurality of user accounts 820, 830, and 840 having a transaction history. The first candidate user account 820 may transact with the target user account 810 using the first IP address 822 and the second IP address 824. The second candidate user account 830 may transact with the target user account 810 using the third IP address 832 and the fourth IP address 834. The third candidate user account 840 may transact with the target user account 810 using the fifth IP address 842. For example, since the first IP address 822 and the fifth address 832 have the same C class of the IP address, the suspicious IP address group may include the first IP address 822 and the fifth address 832. I can.

In the above embodiment, the total number of transactions made by the target user account 810 with the plurality of user accounts 820, 830, 840 is 28, of which the number of transactions with the suspected IP address group is 15. . Accordingly, the second suspicious transaction ratio may be calculated as 15/28=0.54. For example, when the second threshold ratio is set to 0.5, the target user account whose second suspicious transaction ratio is 0.54 is determined as an illegal user account.

3 to 8 described above are an embodiment of a method for determining an illegal user account based on the creation time of the user account, and FIGS. 9 and 10 are examples of determining an illegal user account based on an IP address. This is an example of the method.

9 is a block diagram of a server for determining an illegal user according to another exemplary embodiment.

The steps 910 to 980 below are performed by the server 200 described above with reference to FIGS. 3 to 8.

In step 910, the server 200 receives the transaction record of the exchange. For example, the transaction record may be content that has been traded through an exchange during a preset period. The transaction record may include information of a seller, information of a buyer, and information of an item for sale.

In step 920, the server 200 determines a target user account among the user accounts shown in the transaction record. For example, one of the user accounts that are sellers may be determined as the target user account. Any one of the user accounts having a transaction record within a preset time may be determined as the target user account.

In step 930, the server 200 determines a plurality of user accounts having records of transactions with the target user account. That is, user accounts that purchase items sold by the target user account may be determined.

In step 940, the server 200 acquires a plurality of IP addresses used by each of the plurality of user accounts during a transaction. One user account can also access the server 200 using two or more IP addresses. Even in this case, individual IP addresses can be obtained.

In step 950, the server 200 sets IP addresses within a preset range among the plurality of IP addresses as a suspicious IP address group. For example, an IP address within a preset range may be the same C class of IP addresses. In general, IP addresses have similar values as they are geographically similar. Accordingly, IP addresses of workplaces that share similar geographic locations may be similar.

In step 960, the server 200 calculates a second suspicious transaction ratio of the target user based on the suspicious IP address group.

In step 970, the server 200 determines whether the second suspicious transaction ratio is greater than or equal to the second threshold ratio.

In step 980, when the second suspicious transaction ratio is greater than or equal to the second threshold ratio, the server 200 determines the target user account as an illegal user account. For example, a fraudulent user account may be referred to as a banker, and a user account using an IP address in a suspicious IP address group may be referred to as a farmer.

10 is a flowchart of a method of determining an illegal user account based on a user account creation time according to an example.

The steps 1010 to 1030 below may be performed in parallel with the steps 940 to 970 described above with reference to FIG. 9.

In step 1010, the server 200 determines a first candidate user account from among the plurality of user accounts based on the creation time of the target user account. A detailed description of step 1010 may be replaced with a description of step 340 of FIG. 3.

In step 1020, the server 200 registers the first candidate user account with the suspicious user group. The suspicious user group may include a plurality of candidate user accounts.

In step 1030, the server 200 calculates a first suspicious transaction ratio of the target user account based on the suspicious user group. A detailed description of step 1030 may be replaced with a description of step 360 of FIG. 3.

Step 980 described above with reference to FIG. 9 may include step 1040.

In step 1040, the server 200 determines the target user account as an illegal user account when the calculated first suspicious transaction ratio is greater than or equal to a preset first threshold ratio. That is, if the second suspicious transaction ratio is greater than or equal to the second threshold ratio (satisfying a geographic condition), and the first suspicious transaction ratio is greater than or equal to the first critical ratio (satisfying the creation time condition), the target user account is an illegal user account Can be determined. The first threshold ratio may be adjusted by the administrator of the server 200. For example, the second threshold ratio may be smaller than the first threshold ratio.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -A hardware device specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those produced by a compiler but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operation of the embodiment, and vice versa.

The software may include a computer program, code, instructions, or a combination of one or more of these, configuring the processing unit to behave as desired or processed independently or collectively. You can command the device. Software and/or data may be interpreted by a processing device or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or may be permanently or temporarily embodyed in a transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

As described above, although the embodiments have been described by the limited drawings, a person of ordinary skill in the art can apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order from the described method, and/or components such as a system, structure, device, circuit, etc. described are combined or combined in a form different from the described method, or other components Alternatively, even if substituted or substituted by an equivalent, an appropriate result can be achieved.

Therefore, other implementations, other embodiments and claims and equivalents fall within the scope of the following claims.

200: server
210: communication department
220: processor
230: memory

Claims (25)

The fraudulent user account determination method performed by the server,
Determining a target user account;
Determining a plurality of user accounts having records of transactions with the target user account;
Sorting the plurality of user accounts based on the creation time of each of the plurality of user accounts;
Determining a first candidate user account from among the plurality of user accounts based on the sorted generation time of the target user account;
Registering the first candidate user account with a suspicious user group;
Determining a second candidate user account adjacent to the first candidate user account based on the creation time of the first candidate user account;
Registering the second candidate user account with the suspicious user group;
Calculating a first suspicious transaction ratio representing the number of transactions with candidate user accounts registered in the suspicious user group among the total number of transactions by the target user account;
Obtaining a plurality of Internet Protocol (IP) addresses used by each of the plurality of user accounts during a transaction;
Setting IP addresses within a preset range among the plurality of IP addresses as a suspicious IP address group;
Calculating a second suspicious transaction ratio representing the number of transactions with IP addresses set in the suspicious IP address group among the total number of transactions by the target user account; And
If the calculated first suspicious transaction ratio is greater than or equal to a preset first threshold ratio, and the calculated second suspicious transaction ratio is greater than or equal to a second preset threshold ratio, determining the target user account as an illegal user account-the The second critical ratio is less than or equal to the first critical ratio-
Containing,
How to determine fraudulent user accounts.
The method of claim 1,
The step of determining the target user account,
Determining any one of the user accounts having a transaction record within a preset time as the target user account
Containing,
How to determine fraudulent user accounts.
The method of claim 1,
The step of determining a first candidate user account from among the plurality of user accounts,
Calculating a difference between the creation time of each of the plurality of user accounts and the creation time of the target user account; And
Determining the first candidate user account whose calculated difference is less than a first threshold value
Containing,
How to determine fraudulent user accounts.
delete delete delete The method of claim 1,
IP addresses within the preset range are the same C class of IP addresses,
How to determine fraudulent user accounts.
delete A computer-readable recording medium containing a program for performing the method of any one of claims 1, 2, 3, and 7.
The server that determines the fraudulent user account,
A memory in which a program for determining an illegal user account is recorded; And
Processor that executes the above program
Including,
The above program,
Determining a target user account;
Determining a plurality of user accounts having records of transactions with the target user account;
Sorting the plurality of user accounts based on the creation time of each of the plurality of user accounts;
Determining a first candidate user account from among the plurality of user accounts based on the sorted generation time of the target user account;
Registering the first candidate user account with a suspicious user group;
Determining a second candidate user account adjacent to the first candidate user account based on the creation time of the first candidate user account;
Registering the second candidate user account with the suspicious user group;
Calculating a first suspicious transaction ratio representing the number of transactions with candidate user accounts registered in the suspicious user group among the total number of transactions by the target user account;
Obtaining a plurality of Internet Protocol (IP) addresses used by each of the plurality of user accounts during a transaction;
Setting IP addresses within a preset range among the plurality of IP addresses as a suspicious IP address group;
Calculating a second suspicious transaction ratio representing the number of transactions with IP addresses set in the suspicious IP address group among the total number of transactions by the target user account; And
If the calculated first suspicious transaction ratio is greater than or equal to a preset first threshold ratio, and the calculated second suspicious transaction ratio is greater than or equal to a second preset threshold ratio, determining the target user account as an illegal user account-the The second critical ratio is less than or equal to the first critical ratio-
To do,
server.
The method of claim 10,
The step of determining the target user account,
Determining any one of the user accounts having a transaction record within a preset time as the target user account
Containing,
server.
The method of claim 10,
The step of determining a first candidate user account from among the plurality of user accounts,
Calculating a difference between the creation time of each of the plurality of user accounts and the creation time of the target user account; And
Determining the first candidate user account whose calculated difference is less than a first threshold value
Containing,
server.
delete delete delete delete delete delete delete delete delete delete delete delete delete

Images