KR20120080400A - Apparatus and method of detecting abnormal character in online game based on clustering technique - Google Patents

Abstract

PURPOSE: An abnormal character detection system and a method thereof within online game using clustering technique are provided to practically control the bot accounts within workplace, by extracting a bot program and the accounts associated with bot accounts. CONSTITUTION: A log storage unit(110) stores an activity as a log within online game of a player character. A log analysis unit(120) analyzes the log and understands a dealing act among player characters on online game. A clustering unit(140) grants weighted values to an edge of generated graph by a determined standard in advance.

Description

System and method for detecting abnormal characters in online game using clustering technique {APPARATUS AND METHOD OF DETECTING ABNORMAL CHARACTER IN ONLINE GAME BASED ON CLUSTERING TECHNIQUE}

The present invention relates to a method for detecting so-called workplaces that collectively use bot programs to benefit by collecting and selling items or game money for online games to general gamers.

In general, in the case of MMORPG (Massively Multiplayer Online Role Playing Game), gamers manipulate the player character in the online game to proceed with the game, and acquire an item or pay the game money during the game play to play the non-player NPC (Non Player Character). Also buy from).

Game money, which is a currency used in items and games, not only facilitates the progress of online games, but also adds to the enjoyment of the game, and in the case of some popular MMORPGs, gamers buy rare items or game money. Buying and selling cash for each other can happen.

On the other hand, as these items or game money is frequently made cash transactions, the bot (BOT) program that automatically collects items or game money is on the rise.

There are several types of bot programs, but most of them detect the patterns of bot programs by installing security programs on the client side.

However, recently, as shown conceptually in Figure 1 is equipped with a large number of personal computers (PC) to run a bot program collectively by collecting items or game money in large quantities to sell to general gamers so-called profits Workshops have emerged.

These workplaces usually purchase and use unknown bot programs, which are not easily detected using security programs.

In addition, even if it is difficult to obtain patterns of bot programs, detect accounts that run bot programs through security programs, and block sanctions such as those, the items or game money are collected from the bot accounts due to the nature of the workplace. Accounts are not subject to any sanctions, so you can easily create new accounts to run the bot program at any time and resume operation.

Therefore, simply detecting a bot program has limitations in fully identifying workplace accounts that interfere with the normal operation of online games, and identifying all accounts belonging to the workplace, including accounts that do not run bot programs. A new approach is needed.

The present invention has been made to solve the above-mentioned problems of the prior art, and collects items or game money by detecting accounts having a certain relationship with bot accounts in parallel with the detection of a bot program, and substantially reduces bot accounts in the workplace. Its purpose is to provide a way to identify key accounts of the workplaces it controls.

Abnormal character detection system in the online game using the clustering technique of the present invention for achieving the above object is a log storage means for storing the activity in the online game of the player character as a log;

Log analysis means for grasping the transaction behavior between the player characters in the online game by analyzing the log;

Graph generating means for generating a graph with a player character as a node and an edge between transactions between players; And

And clustering means for respectively weighting the edges of the generated graph by a predetermined criterion and dividing the set of nodes connected by the effective edges whose weight exceeds a threshold into clusters.

In this case, the graph generating means uses the divided clusters as nodes, and calculates the weights assigned to the transaction behavior of the nodes belonging to one cluster and the nodes belonging to the other cluster by using a predetermined formula as an edge. Update the graph,

The clustering means is characterized in that extending the clusters connected to the effective edges above the threshold among the edges connecting the clusters into one cluster.

On the other hand, the abnormal character detection method in the online game using the clustering technique of the present invention for achieving the above object is to receive the activity log of the player character's online game from the online game server to grasp the transaction behavior between the player characters 110 step;

Generating a graph in which a player character is used as a node and each player's transaction behavior is an edge;

Step 130, each weighting an edge of the generated graph according to a predetermined criterion;

A step 140 for dividing a set of nodes each connected to valid edges whose weight exceeds a threshold into clusters;

A step 150 of updating the graph by using the divided clusters as nodes and using edges of the weights assigned to the trading behaviors of the nodes belonging to one cluster and the nodes belonging to the other cluster by using a predetermined formula; ; And

And in step 150, expanding the clusters connected to the valid edges exceeding a threshold among the edges connecting the clusters into one cluster.

According to the present invention, it is possible to identify accounts belonging to the workplace but the bot is not detected. In particular, it is possible to identify the accounts that collect items or kina without running the bot program, and to impose certain sanctions on these accounts according to the terms.

This can effectively neutralize the entire workplace, taking unfair financial gain from good gamers and disrupting online game operations.

1 is a reference diagram illustrating the concept of a workplace,
2 is a functional block diagram illustrating a configuration of an abnormal character detection system in an online game using a clustering technique according to the present invention.
3 is a reference diagram illustrating a graph in which a character is a node and an inter-character trading behavior is an edge.
4 is a reference diagram conceptually illustrating a process of clustering,
5 is a reference diagram conceptually illustrating a process of expanding a cluster.
6 is a flowchart illustrating a method of detecting an abnormal character in an online game using a clustering technique according to the present invention.

Hereinafter, a structure of an abnormal character detection system in an online game using a clustering technique according to the present invention will be described in detail with reference to the accompanying drawings.

As shown in FIG. 1, gamers access an online game server using a game client installed on a PC to play an online game. Some of them may be workshops that run bot programs as shown in FIG.

On the other hand, for most MMOPRGs, the online game server stores a log containing the activity of the player character. Analyze the log post-mortem situation such that a particular player character attacked a mob at a certain coordinate value in the game, acquired an item, interacted with an NPC, or exchanged an item or game money with another player character. It can be seen.

The abnormal character detection system 100 in the online game using the clustering technique according to the present invention may be implemented in such an online game server. In general, an online game server is not necessarily composed of a single physical server, and can be divided into a server that is responsible for simultaneous access of a plurality of clients and a server that stores logs. Therefore, abnormal characters in an online game using the clustering technique according to the present invention. Detection system 100 also does not necessarily have to be implemented in a physically single server.

On the other hand, the abnormal character detection system 100 in the online game using the clustering method according to the present invention, as shown in Figure 2 log storage means 110, log analysis means 120, graph generating means 130, clustering Means 140 and workplace determining means 150 are provided.

The log storage means 110 stores at least the in-game activities of the player character in the log as a conventional online game server. Of course, the log may contain anything other than the activities of the player characters.

On the other hand, the log analysis means 120 analyzes the log stored in this way to determine the transaction behavior between the player characters in the online game.

In this case, the transaction activity that can be analyzed by the log is not limited to the one performed in the "online game", and the "transaction activity" means that two player characters face each other directly at a specific location in the online game to exchange items or game money. It is not limited to the act of donating, but one-sided offering or exchange of items or game money using means provided in the online game for exchanging items or game money between player characters (for example, a note or mail), etc. Includes acts of In addition, the wide-ranging transaction includes storing or withdrawing in an in-game warehouse provided for guild members in an online game to store or withdraw items or games money for public use.

The log analysis unit 120 analyzes the log to identify the activities included in such a broad transaction. Preferably, it identifies which player character there was a trading activity, and the kind of trading behavior and what the trading object was. At this time, the number of transactions between specific player characters may be accumulated and counted.

On the other hand, the graph generating means 130 generates a graph using a player character as a node and a transaction between each player as an edge using the log analysis result.

According to the graph shown in FIG. 3, it can be seen that each node is displayed with a weight of the transaction behavior between the characters whose edges are characters, and the number of transactions in the example of FIG. 3. The graph, which is a data structure composed of nodes and edges, is created in memory or local storage, but may be visually represented as illustrated in FIG. 3 so that an online game server manager can check the monitor.

The clustering means 140 generates or expands a cluster by performing a predetermined operation on the graph thus generated.

Looking at the process of creating a cluster with reference to Figure 4 as follows. First, the clustering means 140 weights the edges of the graph generated as shown in FIG. 4A by predetermined criteria.

As the weight, the transaction amount and the transaction volume can be used, but when the number of transactions is weighted, a reliable result can be obtained. Because of the nature of the workplace, similar content transactions occur frequently between specific characters, while the likelihood of recurring similar transactions among most individual gamers is very low. In the example of FIG. 3, the number of transactions, which is a natural value, is given as a weight without any modification.

Thereafter, the effective edges are selected as shown in FIG. Edges whose weight exceeds a threshold can be determined as valid edges. For example, when the number of transactions itself is a weight, when the threshold is set to 10, only characters having a number of transactions more than 10 times are connected by the valid edges.

Edges indicated by solid lines in FIG. 4B are valid edges, and nodes connected by the valid edges are divided into clusters.

As shown in (c) of FIG. 4, clusters surrounded by circles are generated for the convenience of one each of up, down, left, and right. The meaning of a cluster is that all the transactions belonging to the cluster with at least one character belonging to the same cluster exceed a predetermined reference value when numerically represented by a certain criterion.

On the other hand, when the cluster is generated in this way, the graph generating means 130 uses the conventional clusters as nodes as shown in FIG. Update to the graph set to the edge.

The inter-cluster trading behavior refers to a calculation of a trading behavior between each character belonging to one cluster and each character belonging to another cluster by a predetermined formula.

For example, when the weight given to the edge connecting two characters as shown in FIG. 4 is the number of transactions between characters that are natural values, the weight given to the edge connecting two clusters as shown in FIG. The weight may be the sum of the number of transactions between characters.

On the other hand, the clustering means 140 selects the effective edge among the edges connecting each cluster as shown in (a) of FIG. 5, and clusters connected by the effective edge as shown in (b) of FIG. Combine into one cluster.

This is because the trade is mainly focused on specific characters belonging to the workplace due to the division of work. Therefore, only the first clustering detects only some accounts belonging to the workplace.

Therefore, even if the association (weight of the edge) is not sufficiently found by the character's transaction behavior characteristics, if the association is determined to be sufficient as a result of analyzing the entire transaction behavior between the cluster and the cluster, the entirety is expanded to one cluster. Characters belonging to the workplace can be detected without exception.

On the other hand, the abnormal character detection system 100 in an online game using the clustering technique corresponds to a case where the number of nodes in the divided or expanded clusters exceeds a predetermined value or the ratio of nodes determined as bots exceeds a threshold. The workplace determination means 150 for determining the cluster as the workplace may be further provided.

For example, if the number of nodes is less than 10, it can be judged that the transaction was frequently happening by gamers with friends, or in the workplace, most PCs run bots except for some accounts. In general, if less than 50% of the nodes are considered to be bots, it may be unreasonable to judge them as the workplace. It is a matter of course that the determination of whether each node has driven the bot program should be made separately from the present invention.

On the other hand, after the classification or expansion of the cluster through the graph operation as described above or the determination of the workplace by the workplace determination means 150 is completed, the graph generation means 130 is a graph so that the game server administrator can check through the monitor Visually, the range of the cluster may be displayed, or the name of the character, the information of the account to which the character belongs, the number of transactions at the edge, information about the traded goods, etc. may be displayed.

As a result, it is possible to visually check at a glance how far the online game account belonging to the workplace and the transaction (presumed to be a cash transaction) between the character belonging to the workplace and the non-cluster character.

In particular, it may be suspected that a character belonging to the cluster determined to be the workplace used a private bot which cannot be detected if the bot is not detected, or the core account of the workplace collecting items or money from the bot account.

Meanwhile, referring to FIG. 6, a method of detecting abnormal characters in an online game using a clustering method according to the present invention will be described in time series.

As shown in FIG. 6, first, an abnormal character detection system 100 in an online game using a clustering technique implemented in an online game server receives and analyzes an activity log of a player character's online game from an online game server. The transaction behavior between the player characters is grasped (S110). That is, transactions with NPCs such as player characters paying game money and purchasing items in stores in online games are excluded from the analysis.

On the other hand, the trading action includes not only the two player characters meeting each other at a specific position in the online game to exchange items or game money, but also providing items or game money to another player character by a message or other means in the online game, In the online gain, it is desirable to analyze all items including storing and earning items or game money in a space such as a warehouse that can be used jointly by the guild members.

Using the log analysis result, a graph is generated in which a player character is a node, and a transaction behavior between each player is an edge (S120), and weights are assigned to edges of the generated graph according to a predetermined criterion (S130). .

In this case, as the weight, for example, the number of transactions between two nodes-that is, between two player characters-can be given as it is or modified by a certain formula.

On the other hand, if the weight is given in this manner, as shown in (b) of FIG. 4, the valid edges whose weight is out of the threshold are selected, and a set of nodes connected by the valid edges as shown in (c) of FIG. 4. Each is divided into clusters (S140).

When the clusters are divided in this way, each cluster is a node, and the graph is updated with the inter-cluster trading behavior as an edge (S150). The transaction behavior between two clusters can be calculated by assigning a value calculated by a predetermined formula to the transaction behavior between nodes belonging to both clusters, or simply adding up the number of transactions between nodes. (S150).

As shown in (c) of FIG. 5, clusters connected to the valid edges are selected from the edges connecting the clusters to select valid edges whose weight is out of the threshold and connected to the valid edge. Expand by combining with (S160).

On the other hand, if the cluster is divided or expanded in this way it can be determined as a workplace. However, in order to further improve accuracy, a limit may be placed on the minimum value of the number of nodes belonging to the cluster or the ratio of the nodes determined to be bots among the nodes belonging to the cluster.

For example, when there are 10 or more nodes or the percentage of nodes determined as bots is 50% or more, the cluster may be finally determined as a workplace (S170).

On the other hand, if a cluster is divided or expanded in this way, or a specific cluster is determined as a workplace, the cluster determined as a workplace, characters belonging to the cluster, and transaction information between characters are visually displayed so that an administrator of the online game server can easily check. It may be displayed (S180).

The abnormal character detection method in the online game using the clustering technique as described above may be manufactured in the form of a computer program, and may be stored in a computer-readable recording medium and executed in the online game server.

While the present invention has been described with reference to several embodiments, these embodiments have been disclosed for purposes of illustration, and those skilled in the art will be able to make various modifications, changes, and additions within the spirit and scope of the present invention. This is to be construed as not departing from the scope of the following claims.

110: log storage means
120: log analysis means
130: graph generation means
140: clustering means
150: workplace judgment means

Claims (17)

Log storage means for storing an online game activity of a player character as a log;
Log analysis means for grasping the transaction behavior between the player characters in the online game by analyzing the log;
Graph generating means for generating a graph with a player character as a node and an edge between transactions between players; And
Clustering means for assigning weights to edges of the graph based on a predetermined criterion and dividing a set of nodes connected to valid edges whose weight is outside a threshold into clusters, respectively. Abnormal character detection system in online game using.
The method of claim 1,
The graph generating means uses the divided clusters as nodes, and calculates the graphs by using the edge values of the weights assigned to the transaction behavior of the nodes belonging to one cluster and the nodes belonging to the other cluster as edges. Update it,
And the clustering means extends the clusters connected to valid edges out of a threshold among the edges connecting the clusters into one cluster.
The method according to claim 1 or 2,
The clustering means weighted to the edge is an abnormal character detection system in the online game using a clustering technique, characterized in that the value is proportional to the number of transactions between each node.
The method of claim 2,
The graph generating means is an abnormality in the online game using the clustering technique, characterized in that for updating the graph with the edge value of the sum of the weights assigned to the transaction behavior of the nodes belonging to one cluster and the other cluster. Character Detection System.
The method according to claim 1 or 2,
Workshop determination means for determining the nodes belonging to the cluster of the number of nodes out of the threshold as a character belonging to the same workplace; abnormal character detection system in the online game using a clustering technique characterized in that it further comprises.
The method according to claim 1 or 2,
And workplace determination means for determining nodes belonging to a cluster having a certain ratio as a bot as a character belonging to the same workplace.
The method of claim 1,
The log analyzing means may exchange items or game money between player characters in an online game from a log, or any one player character provides an item or game money to another player character in an online game, or An abnormal character detection system in an online game using a clustering technique, characterized in that the above-mentioned character grasps an act of storing or withdrawing an item or game money in a space within an online game accessible to the character, and determines this as a transaction between characters.
The method according to claim 1 or 2,
The graph generating means visually displays the graph after the clustering or expansion of the cluster is completed by the clustering means, wherein the name of the character in the node, the information of the account to which the character belongs, the number of transaction actions at the edge, and the information about the traded goods. An abnormal character detection system in an online game using a clustering technique, characterized by displaying one or more of them.
A step (110) of receiving an activity log of an online game of a player character from an online game server to identify a transaction behavior between the player characters;
Generating a graph in which a player character is used as a node and each player's transaction behavior is an edge;
Step 130, each weighting an edge of the generated graph according to a predetermined criterion; And
And a step (140) of dividing the set of nodes connected to the valid edges whose weight is out of the threshold into clusters, respectively.
The method of claim 9,
A step 150 of updating the graph by using the divided clusters as nodes and using edges of the weights assigned to the trading behaviors of the nodes belonging to one cluster and the nodes belonging to the other cluster by using a predetermined formula; ;
In step 150, expanding the clusters connected to the valid edges having a value out of the threshold among the edges connecting the clusters to one cluster; abnormality in the online game using the clustering technique further comprising: Character detection method.
11. The method according to claim 9 or 10,
The abnormal character detection method in the online game using the clustering technique, characterized in that the weighting in proportion to the number of transactions between each node in step 130.
11. The method of claim 10,
The abnormality in the online game using the clustering technique, wherein in step 150, the graph is updated with the edges of the sums of the weights assigned to the transaction behaviors of the nodes belonging to one cluster and the nodes belonging to the other cluster. Character detection method.
11. The method according to claim 9 or 10,
And a step 170 for determining nodes belonging to the cluster whose number of nodes deviates from a threshold value as characters belonging to the same workplace. The abnormal character detection method in the online game using the clustering technique further comprises.
11. The method according to claim 9 or 10,
And a step 170, in which the node determined as the bot determines nodes belonging to a cluster having a predetermined ratio as a character belonging to the same workplace. The method of claim 2, further comprising: a method for detecting abnormal characters in an online game using a clustering technique.
The method of claim 9,
In step 110, an item or game money is exchanged between player characters in an online game from a log, or a player character provides an item or game money to another player character by means provided in an online game, or The method of detecting abnormal characters in an online game using a clustering technique, characterized in that it identifies an act of storing or withdrawing an item or game money in a space within an online game accessible by the above character and determining the same as a transaction between characters.
11. The method of claim 10,
Displaying a graph visually after step 160 and displaying one or more of a character's name, information on an account to which the character belongs, information on the number of transactions on the edge, and information on traded goods; An abnormal character detection method in an online game using a clustering technique, characterized in that it further comprises.
A computer-readable recording medium containing a method for detecting an abnormal character in an online game using the clustering technique according to any one of claims 9 to 16.

Images