KR20150100993A - Computer system and computer implemented method for detecting bot based on self similarity - Google Patents

Abstract

Disclosed is a bot detecting method using a self-similarity value. A self-similarity value is calculated by dividing into a certain unit after extracting each account or character from a log generated in an online game. When the calculated self-similarity is a threshold value or more, the self-similarity is determined as a bot. On the other hand, an optimized combination of a measurement period and a threshold value is selected after analyzing various measurement periods and threshold values and comparing with an answer file. Accordingly, a bot determination algorithm, related to a relevant online game, can be optimized. In addition, when a section in which a self-similarity exceeds a threshold value and a section in which a self-similarity does not appear repeatedly, the self-similarity can be determined by using a bot of an ordinary user.

Description

Technical Field [0001] The present invention relates to a bot detection system using a self similarity value,

The present invention relates to a method of detecting a bot in an online game.

In the field of online game technology, a bot is a program for automatically manipulating a player character of an online game according to a predetermined pattern.

These bots are mainly developed for acquiring items or game money by repeating simple play such as hunting or gathering in an online game. Instead of acquiring game money or items through normal online game play, There is a risk of breaking the balance in the online game because it obtains a lot of game money or items by playing a game.

Therefore, most online games strictly prohibit the use of bots.

Particularly, a large number of computers in foreign countries are used to constantly drive bots to acquire gaming money or items, and then sell them to general users in a space outside the game. The so-called workplace poses a threat to the normal service of online games An algorithm has been developed to distinguish the workplace from the general user in addition to the bot detection algorithm.

On the other hand, the known bot detection algorithm generally analyzes the log, and as a result, determines that the specific log is repeatedly generated and satisfies a predetermined rule.

It is a known general bot detection algorithm to determine by a bot when a specific log repeatedly occurs over a predetermined number of times for a predetermined time.

For example, if the hunting is 500 times or more within 5 hours, an algorithm such as determination as a bot is used.

However, such an algorithm has a limit in that it is difficult to judge whether a game is played under a certain period of time or when it is mixed with various patterns.

In particular, it is in the process of developing bots that grasp the loopholes of these algorithms and perform automated play with patterns that are not determined by algorithms.

In addition, when the online game is updated, the accuracy of the existing bot detection algorithm is significantly lowered, and there is a problem that the algorithm needs to be newly refined.

Furthermore, existing bot detection algorithms alone can not distinguish between workplace use and personal user bot usage.

Patent Document 1: Korean Patent Application Publication No. 10-2011-0067630 "Bad User Monitoring System and Method for Online Game Service" Patent Document 2: Korean Patent No. 10-1237161 entitled "Method of detecting a private bot of an online game" Patent Document 3: Korean Patent Laid-Open Publication No. 10-2013-0099786 "

KCI, "A Method for Detecting Game Bots Using Behavioral Pattern Model", Proceedings of the Korea Institute of Intelligent Systems (KIET) 20 (3) 422-427 1976-9172 Non-Patent Document 2. Proceedings of the 2011 Fall Conference of the Korean Institute of Intelligent Systems 21 (2)

In order to solve the problems of the related art as described above, the present invention proposes a method of calculating the self similarity by quantifying behavior repetition tendencies for each character, and detecting whether or not the robot is used based on the self similarity.

In particular, we propose a method to detect and distinguish bot use between workplace and individual user using the change of self - similarity.

According to another aspect of the present invention, there is provided a method of detecting a bot using a self similarity value, comprising: a log extracting step of extracting log data of any one of online game accounts or player characters;

A log partitioning step of dividing the logs at predetermined intervals from the extracted log data arranged in chronological order to generate a log bundle;

A self similarity calculation step of quantitatively calculating a self similarity value of a plurality of log bundles;

And a bot determining step of determining whether or not the robot is based on the self similarity value.

At this time, the calculation of the degree of self similarity is performed by generating a log vector using the amount of log IDs generated per log group,

Calculating a cosine similarity with the unit vector with respect to the generated log vector,

A standard deviation may be calculated with respect to the calculated cosine similarity for one or more log vectors, and the self similarity may be converted.

At this time, the cosine similarity can be obtained by using the following equation.

(Where Cos (?) Is the cosine similarity, A is the log vector, and B is the unit vector)

At this time, the self-similarity can be obtained by using the following equation.

(Where H is the self similarity, ∂ (St) is the standard deviation of St, and St is the cosine similarity)

On the other hand, since the accuracy and the recall rate vary depending on the measurement period of the cosine similarity and the threshold value, the optimal measurement period and threshold combination are selected by comparing analysis results according to various measurement periods and threshold values with the correct answer file.

On the other hand, if the self similarity value keeps a value equal to or more than the threshold value over a certain period of time, the self similarity value repeats the rise and fall based on the threshold value. .

According to the present invention, it is possible to determine the bots with a very high accuracy compared with the existing algorithms even if the play time is short because the tendency of repeat behavior for each character is quantified and the bot is judged based on the tendency.

In particular, since it is possible to determine whether or not a bot exists regardless of the game content itself, there is no need to elaborate or create a new bot determination criterion each time to update or correspond to a new type of bot.

Furthermore, it is possible to distinguish between use of the robot by the workplace and the use of the personal user by using the change in the degree of self similarity. Accordingly, the use of the bot of the individual user can be performed instead of blocking the account, thereby contributing to the improvement of the quality of the customer service.

1 is a diagram illustrating a structure in which an online game server is connected to a network,
FIG. 2 is a flowchart illustrating a method of detecting a bot using the self similarity value according to the present invention,
3 is a flowchart illustrating an example of a method for calculating a self similarity value in the present invention shown in FIG. 2,
4 is a diagram for explaining a process of generating a log vector from log data,
5 is a diagram for explaining the calculation process of the cosine similarity,
FIG. 6 is a chart comparing the trends of the cosine similarities of general users and bots,
FIG. 7 is a chart comparing the similarity of the general user and the bot,
8 is a diagram for explaining the relationship between the accuracy rate and the recall rate,
FIG. 9 is a view for explaining an optimum threshold value and a measurement period selection process considering the accuracy rate and recall rate,
10 is a chart showing a transition of the self similarity when a general user uses a bot.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT Hereinafter, the present invention will be described in detail with reference to preferred embodiments of the present invention and the accompanying drawings, wherein like reference numerals refer to like elements.

It is to be understood that when an element is referred to as being "comprising" another element in the description of the invention or in the claims, it is not to be construed as being limited to only that element, And the like.

Also, in the description of the invention or the claims, the components named as "means", "parts", "modules", "blocks" refer to units that process at least one function or operation, Each of which may be implemented by software or hardware, or a combination thereof.

The computer system and method described below are related to a method for analyzing a log for each online game account or each player character, quantitatively calculating the self similarity by a predetermined algorithm, and determining whether the robot is a bot based on the calculated self similarity will be.

In some embodiments, a log vector is generated in units of a predetermined time, a degree of similarity to a unit vector is calculated, a standard deviation of the cumulative cosine similarity during a measurement period is obtained, and a self similarity value is quantitatively calculated .

In some embodiments, sequences generated using a sequence mining technique are defined, and then the amount of self-similarity is quantitatively calculated by dividing the amount generated by each sequence into types of sequences.

Hereinafter, the log or log data refers to data in which the online game server records the behavior of the player character, the NPC, and the like in the online game or the change of the variable in the game. Such log data is generated in a predetermined time unit and stored as a file.

Self-similarity refers to a value obtained by quantitatively calculating the repeated tendency of divided logs after distinguishing logs of a specific account or player character from log data.

1 is a diagram illustrating a structure in which an online game server is connected to a network.

The online game server 2 is a main body for providing an online game service to a plurality of game clients 3 connected through a network and stores log data during execution of an online game.

The game client 3 means means for executing online game client software and connecting to the online game server 2 via a network so that the user can play online games.

General users perform game play in a manner of operating a player character by using their own game client 3, and install game bots in a plurality of game clients 3 in a workplace to automate and process game play.

At times, there may be a case where a bot is installed in the game client 3 among ordinary users.

The log analysis server 1 collects log data from the online game server 2 and analyzes the collected data.

The present invention relates to a system and method for determining an account and a character using a bot by analyzing log data generated by an online game server (2) . ≪ / RTI >

Alternatively, it may be implemented in a way that is executed in the log analysis server 1 or the online game server 2.

Hereinafter, it is assumed that the log analysis server 1 collects and analyzes log data from the online game server 2, but this is for the sake of understanding only, and the online game server 2 directly analyzes the bots The present invention is not limited thereto.

2 is a flowchart illustrating a method of detecting a bot using the self similarity value according to the present invention.

2, the present invention includes a log extraction step S10, a log segmentation step S20, a self similarity calculation step S30, a bot determination step S40, an accuracy and recall calculation step S50, , And a bot usage classification step (S60).

First, in the log extracting step (S10), the log analyzing server 1 acquires log data from the online game server 2, and then extracts a log of each online game account or player character.

The log data includes logs of various variables in the NPC and other online games, as well as a plurality of player characters, among which a log of a specific account or player character is extracted.

The extracted account or player character log is arranged in chronological order. In the log compartment step (S20), the logs are divided according to predetermined intervals to generate a log bundle.

In the self similarity calculation step S30, as the log bundles are generated as described above, a predetermined algorithm is applied to quantitatively calculate the self similarity.

In the bot determination step (S40), it is determined whether or not the bot is based on the calculated self similarity value.

Various methods can be used for the quantitative calculation of the degree of self similarity. In the present invention, two methods relating to the calculation of the degree of self similarity are presented.

First, an example of a calculation algorithm of self similarity will be described with reference to FIG.

3 is a flowchart illustrating an example of a method of calculating a self similarity value in the present invention shown in FIG.

3, the self similarity calculation step includes a log vector generation step S31, a cosine similarity calculation step S32, a standard deviation calculation step S33, and a self similarity conversion step S34.

In the log vector generation step S31, a log vector is generated by using the amount of each log ID generated in each log bundle.

4 is a diagram for explaining a process of generating a log vector from log data.

The table on the left side of FIG. 4 schematically shows the log of any one of the player characters.

The time, the log ID, and the log ID are solved and displayed to help understand the log of the player character from 00:00 to 00:05.

In the left table of Fig. 4, it is seen that they are divided into dashed lines at intervals of one minute.

That is, in the example of FIG. 4, it can be understood that logs are divided into units of 1 minute, and log bundles are created.

The number of times the same log ID is generated is counted for log bundles partitioned in units of one minute.

In the example of FIG. 4, it is assumed that there are four log IDs for the sake of convenience, but in reality, there are many kinds of log IDs and the calculation process is more complicated.

The table at the center of FIG. 4 indicates that the log ID generation amount is counted for each log bundle.

For example, at 00:00, it can be seen that the log corresponding to the log ID 1022 is 2, the logs corresponding to 1204 and 1205 are each 1, and the log corresponding to 1208 is generated 2 times.

This can be expressed in the form of a vector such as (2,1,1,2).

On the right side of FIG. 4, it can be seen that the log vector generated through the above process is displayed.

In the cosine similarity calculation step S32, a cosine similarity with the unit vector is calculated for the generated log vector.

The cosine similarity can be obtained using Equation (1).

At this time, Cos (θ) is a cosine similarity degree, and A and B are vectors for obtaining cosine similarity. The cosine similarity can be obtained by substituting the obtained log vector for A and the unit vector for B into the equation (1).

5 is a diagram for explaining the calculation process of the cosine similarity.

For example, assuming that the log vector Vt is (2, 1), the unit vector (1, 1) and the cosine similarity are calculated using Equation 1, which yields about 0.948 as shown in FIG.

The log data collected for a predetermined time is analyzed to generate a plurality of log vectors, and a result of calculating the cosine similarity for each log data is shown in FIG.

Fig. 6 is a chart comparing the trends of the cosine similarities of general users and bots.

6 (a) shows the cosine similarity transition of the general user, and the horizontal axis indicates time and the vertical axis indicates the cosine similarity value, respectively.

6 (a), it can be seen that the cosine similarity shows a value that is not constant over time.

Since a general user performs various in-game activities using his / her player character, and freely judges each game at an instant, it plays such a non-constant game.

On the other hand, FIG. 6 (b) shows the transition of the cosine similarity when the bot is used.

As shown in FIG. 6 (b), it can be seen that a relatively constant cosine similarity value is maintained. Even if the bot's play pattern is modified in various ways, the similarity of the cosine is similar.

If the cosine similarity is obtained as described above, the standard deviation calculation step S33 calculates a standard deviation of the calculated cosine similarity for one or more log vectors.

Thereafter, in the self similarity conversion step S34, the self similarity is converted using the obtained standard deviation.

The self similarity is obtained by the equation (2).

At this time, H is the self similarity, ∂ (St) is the standard deviation of St, and St is the cosine similarity.

The self-similarity H has a value between 0.5 and 1, and the closer to 1, the more similar behavior it can be seen.

FIG. 7 is a chart comparing the similarity of the general user and the bot, and shows a result of calculating the self-similarity for the online game currently in service.

In the case of the bots, the self similarity value is distributed in the range between 0.95 and 0.97 in the case of general users while the value is about 0.99 in the similarity value.

Other embodiments are possible as shown in Fig.

In FIG. 3, the cosine similarity degree is quantitatively calculated in the self similarity degree calculation step S30 and is converted into the self similarity value. However, the self similarity value is calculated by dividing the generation amount of each sequence by the type of the sequence for a predetermined measurement period You can also use the

That is, sequences of log IDs are determined, and log bundles are divided in consideration of the order in which log IDs are generated.

Then, during the measurement period, if the amount of occurrence of each sequence is counted and divided by the type of the sequence, if the ratio of the amount of occurrence of the specific sequence is high, it can be calculated that the degree of self similarity is high.

When this method is used, the accuracy of the algorithm can be improved because the self similarity is calculated considering the order of the log IDs. However, there is a disadvantage that the sequence mining is required and the calculation amount is increased.

On the other hand, if the self similarity value is calculated quantitatively using several methods as described above, the bot determining step S40 determines whether the robot is a bot using the self similarity value.

Referring back to FIG. 2, the process after the calculation of the self-similarity is examined.

In the bot determination step (S40), if the self similarity value is equal to or greater than a predetermined threshold value, the robot determines that it is the bot.

FIG. 8 is a view for explaining the relationship between the accuracy rate and the recall rate, and FIG. 9 is a diagram for explaining a process of selecting an optimal threshold value and a measurement period considering the accuracy rate and recall rate.

8, the accuracy rate means the ratio of bots among all the characters to be detected, and the recall rate means the ratio of bots detected among all bots.

At least a part of the entire detection target characters can be determined as a bot using the calculated similarity degree as described above. The result is compared with a correct answer file containing information on the detected bots to obtain a precision rate and a recall rate .

The lower the threshold, the higher the recall, but the lower the accuracy.

When the threshold value is lowered, the case where the bot is not used is judged as a bot, so that the accuracy is lowered.

On the other hand, if the measurement period is too short, the reliability of the data is lowered and the recall rate is generally lowered.

Therefore, it is necessary to reset the optimum measurement period and threshold value for optimization of the algorithm.

In the accuracy and recall calculation step (S50), the optimum measurement period and the threshold value are reset through comparison with the correct answer file.

To this end, steps S10 to S40 are repeated using various measurement cycles and threshold values, and the result is compared with the correct answer file.

Among them, the combination of the measurement period and the threshold value, which is not 100% accurate, is excluded, and the combination with the highest recall is found among the remaining combinations.

In the table of FIG. 9, shaded portions correspond to combinations that are not 100% accurate. Among the remaining combinations, the highest recall value is 86.2% indicated by a dotted line, and the threshold value and the measurement cycle combination have a threshold of 0.988 and a measurement cycle of 20 minutes.

In relation to the corresponding online game, the standard deviation and the self similarity are calculated for the log vectors generated at the 20-minute measurement period, and the optimum result is obtained when the account or character having the self similarity degree of 0.988 or more is determined by the bots .

Meanwhile, as shown in FIG. 7, the self similarity degree of the bots is higher than that of the general user by calculating the self similarity through the process as described above. When the general user plays the game by itself and uses the bots occasionally, Are prone to jaggedness.

10 is a chart showing a transition of the self similarity when a general user uses a bot.

10, the abscissa indicates the time and the ordinate the magnetic relativity. On the other hand, the upper horizontal line indicates the threshold value.

In this case, it can be seen that the calculated self-similarity has fallen below the threshold value in any section, and falls below the threshold value in any section.

In the workplace, the pattern is not displayed because the bots are always executed, and the self-similarity value is maintained at a certain level or more.

On the other hand, this pattern appears when an individual user temporarily uses a bot to repeat a simple hunting or gathering, or repeats playing the game directly.

In the step S60, the variation of the self similarity value is tracked. When the self similarity value is maintained at a value equal to or more than a predetermined threshold value, the self similarity value is increased and decreased based on the threshold value If you are using a bot, you can distinguish the use of individual users.

In other words, if the interval of passing the threshold value and the interval of the threshold value are repeated after tracking the change of the self-similarity value, the user can be classified into the use of the bot.

Meanwhile, the method of detecting a bot using the self similarity value according to the present invention can be implemented in the form of software, which is a collection of commands that can be read by a computer, and can be recorded on a recording medium.

In this case, the recording medium may include any type of medium readable by a computer, such as DVD-ROM, CD-ROM, hard disk, USB memory, and flash memory.

On the other hand, the expression to be recorded on the recording medium includes not only the case of being recorded on the recording medium of this type but also the case of being provided through a communication line in the form of an intangible carrier wave (Carrier Wave).

The technical idea of the present invention has been described through several embodiments.

It will be apparent to those skilled in the art that various changes and modifications may be made to the embodiments described above from the description of the present invention. Further, although not explicitly shown or described, those skilled in the art can make various modifications including the technical idea of the present invention from the description of the present invention Which is still within the scope of the present invention. The above-described embodiments described with reference to the accompanying drawings are for the purpose of illustrating the present invention, and the scope of the present invention is not limited to these embodiments.

The present invention can be applied to the field of on-line game technology.

1: log analysis server
2: Online game server
3: Game Client

Claims (13)

CLAIMS What is claimed is: 1. A method executed on a computer system,
A log extracting step of extracting log data of any one of the online game accounts or any one of the player characters;
A log partitioning step of dividing the logs at predetermined intervals from the extracted log data arranged in chronological order to generate a log bundle;
A self similarity calculation step of quantitatively calculating a self similarity value of a plurality of log bundles;
And a bot determining step of determining whether or not the robot is based on the self similarity value. The method according to claim 1,
The self similarity calculation step may include:
Generating a log vector using an amount of log IDs generated per log group;
Calculating a cosine similarity with a unit vector for the generated log vector;
Calculating a standard deviation for the calculated cosine similarity for one or more log vectors; And
Calculating a self similarity using the standard deviation; and detecting the robot using the self similarity value. 3. The method of claim 2,
Wherein the step of calculating the cosine similarity comprises the step of calculating a cosine similarity using the following equation.

(Where Cos (?) Is the cosine similarity, A is the log vector, and B is the unit vector) 3. The method of claim 2,
The method of detecting a robot using the self similarity value calculating the self similarity using the following equation at the step of calculating the self similarity.

(Where H is the self similarity, ∂ (St) is the standard deviation of St, and St is the cosine similarity) 3. The method of claim 2,
In the step of calculating the standard deviation and the degree of similarity, a standard deviation and a degree of similarity are calculated for the log vectors generated during the time corresponding to the period of the cosine similarity measurement,
Wherein the bot determining step uses the self similarity value determined by the bot when the self similarity value of the log vectors corresponding to the measurement cycle of the cosine similarity is equal to or greater than a threshold value. 6. The method of claim 5,
After the bot decision step,
Detecting a maximum value of the accuracy and the recall rate by comparing the set of the cosine similarity measurement periods and the threshold value with the evaluation set and detecting the maximum value of the accuracy and the recall rate. The method according to claim 1,
After the bot decision step,
Track the changes of the self-similarity value. If the self-similarity value keeps a value higher than the threshold value for a certain period or more, it refers to the workplace. If the self-similarity value repeats the rise and fall based on the threshold value, The method comprising the steps of: (a) classifying a robot using a robot; CLAIMS What is claimed is: 1. A method executed on a computer system,
A log extracting step of extracting log data of any one of the online game accounts or any one of the player characters;
A log partitioning step of extracting log bundles corresponding to a predetermined sequence of logs from an array of log IDs included in log data;
A self similarity calculation step of calculating a self similarity value by dividing the generation amount of each sequence by a type of a sequence during a predetermined measurement period;
And a bot determining step of determining whether or not the robot is based on the self similarity value. A computer-readable recording medium containing instructions for executing on a computer a method of detecting a bot using the self-similarity value recited in any one of claims 1 to 8. A computer system having a processor,
The processor extracts log data of any one of the online game accounts or player characters and generates log bundles by dividing the logs at predetermined intervals from the extracted log data arranged in chronological order, A bot detection system using a self similarity value that calculates a similarity value and then determines whether or not the robot is based on the self similarity value. 11. The method of claim 10,
The processor generates a log vector using the log IDs of the logs belonging to each log bundle, calculates the cosine similarity with the unit vector for each log vector generated, A robot detection system using a self similarity value that calculates the standard deviation of the calculated cosine similarity and then calculates the self similarity using the standard deviation. 11. The method of claim 10,
The processor calculates a standard deviation and a self similarity for the log vectors generated during the time corresponding to the measurement period of the cosine similarity, and when the self similarity value of the log vectors corresponding to the measurement period of the cosine similarity is equal to or greater than the threshold value, However,
A system for detecting a bot using a self similarity value that determines a combination of a threshold value and a cosine similarity measurement cycle having a highest recall ratio while maintaining accuracy above a predetermined value by comparing the measurement cycle and the threshold value of the cosine similarity measurement. 11. The method of claim 10,
The processor tracks the change of the self similarity value. If the self similarity value keeps a value equal to or more than a predetermined threshold value, Bot detection system using self - similarity value which is classified by using bot.

Images