KR102448431B1 - Method and apparatus for detecting abnormal events - Google Patents

Abstract

A method for abnormal event detection is disclosed.
According to an embodiment, a method for detecting an abnormal event includes processing reference data that has occurred in the past to determine a regression model; detecting an abnormal event by using a confidence interval between actual data to be detected and predicted data predicted from the regression model; and detecting an abnormal event by using an accumulated value of a difference between the predicted data and the actual data.

Description

Abnormal event detection method and device {METHOD AND APPARATUS FOR DETECTING ABNORMAL EVENTS}

The following embodiments relate to a method for detecting an abnormal event and an apparatus using the methods.

When operating a game service, abusing such as bugs used by game users may occur. In this case, the goods in the game will increase abnormally and rapidly, which may have a fatal impact on the game service.

In general, the game service operator monitors the occurrence of abnormal events with respect to major indices in the game in order to prevent abusing from occurring. Since abnormal events occur very rarely in terms of probability, it may be inefficient in terms of time and money for operators of game services to monitor various indicators in real time. Accordingly, a technology for automatically detecting an abnormal event without continuous monitoring by an operator of a game service is required.

A method for detecting an abnormal event according to an embodiment may include: determining a regression model by processing reference data that has occurred in the past; detecting an abnormal event by using a confidence interval between actual data to be detected and predicted data predicted from the regression model; and detecting an abnormal event by using an accumulated value of a difference between the real data and the predicted data.

The determining of the regression model according to an embodiment may include: extracting period information indicating the periodicity of the reference data, event information affecting the increase or decrease of the reference data, and trend information indicating a trend of the reference data; and regression-analyzing the variation pattern of the reference data based on the period information, event information, and trend information.

The detecting of the abnormal event using the confidence interval according to an embodiment may include: determining a confidence interval of the prediction data; and detecting whether the actual data deviates from the confidence interval.

The abnormal event detection method according to an embodiment may further include delivering a notification to a user when a preset condition is satisfied for the occurrence of the abnormal event.

The detecting of the abnormal event using the accumulated value according to an embodiment may include: determining an accumulated value of a difference between the real data and the predicted data; and transmitting a notification to the user when the absolute value of the average of the accumulated values exceeds a preset threshold value.

An abnormal event detection method according to an embodiment may include, when the abnormal event occurs, analyzing a cause of the occurrence of the abnormal event; and updating the regression model when the cause is due to an error in the regression model.

An apparatus for detecting an abnormal event according to an embodiment includes a processor, wherein the processor determines a regression model by processing reference data that has occurred in the past, and predicts from actual data to be detected as an abnormal event and the regression model An abnormal event may be detected using the confidence interval of the predicted data, and the abnormal event may be detected using an accumulated value of a difference between the actual data and the prediction data.

The processor according to an embodiment extracts period information indicating the periodicity of the reference data, event information affecting the increase or decrease of the reference data, and trend information indicating a trend of the reference data, the period information and the event information and a regression analysis of the variation pattern of the reference data based on the trend information.

The processor according to an embodiment may determine a confidence interval of the prediction data and detect whether the actual data deviates from the confidence interval.

The processor according to an embodiment may deliver a notification to the user when a preset condition is satisfied for the occurrence of the abnormal event.

The processor according to an embodiment may determine an accumulated value of a difference between the actual data and the predicted data, and transmit a notification to the user when the absolute value of the average of the accumulated values exceeds a preset threshold value .

When the abnormal event occurs, the processor may analyze a cause of the occurrence of the abnormal event, and if the cause is due to an error in the regression model, update the regression model.

1 is a diagram illustrating an apparatus for detecting an abnormal event according to an exemplary embodiment.
2 is a flowchart illustrating an abnormal event detection method according to an exemplary embodiment.
3 is a diagram illustrating a process of generating a regression model and predicting through the regression model according to an exemplary embodiment.
4 is a diagram illustrating a method of detecting an abnormal event using a confidence interval of real data and predicted data according to an embodiment.
5 is a diagram illustrating a method of detecting an abnormal event using an accumulated value of a difference between real data and predicted data according to an exemplary embodiment.

Specific structural or functional descriptions of the embodiments are disclosed for purposes of illustration only, and may be changed and implemented in various forms. Accordingly, the embodiments are not limited to a specific disclosure form, and the scope of the present specification includes changes, equivalents, or substitutes included in the technical spirit.

Although terms such as first or second may be used to describe various elements, these terms should be interpreted only for the purpose of distinguishing one element from another. For example, a first component may be termed a second component, and similarly, a second component may also be termed a first component.

When a component is referred to as being “connected” to another component, it may be directly connected or connected to the other component, but it should be understood that another component may exist in between.

The singular expression includes the plural expression unless the context clearly dictates otherwise. In this specification, terms such as "comprise" or "have" are intended to designate that the described feature, number, step, operation, component, part, or combination thereof exists, and includes one or more other features or numbers, It should be understood that the possibility of the presence or addition of steps, operations, components, parts or combinations thereof is not precluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related art, and should not be interpreted in an ideal or excessively formal meaning unless explicitly defined in the present specification. does not

In the present specification, a user is a subject providing a game service, and may include, for example, an operator of the game service. A user in the game service is a player who is provided with the game service and uses the game service.

Abnormal events are not events that occur due to causes such as changes in the contents of the game service, changes in the user's game service settings, such as changes in the marketing strategy of the game service, or changes in the user's play pattern within the game service, such as user's bugs in the game service, etc. This is an event that occurs by abusing using

The reference data may be data generated in the past in relation to a specific indicator in the game service. Here, the specific indices in the game service according to an embodiment may include in-game goods such as in-game currency and items. In addition, the actual data is data that is actually generated after the reference data in relation to a specific indicator in the game service, and may be data that is a target of abnormal event detection.

1 may be a diagram illustrating an apparatus for detecting an abnormal event according to an embodiment.

Referring to FIG. 1 , the abnormal event detecting apparatus 100 may include a processor for detecting an abnormal event. The processor of the abnormal event detection apparatus 100 may be implemented as a software module, a hardware module, or a combination thereof.

The abnormal event detection apparatus 100 may receive data to detect the occurrence of an abnormal event. Data input to the abnormal event detection apparatus 100 may include reference data and actual data.

The processor of the abnormal event detection apparatus 100 may model a regression model for detecting an abnormal event by using data input to the abnormal event detection apparatus 100 . A regression model is a model to explain the tendency among given data, and the purpose is to find a central tendency that can explain the data.

The processor may determine whether an abnormal event occurs through the modeled regression model. And, when an abnormal event occurs, the processor may deliver a notification about the occurrence of the abnormal event to the user.

2 may be a flowchart illustrating an abnormal event detection method according to an embodiment.

In operation 200, the abnormal event detection apparatus 100 may receive data. In this case, the data may include reference data and actual data. The processor of the abnormal event detecting apparatus 100 may generate a regression model for detecting the abnormal event by processing the reference data.

More specifically, the processor may extract a plurality of pieces of information from the reference data. In this case, the plurality of pieces of information extracted from the reference data may include period information indicating the periodicity of the reference data, event information affecting the increase or decrease of the reference data, and trend information indicating the trend of the reference data. Then, the processor may generate a regression model for detecting an abnormal event by regression-analyzing a variation pattern of the reference data using the extracted period information, event information, and trend information.

The processor may generate prediction data for abnormal event detection through a regression model generated using a plurality of pieces of information extracted from reference data. Here, the prediction data may be a prediction value for actual data to be generated after the reference data.

In operation 201 , the processor may perform primary detection of whether an abnormal event has occurred by using the confidence interval of the prediction data generated through the regression model in operation 200 .

The processor may determine a confidence interval of the prediction data and compare the actual data and the prediction data. In addition, the processor may detect whether the actual data includes a value out of the confidence interval of the prediction data as a result of comparing the actual data and the prediction data. In this case, when the actual data includes a value that is out of the confidence interval of the prediction data, the processor may determine the corresponding actual data value to be abnormal, and determine the event causing the generation of the abnormal real data as the abnormal event.

The primary detection performed by the processor in operation 201 can be applied to a case in which a specific indicator in the game service rapidly changes due to an abnormal event, but due to abusing by a small number of game users in the game service, a specific indicator in the game service In the case where is a gradual change without a sudden change, there may be a limit to the detection of an abnormal event. Accordingly, in addition to the primary detection of the abnormal event performed in operation 201 , the processor may perform secondary detection of the abnormal event through operation 202 .

In operation 202, the processor performs secondary detection of whether an abnormal event occurs by using the accumulated value of the difference between the actual data that actually occurred in the game service in operation 200 and the predicted data generated through the regression model in operation 200 can do.

The processor may determine a difference between the actual data and the predicted data. In addition, the processor may detect whether the average of the accumulated values of the determined differences is greater than or equal to a predetermined scale. In this case, when the accumulated value of the difference between the real data and the predicted data is equal to or greater than a certain scale, the processor may determine that an abnormal event has occurred in the corresponding real data.

In operation 203 , the processor may deliver a notification about the occurrence of the abnormal event to the user.

When the occurrence of the abnormal event is detected by at least one of the primary detection and the secondary detection, the processor may deliver a notification of the occurrence of the abnormal event to the user.

In particular, when the occurrence of an abnormal event is detected through the primary detection, the processor may deliver a notification to the user when the occurrence of the abnormal event satisfies a preset condition in order to prevent frequent notifications from occurring due to a detection error. .

In operation 204, the processor may analyze the cause of occurrence of the abnormal event detected by at least one of the primary detection and the secondary detection to determine whether the detected abnormal event is caused by a user's abusing in the game service. .

In operation 205 , the processor may determine whether to update the regression model generated in operation 200 by referring to the cause of the occurrence of the abnormal event.

More specifically, when the cause of the occurrence of the abnormal event analyzed in operation 204 is not user abusing in the game service, the processor may determine to update the regression model modeled in operation 200 . For example, if an abnormal event occurs due to content in the game service, marketing strategy of the game service, or a change in the user's play pattern in the game service, not the user's abusing in the game service, the processor reflects the cause of the occurrence and builds a regression model You can decide to update.

3 is a diagram illustrating a process of generating a regression model and predicting through the regression model according to an exemplary embodiment.

Referring to FIG. 3 , the processor of the abnormal event detection apparatus 100 may model a regression model for abnormal event detection. In addition, the processor may generate prediction data for the increase/decrease amount of the in-game indicator using the modeled regression model, and detect an abnormal event using the generated prediction data. The processor may repeatedly perform the above process in order to continuously monitor the occurrence of abnormal events.

The abnormal event detection apparatus 100 may receive data on a game service, and the processor of the abnormal event detection apparatus 100 may store past data for a plurality of indices in the game service among the data received by the abnormal event detection apparatus 100 . Preprocessing can be performed on reference data containing information. In addition, the processor may generate a regression model for abnormal event detection using the preprocessed reference data.

More specifically, the processor may perform pre-processing on a specific indicator included in the reference data. For example, the processor may perform pre-processing on the goods in the game service in the format shown in Table 1 below.

change of goods date event variable 1 event variable 2 ... 123,456,789 2018-04-02 09:00:00 0 One ... 123,789,456 2018-04-02 10:00:00 0 0 ... 132,453,987 2018-04-02 11:00:00 One 0 ... ... ... One 0 ...

In addition, the processor may extract a plurality of pieces of information from the preprocessed reference data. At this time, the plurality of information includes period information indicating information about the time period such as day of the week and time zone, event information in the game service that affects the increase or decrease of goods (1 if an event occurs, 0 if no event occurs), goods may include trend information indicating an upward/downward trend of the overall increase/decrease of Here, the index and format in the game service in Table 1 are only examples, and the format of the index in the game service and the reference data preprocessed by the processor is not limited thereto.

The processor may generate a regression model for generating prediction data to be used for detection of an abnormal event by using the plurality of pieces of information extracted from the reference data. The processor can model the regression model using the time-windowing method. In this case, the period of Time-Windowing can be determined through the tuning process of a general regression model.

4 is a diagram illustrating a method of detecting an abnormal event using a confidence interval of real data and predicted data according to an embodiment.

The processor of the abnormal event detection apparatus 100 may simply determine a confidence interval of the prediction data generated through the regression model before detecting the abnormal event using the prediction data generated from the regression model. The processor may perform primary detection of whether an abnormal event has occurred in actual data actually generated within the game service using the set confidence interval. In addition, the processor may deliver a notification to the user when an abnormal event occurs in actual data as a result of the first detection. In addition, the processor may analyze the cause of the occurrence of the abnormal event to determine whether the regression model needs to be updated, and when the regression model needs to be updated, the processor may generate a new regression model updated from the existing regression model.

More specifically, prediction data is a set of point estimates generated through a regression model modeled using reference data, which is data that has occurred in the past. In this case, reliability may be compromised. Accordingly, the processor may determine a confidence interval of the prediction data generated through the regression model before simply detecting the abnormal event using the prediction data generated through the regression model. The processor may determine the upper limit of the prediction data and the lower limit of the prediction data based on the prediction data, and may determine the interval between the upper limit of the prediction data and the lower limit of the prediction data as the confidence interval.

The processor may determine whether an abnormal event occurs in the game service using the determined confidence interval. The processor may compare the actual data with the confidence interval, and when the actual data is within the confidence interval range of the prediction data, it may be determined that the abnormal event in the game service does not occur. However, when the actual data exists outside the confidence interval of the prediction data, such as the time point 400 , the processor may determine that abnormal data in the game service has occurred, and deliver a notification of the occurrence of the abnormal event to the user.

When the occurrence of the abnormal event is detected using the confidence interval of the prediction data, the processor may perform an additional process before delivering a notification of the occurrence of the abnormal event to the user.

When an abnormal event is detected using the confidence interval of the prediction data, the processor can determine that the abnormal event has occurred if the actual data value simply deviates from the confidence interval without determining how much the actual data value deviates from the confidence interval of the prediction data. . However, as mentioned above, since the prediction data was generated through a regression model modeled using reference data, which is data that occurred in the past, the confidence interval may not be perfect in detecting abnormal events. Accordingly, even though the abnormal event does not actually occur, an abnormal event may be detected due to an error, and thus, a notification about the occurrence of the abnormal event may be frequently delivered to the user.

In order to prevent such a case, the processor may deliver a notification to the user only when a preset condition is satisfied even if an abnormal event is detected. For example, the processor may transmit a notification to the user when an abnormal event is detected as many times as preset X times during preset N hours.

The processor may analyze a cause of the detected abnormal event and update the regression model based on the analyzed cause. Abnormal events may occur when the regression model is not updated in addition to the case where the user is abusing the game service.

For example, changes in content in game services such as adding core content in game services that occur on a specific day of the week, changes in marketing strategy of game services, such as irregular marketing promotions that affect the increase or decrease of goods in game services, or games When a change in a user's play pattern in the service occurs, period information, event information, or trend information of reference data used to model the regression model may be changed. However, when the reference data used to model the regression model does not include such information, the processor may falsely detect an abnormal event even though user abusing has not occurred in the game service.

Accordingly, the processor may analyze the cause of the occurrence of the detected abnormal event, and when the analyzed cause is due to a change in information about the game service, the processor may update the regression model based on the changed information.

5 is a diagram illustrating a method of detecting an abnormal event using an accumulated value of a difference between real data and predicted data according to an exemplary embodiment.

In the case of primary detection, in which the processor of the abnormal event detection apparatus 100 detects an abnormal event using a confidence interval of prediction data generated using a regression model, Detection is possible, but there may be a limit to detecting a gradual change in a specific indicator in the game service due to abusing by a small number of users in the game service.

Therefore, the processor uses the accumulated value of the difference between the actual data generated in the game service and the predicted data predicted using a regression model to detect a gradual change in a specific indicator in the game service due to the abusing of a small number of users in the game service. Secondary detection can be performed. The processor may deliver a notification to the user when an abnormal event occurs in actual data as a result of the secondary detection. The processor may determine whether the regression model needs to be updated by analyzing the cause of the occurrence of the abnormal event, and when the regression model needs to be updated, a new regression model updated from the existing regression model may be generated.

More specifically, the processor may calculate a difference between the actual data and the predicted data, and determine an absolute value of the calculated value. In addition, the processor may monitor the accumulated value of the absolute value of the difference between the actual data and the predicted data.

The processor may determine whether an abnormal event occurs in the game service by using the accumulated value of the absolute value of the difference between the actual data and the predicted data determined above. The processor may determine that an abnormal event in the game service does not occur when the accumulated value of the absolute value of the difference between the actual data and the predicted data maintains a normal distribution with an average of 0. However, when the accumulated value of the absolute value of the difference between the actual data and the predicted data forms a normal distribution skewed to one side, that is, when the average of the accumulated values is not 0 but has a value of a certain scale or more, the processor detects abnormal data in the game service. It can be determined that it has occurred and a reminder about the occurrence of the abnormal event can be delivered to the user.

The processor may analyze a cause of the detected abnormal event and update the regression model based on the analyzed cause. Abnormal events may occur when the regression model is not updated in addition to the case where the user is abusing the game service.

For example, changes in content in game services such as adding core content in game services that occur on a specific day of the week, changes in marketing strategy of game services, such as irregular marketing promotions that affect the increase or decrease of goods in game services, or games When a change in a user's play pattern in the service occurs, period information, event information, or trend information of reference data used to model the regression model may be changed. However, when the reference data used to model the regression model does not include such information, the processor may falsely detect an abnormal event even though user abusing has not occurred in the game service.

Accordingly, the processor may analyze the cause of the occurrence of the detected abnormal event, and when the analyzed cause is due to a change in information about the game service, the processor may update the regression model based on the changed information.

According to at least one of the above-described various embodiments, game creators in the game industry can increase the number of people who enjoy the game of their own creation by inducing and making the propagation of game contents, and can also add social elements to the game contents. . In addition, game players can share the experience of enjoyable game play with their acquaintances and make the subject matter, get help from others for areas that existing game players lack the ability to afford, and new game players can use the full-package game client software You can enjoy a fun game even if it is not installed, and you can make the full package software available easily or through a simple button by linking with new game player subscribers who have downloaded and executed the trial app.

The embodiments described above may be implemented by a hardware component, a software component, and/or a combination of a hardware component and a software component. For example, the apparatus, methods and components described in the embodiments may include, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate (FPGA). array), a programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose or special purpose computers. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For convenience of understanding, although one processing device is sometimes described as being used, one of ordinary skill in the art will recognize that the processing device includes a plurality of processing elements and/or a plurality of types of processing elements. It can be seen that may include For example, the processing device may include a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as parallel processors.

The software may comprise a computer program, code, instructions, or a combination of one or more thereof, which configures a processing device to operate as desired or is independently or collectively processed You can command the device. The software and/or data may be any kind of machine, component, physical device, virtual equipment, computer storage medium or device, to be interpreted by or to provide instructions or data to the processing device. , or may be permanently or temporarily embody in a transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and available to those skilled in the art of computer software. Examples of the computer-readable recording medium include magnetic media such as hard disks, floppy disks and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic such as floppy disks. - includes magneto-optical media, and hardware devices specially configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine language codes such as those generated by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described with reference to the limited drawings, various modifications and variations are possible from the above description by those of ordinary skill in the art. For example, the described techniques are performed in a different order than the described method, and/or the described components of the system, structure, apparatus, circuit, etc. are combined or combined in a different form than the described method, or other components Or substituted or substituted by equivalents may achieve an appropriate result. Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: abnormal event detection device

Claims (13)

determining a regression model by processing reference data that has occurred in the past in relation to a specific indicator in the game service;
detecting an abnormal event using a confidence interval of actual data that has actually occurred after the reference data and prediction data predicted from the regression model in relation to a specific indicator in the game service that is a target of the abnormal event detection; and
detecting an abnormal event by using an accumulated value of a difference between the real data and the predicted data;
including,
The abnormal event detection method is an abnormal event that is generated by abusing in the game service. According to claim 1,
The operation of determining the regression model is,
extracting period information indicating the periodicity of the reference data, event information affecting the increase or decrease of the reference data, and trend information indicating a trend of the reference data; and
regression-analyzing the fluctuation pattern of the reference data based on the period information, event information, and trend information;
Abnormal event detection method comprising. According to claim 1,
The operation of detecting an abnormal event using the confidence interval includes:
determining a confidence interval of the prediction data; and
detecting whether the actual data is outside the confidence interval;
Abnormal event detection method comprising. 4. The method of claim 3,
When a preset condition is satisfied with respect to the occurrence of the abnormal event, further comprising the operation of delivering a notification to the user,
The preset condition is a condition in which the abnormal event is detected a preset number of times during a preset time. According to claim 1,
The operation of detecting an abnormal event using the accumulated value includes:
determining an accumulated value of a difference between the real data and the predicted data; and
delivering a notification to a user when the absolute value of the average of the accumulated values exceeds a preset threshold;
Abnormal event detection method comprising. The method of claim 1
when the abnormal event occurs, analyzing a cause of the occurrence of the abnormal event; and
updating the regression model when the cause is due to an error in the regression model;
Abnormal event detection method further comprising. In the abnormal event detection device,
including a processor;
The processor is
Determining a regression model by processing reference data that occurred in the past with respect to a specific indicator within the game service;
Detecting an abnormal event using the confidence interval of the predicted data predicted from the regression model and the actual data that actually occurred after the reference data in relation to the specific indicator in the game service that is the target of the abnormal event detection,
Detecting an abnormal event using the accumulated value of the difference between the real data and the predicted data,
The abnormal event is an abnormal event that is an abnormal event generated by abusing in the game service. 8. The method of claim 7,
The processor is
extracting period information indicating the periodicity of the reference data, event information affecting the increase or decrease of the reference data, and trend information indicating the trend of the reference data;
Regression analysis of the fluctuation pattern of the reference data based on the period information, event information and trend information,
Anomaly event detection device. 8. The method of claim 7,
The processor is
determining a confidence interval of the prediction data;
detecting whether the actual data falls outside the confidence interval,
Anomaly event detection device. 10. The method of claim 9,
The processor is
When a preset condition is satisfied for the occurrence of the abnormal event, a notification is delivered to the user,
The preset condition is a condition in which a preset number of times the abnormal event is detected during a preset time period. 8. The method of claim 7,
The processor is
determining the cumulative value of the difference between the real data and the predicted data,
To deliver a notification to the user when the absolute value of the average of the accumulated values exceeds a preset threshold value,
Anomaly event detection device. 8. The method of claim 7,
The processor is
When the abnormal event occurs, the cause of the occurrence of the abnormal event is analyzed, and
If the cause is due to an error in the regression model, updating the regression model,
Anomaly event detection device. A computer-readable recording medium in which a program for executing the method of any one of claims 1 to 6 is recorded.

Images