KR20200041288A - Method and apparatus for detecting game abuser - Google Patents

Abstract

Disclosed are a method and an apparatus for detecting a game abuser. The method for detecting a game abuser comprises the following steps of: receiving log data related to a transaction of a game good; generating transaction network data based on the log data; determining a reference feature based on the connection relationship among nodes included in the transaction network data; classifying nodes by performing the clustering based on a reference feature; and detecting the game abuser based on the classified result.

Description

METHOD AND APPARATUS FOR DETECTING GAME ABUSER}

The embodiments below relate to a technology for detecting a game observer.

Recently, with the advent of intermediary sites that trade game goods in cash, so-called "workshops" that systematically acquire game goods and trade game goods with cash for profit are becoming a problem. The workshop has a form in which several game accounts are organized to acquire game goods and sell the acquired game goods to other game users. In general, the workshop has a multi-level structure in which a farmer acquires game goods, a banker collecting game goods acquired by the farmer, and a buyer purchasing game goods from a banker. Such actions of the workplace may affect the market price of the game goods or damage the game economy by manipulating the market price, so appropriate measures need to be taken.

Korean Registered Patent No. 10-0902466 Korean Registered Patent No. 10-1074624

A method for detecting a game viewer according to an embodiment includes receiving log data related to a transaction of a game good; Generating transaction network data based on the log data; Determining a reference characteristic based on a connection relationship between nodes included in the transaction network data; Classifying the nodes by performing clustering based on the determined reference feature; And it may include the step of detecting a game avisor based on the classification result.

Determining the reference characteristic may include determining the reference characteristic based on a connection relationship between one node included in the transaction network data and one or more other nodes connected to the node.

Determining the reference feature may include determining the reference feature based on the direction of movement of the game goods from each node to another node in the transaction network data.

The determining of the reference feature may include selecting one of a plurality of features determined based on the connection relationship as the reference feature.

The generating of the transaction network data may include quantifying an abnormal degree of game goods transaction; And allocating the numerical abnormality as a weight of an edge corresponding to a game goods transaction.

The step of quantifying the degree of anomaly may include calculating the degree of anomaly based on an average value of a transaction price related to the transaction of the game good, each commercial trade price of the game good, and the number of game goods traded.

A node constituting the transaction network data may correspond to a game user, and trunk lines between nodes may correspond to a moving direction of game goods in relation to game goods transactions between game users.

The step of classifying the nodes may include the nodes, a farmer who acquires game goods in a game, a banker who receives game goods from the farmer, and collects the received game goods, a buyer who purchases game goods from the banker, and And classifying the user as a general game user not related to the transaction of the game good.

In the step of classifying the nodes, the nodes include a farmer who acquires game goods in a game, a game goods received from the farmer, an intermediate banker that delivers the received game goods to a banker, and a game delivered from the intermediate banker It may include the step of categorizing as a banker collecting goods, a buyer purchasing game goods from the banker, and a general game user not related to the transaction of the game goods.

A method for detecting a game viewer according to another embodiment includes generating transaction network data based on log data related to a transaction of a game good; Determining a reference characteristic based on the transaction network data; Detecting a game observer by clustering the transaction network data based on the reference feature; Verifying the detection result of the game avuser; And determining whether the verification result satisfies a preset condition.

A method for detecting a game viewer according to another embodiment includes: when the verification result does not satisfy the preset condition, changing a reference feature for detecting the game viewer; And detecting the game viewer by clustering the transaction network data again based on the changed reference feature.

Determining whether the verification result satisfies the condition includes: calculating the accuracy of the detection result; And determining whether the accuracy of the detection result exceeds a threshold value.

The verifying of the detection result may include verifying the detection result based on the classification result predicted by the neural network-based verification model and the classification result of the clustering.

The verification model may input log data related to the behavior of game users on game play as input, and output a label for classifying a group to which each game user belongs.

The verifying of the detection result may include generating a confusion matrix based on the detection result and the output result of the verification model; And determining a verification result of the detection result based on the confusion matrix.

The determining of the verification result may include determining whether a representative value calculated based on values of diagonal elements of the confusion matrix is equal to or greater than a threshold value.

A method for detecting a game viewer according to another embodiment includes generating transaction network data based on log data related to a transaction of a game good; Selecting a reference feature from a plurality of features based on a connection relationship between nodes included in the transaction network data; Classifying game users by performing clustering based on the reference feature; Verifying the classification result using a neural network-based verification model; If the verification result does not satisfy a preset condition, changing the reference feature to another reference feature; And detecting a game observer by performing clustering based on the changed reference feature.

The apparatus for detecting a game viewer according to an embodiment includes a memory and a processor, and the memory stores instructions executable by the processor, and when the instructions are executed by the processor, the processor is configured to generate game goods. Receiving log data related to a transaction, generating transaction network data based on the log data, determining a reference characteristic based on a connection relationship between nodes included in the transaction network data, and based on the determined reference characteristic The nodes can be classified by performing clustering, and a game viewer can be detected based on the classification result.

The apparatus for detecting a game viewer according to another embodiment includes a memory and a processor, the memory stores instructions executable by the processor, and when the instructions are executed by the processor, the processor is configured to generate a game product. Generate game network data based on transaction-related log data, determine a reference feature based on the transaction network data, and detect a game viewer by clustering the transaction network data based on the reference feature, The detection result of the game viewer can be verified, and it can be determined whether the verification result satisfies a preset condition.

The apparatus for detecting a game viewer according to another embodiment includes a memory and a processor, the memory stores instructions executable by the processor, and when the instructions are executed by the processor, the processor, Generates transaction network data based on log data related to the transaction, selects a reference feature from a plurality of features based on a connection relationship between nodes included in the transaction network data, and performs clustering based on the reference feature Classifying game users, verifying the classification result using a neural network-based verification model, and when the verification result does not satisfy a preset condition, changing the reference feature to another reference feature, and Based on the changed reference features By performing a gettering it can detect the gamers byujeo.

1 is a view for providing an overview of a game system according to an embodiment.
2 is a flow chart showing the overall operation of the game observer detection method according to an embodiment.
3 is a flowchart illustrating a process of detecting a game observer according to an embodiment.
4A and 4B are diagrams illustrating an example of transaction network data according to an embodiment.
5A and 5 are diagrams illustrating examples of a box plot showing clustering results according to an embodiment.
6 is a flow chart for explaining a verification process of a game observer detection result according to an embodiment.
7 is a diagram illustrating an example of a structure of a neural network to be used in a verification process according to an embodiment.
8A and 8B are diagrams illustrating an example of a confusion matrix according to an embodiment.
9 is a diagram illustrating the configuration of a game observer detection device according to an embodiment.

Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. However, various changes may be made to the embodiments, and the scope of the patent application right is not limited or limited by these embodiments. It should be understood that all modifications, equivalents, or substitutes for the embodiments are included in the scope of rights.

The terms used in the examples are for illustrative purposes only and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, the terms "include" or "have" are intended to indicate the presence of features, numbers, steps, actions, components, parts or combinations thereof described herein, one or more other features. It should be understood that the existence or addition possibilities of fields or numbers, steps, operations, components, parts or combinations thereof are not excluded in advance.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person skilled in the art to which the embodiment belongs. Terms such as those defined in a commonly used dictionary should be interpreted as having meanings consistent with meanings in the context of related technologies, and should not be interpreted as ideal or excessively formal meanings unless explicitly defined in the present application. Does not.

In addition, in the description with reference to the accompanying drawings, the same reference numerals are assigned to the same components regardless of reference numerals, and redundant descriptions thereof will be omitted. In describing the embodiments, when it is determined that detailed descriptions of related known technologies may unnecessarily obscure the subject matter of the embodiments, detailed descriptions thereof will be omitted.

1 is a diagram for providing an overview of a game system according to an embodiment.

Referring to FIG. 1, the game system 100 provides a game service to a plurality of game user terminals 130 through the game server 110. The game system 100 includes a game server 110, a network 120, and a plurality of game user terminals 130, and the game server 110 and a plurality of game user terminals 130 are connected to a network 120 (eg For example, they may communicate with each other through an Internet communication network, a wired / wireless local area network, or a wide area data communication network.

The game server 110 may perform an authentication procedure for the game user terminal 130 requesting access to execute the game program, and provide a game service to the game user terminal 130 that has been authenticated. The game user who wants to play the game executes a game program (or game application) installed in the game user terminal 130 and requests connection to the game server 110. The game user terminal 130 is a computing device that enables game users to access a game through an online connection, for example, a cellular phone, smart phone, personal computer, laptop, notebook, netbook, tablet or personal digital assistant (personal digital) assistant; PDA). In this specification, 'game user' refers to a user who can play a game through his or her game account, and 'game user terminal 130' may be referred to as a game client as a terminal of the game user.

The game user adjusts the virtual game character to play the game. The 'game character' is a fictional character appearing in the 'game space', a virtual space where the game is played, and means an object controlled by each game user and a subject performing an action for progressing the game. Each game character can be visualized as a 2D or 3D graphic image. The game user can change the ability or characteristics of the game character by using the game goods (or game items). Such game goods may have a great influence on game play, and depending on the game, there may be cases where game goods can be traded between game users. In this case, the transaction of the game good may be made through the game good exchange or on the game.

With regard to the trading of game goods, 'workshops' that acquire game goods abnormally can be problematic. A workplace is one of the game abusers that systematically acquires game goods and makes profits by trading the game goods for cash, and the behavior of these workshops affects the market price of the game goods or manipulates the market price. There is a danger of harming the economy. Therefore, detecting a game observer is an important issue in terms of normalization of game goods transactions and game economy.

In the embodiments to be described below, the game viewer is accurately determined by analyzing the game goods trading network to effectively detect a game viewer such as a workshop, and verifying the detection result of the corresponding game viewer through classifying the behavior of the game user. It provides a way to detect. It is possible to detect the overall structure of the workplace using the transaction network, and the detection result of the workplace can be verified based on the result of classifying the behavior patterns of game users using the neural network model.

2 is a flow chart showing the overall operation of the game observer detection method according to an embodiment. The method for detecting a game viewer can be performed by the game viewer detecting apparatus described herein.

Referring to FIG. 2, the game abuyer detection device detects a game abuyer such as a workplace force through analysis of a transaction network, and through a classification process using a behavior pattern of game users, the game abuyer is accurately determined in the previous step. You can verify that it has been detected.

In step 210, the apparatus for detecting a game viewer can detect a game viewer based on log data (hereinafter referred to as 'transaction log data') related to the transaction of the game goods. The game observer detection device may generate the transaction network data based on the transaction log data, and analyze the transaction network data to detect the game viewer. In one embodiment, the apparatus for detecting a game viewer may quantify an abnormal degree of a game good transaction and generate transaction network data based on the numerical abnormality information.

The apparatus for detecting a game viewer can detect a game viewer by performing clustering using a connection based centrality as a characteristic of clustering in the analysis of transaction network data. The workshop trades game goods in a different way than regular game users. Based on this point, the game viewer detection device selects, for example, a feature (reference feature) that is expected to differ between a workshop and a general game user among a plurality of possible features, and then K-means clustering. By performing clustering such as, it is possible to classify a group of game viewers. Features used for clustering may be calculated based on a connection relationship between nodes in the transaction network data, which will be described below.

The game observer detection device is related to farmers who acquire game goods in a game through clustering, bankers who receive game goods from farmers and collect game goods received, buyers who purchase game goods from bankers, and transaction of game goods It can classify normal game users who do not have it. In another embodiment, the game observer detection device receives the game goods from the farmer and the farmer through clustering, and collects the received game goods and delivers them to the banker, the banker collecting the game goods received from the intermediate banker, and the bankers It is possible to classify buyers and general game users who purchase game goods. Depending on the structure of the workplace, intermediate bankers may be included or omitted from the forces of the workplace. An intermediate banker has both the characteristics of a farmer and a banker in a trading network. The clustering process includes labeling game users included in the transaction log data into each group, for example, farmers, bankers, middle bankers, buyers, and general game users. Farmers, bankers, and middle bankers are game observers.

The process of step 210 will be described in more detail below with reference to FIG. 3.

In step 220, the game avager detection device may verify the detection result of the game avager in step 210. The apparatus for detecting a game viewer can verify whether the clustering result in step 210, that is, whether a normal general game user and a game viewer (for example, workplace forces) are well separated. Based on the fact that a group of farmers, bankers, intermediate bankers, buyers, and general game users exhibit different behaviors, the game avuser detection device performs verification based on the behaviors of the game users.

The apparatus for detecting a game viewer may classify game users based on behavior log data (hereinafter referred to as 'behavior log data') related to the behavior patterns of game users. At this time, a feature independent of the feature used in the clustering in step 210 may be used. The apparatus for detecting a game viewer may configure a verification model based on a neural network, and perform a verification process using the configured verification model. The verification model may input action log data and output a label of a group to which each game user belongs. For example, the game observer detection device may classify game users into farmers, bankers, middle bankers, buyers, and general game users using a verification model. Depending on the embodiment, the classification process of the intermediate banker may be omitted. When the behavior log data is used as a characteristic of classification using a verification model, a group of game users can be well classified. If the classification result in step 210 is correct, the accuracy of the classification result through the verification model should be high.

In the verification process, the game observer detection apparatus generates a confusion matrix based on the classification result in step 210 and the classification result using the verification model, and calculates the accuracy of classification based on the generated confusion matrix. And determining whether the calculated accuracy satisfies a preset condition.

The process of step 220 will be described in more detail below with reference to FIG. 6.

In step 230, the game observer detection device may determine whether the verification result of step 220 satisfies a preset condition. For example, the verification process may include a process of calculating the accuracy of the detection result in step 210 using a confusion matrix, and determining whether the accuracy of the detection result exceeds a threshold value. If the accuracy of the confusion matrix obtained as a result of the verification is lower than the reference, the game observer detection device may return to the transaction network analysis and perform the analysis process again.

If the verification result does not satisfy the preset condition, the game avuser detection apparatus changes game users by changing the reference feature for detection of the game viewer and clustering the transaction network data again based on the changed reference feature. By classifying them into groups, it is possible to detect the game viewer.

The game observer detection apparatus improves a feature to be used for clustering performed in step 210 through the verification result of step 220, and clusters transaction network data again with the improved feature to perform classification. If the value of the off-diagonal elements in the confusion matrix is large, it can be interpreted that the corresponding actual label is not properly clustered. In this case, the game observer detection device may re-adjust the characteristics of clustering to be performed in step 210 to better distinguish the groups associated with large non-diagonal elements. The apparatus for detecting a game viewer can accurately and precisely detect the game viewer by repeatedly performing the transaction network analysis process of step 210 and the verification process of step 220.

When the accuracy of the confusion matrix is high, the game observer detection device may identify each group classified based on the clustering feature used, and determine the game viewer through analysis of transaction log data.

As described above, the game observer detection device has high reliability through the process of detecting a game avager through clustering based on the centrality based on the degree of connection and the process of validating the detection result using a neural network-based verification model. Can detect In addition, the game observer detection device provides high versatility because it can detect not only machine programs such as bots, but also farmers, intermediate bankers, bankers, and buyers.

3 is a flowchart illustrating a process of detecting a game observer according to an embodiment.

Referring to FIG. 3, in step 310, the game observer detection device receives log data (transaction log data) related to the transaction of the game goods. Transaction log data may be transmitted from a game goods exchange or a game server. The transaction log data may include, for example, information regarding trading parties, traded game goods, transaction price, transaction time, number of game goods traded, and the like.

In step 320, the game observer detection device generates transaction network data based on the transaction log data. For example, the game observer detection apparatus may generate transaction network data for an abnormal transaction using transaction log data between game users.

The game viewer detection device can generate transaction network data by representing each game user as a node, representing game goods transactions between game users as trunks, and indicating the direction of movement of game goods in the direction of trunks. have. In the present specification, "transaction network data" may also be referred to as "transaction network graph" or "ideal transaction network graph". Each node constituting the transaction network data corresponds to a game user, and the trunks between the nodes correspond to the movement direction of the game goods in relation to the game goods transaction between game users.

An example of transaction network data according to one embodiment is illustrated in FIGS. 4A and 4B. 4A and 4B, each game user is displayed as a node 410, 420, 430, 440, 450, 460, 470, and the transaction of game goods between each game user is represented by an edge or an edge. By displaying, the transaction network graph can be constructed. At this time, the direction of the trunk line may be set as the moving direction of the game goods. Subsequently, the game observer detection device quantifies the degree of anomalies in all game goods transactions to detect the forces of the workplace, and the digitized anomalies correspond to the weights of the trunk lines corresponding to the game goods transactions. directed graph). The weight of the edge may indicate the degree of abnormality in the game goods transaction.

Returning to FIG. 3 again, as above, the game observer detection device may quantify the abnormal degree of the game goods transaction. In one embodiment, the game observer detection device is abnormal by calculating the degree of abnormality of the game transaction based on the average value of the transaction price related to the transaction of the game good, each commercial trade price of the game good, and the number of game goods traded The degree can be quantified. The apparatus for detecting a game observer may allocate a numerical abnormality as a weight of an edge corresponding to a transaction of a game good. Through this, the game observer detection apparatus may construct a direction graph having a weight.

In general, the game goods acquired through the workshop are moved through the game goods exchange, and in most cases, the game goods are traded in such a way that they are easy to obtain and sell at a high price. At this time, the transaction price of the game good is divided by a specific price unit to determine the most frequently traded price for each game good. Then, the average value of the transaction price within the appropriate price range is determined as the commercial transaction value of each game product as 'c'. If the actual transaction price of each game good in each transaction is called 'cost', and the number of game goods traded is 'cnt', the degree of numerical abnormality can be calculated by Equation 1 below.

A high degree of the above may mean that the commercial goods are cheaper and more expensive.

In step 330, the apparatus for detecting a game viewer determines a reference characteristic based on a connection relationship between nodes included in the transaction network data. The game observer detection apparatus may determine a reference feature based on the direction of movement of the game goods from each node to another node in the transaction network data. The apparatus for detecting a game viewer may select any one of a plurality of features determined based on a connection relationship between one node included in the transaction network data and one or more other nodes connected to the node as a reference feature.

In one embodiment, a type of game avender to be classified is determined, and various characteristics that are expected to differ from other types for each type of game avender may be defined. A connection-based centrality, which can be calculated through transaction network data, may be defined as a feature. A reference feature to be used in clustering may be selected in step 340 of the defined features.

Game viewers such as workshops and general game users differ in the degree of abnormalities in game goods trading. On the transaction network data, the nodes corresponding to the game viewer will have a high weight of entering and leaving trunks. When the adjacency matrix of the transaction network data is 'A', in-degree (x) and out-degree (y) of each node for classifying the game viewer are based on Equation 2 below. Can be calculated.

Here, 'x' represents the sum of weights coming into one node, and 'y' represents the sum of weights leaving the node. 'i' is an index to indicate the current node, and 'j' is an index to indicate the counterpart node of the game good. For example, in the form in which game goods move from Farmer-> Banker-> Buyer, the x value of the Banker and Buyer is large because the Banker and the Buyer receive game goods from Farmer and Banker, respectively. In contrast, farmers and bankers deliver game goods to bankers and buyers, respectively, so farmers and bankers have large y values.

In addition to the features calculated by Equation 2, the features for classifying the game viewer more precisely may be calculated according to Equations 3 to 10 below. Also in Equations 3 to 10, 'A' denotes an adjacency matrix of transaction network data, 'i' denotes an index to indicate the current node, and 'j' denotes an opponent node of the game goods. Represents an index.

The feature calculated in Equation 3 has a large value because the buyer has a large value because x2 considers the edges that go through twice, whereas a y2 has a large value because it considers the edges that go through twice. The feature calculated in Equation 4, xy considers both the incoming and outgoing edges, so the banker has the largest value.

The feature calculated in Equation 5 considers both the incoming and outgoing trunks in two passes, so the banker that receives the game goods from the farmer through the intermediate banker and delivers the game goods to the buyer has the highest value. Have

The feature calculated in Equation 6 considers both the incoming and outgoing trunks at one time, and the intermediate banker receiving the game goods from Farmer and passing the game goods to the buyer via the banker has the highest value. Have

To_xy_max, a feature calculated in Equation 7, considers the xy value, which is the banker of another node with a trunk coming from it, and the weight of the trunk at the same time, and thus represents an aspect of an intermediate banker> farmer, banker> general game user. Since the intermediate banker represents both the characteristics of the farmer and the characteristics of the banker in the transaction network, the features calculated in Equations 6 and 7 may be used to classify the intermediate bankers.

The characteristic calculated in Equation (8) shows the aspect of buyer> different group because it simultaneously considers the xy value of the other node with the edge going out to itself and the weight of the edge.

The feature calculated in Equation 9 considers the to_xy_max value of Equation 7 and the weight of the edge at the same time, so the farmer who delivers the game goods to the intermediate banker has the largest value.

The characteristic calculated in Equation 10 considers the to_xy_max value of Equation 7 and the weight of the edge at the same time, so the buyer and the banker receiving the game goods from the intermediate banker have the largest value.

The reference feature may be selected from features that can be calculated through Equations 2 to 10 above.

In step 340, the apparatus for detecting a game viewer can classify nodes constituting the transaction network data by performing clustering based on the reference characteristic determined in step 330. For example, the game observer detection apparatus may classify nodes corresponding to the power of the workplace by performing clustering techniques such as K-average clustering on the transaction network data based on the reference feature. Here, the performed clustering technique is not limited to K-average clustering, and various other clustering techniques may be used. The game observer detection device may classify nodes included in the transaction network data as farmer, banker, buyer, and general game user through clustering, or may classify the nodes as farmer, middle banker, banker, buyer, and general game user. have. The game observer detection device may assign a label to each game user corresponding to a node through clustering.

Returning to FIG. 3 again, in step 350, the apparatus for detecting game viewers may detect the game viewer based on the classification result of step 340. The game observer detection apparatus may classify the game viewer and the general game user by combining the feature aspect for each cluster label and the feature change aspect for each game user type. The game observer detection device may associate a game user type with a cluster label.

For example, an example of the result of K-average clustering with K = 4 considering farmer structure-> banker-> buyer structure and general game user is shown in FIG. 5A, and farmer-> middle An example of the result of performing K-average clustering with K = 5 in consideration of a banker-> banker-> shop structure having a form of a buyer and a general game user is illustrated in FIG. 5B. 5A and 5 show examples of box plots showing clustering results according to an embodiment.

Referring to FIG. 5A, each of the box plots 505, 510, 515, 520, and 525 clusters nodes for each reference feature (characteristics of x, x2, y, y2, and xy calculated through the above equation). It shows the results and shows the tendency of the reference feature. In each box plot (505, 510, 515, 520, 525), the x-axis represents the cluster label, and the y-axis represents the feature value. In the case of a cluster label, '1' means a regular game user, '2' means a farmer, '3' means a buyer, and '4' means a banker.

The box plot 505 and the box plot 515 represent clustering results according to the features x and y calculated through Equation 2, respectively, and the box plot 510 and the box plot 520 respectively express Equation 3 It shows the clustering result according to the features x2 and y2 calculated through. The box plot 525 shows the clustering result according to the feature xy calculated through Equation (4). In the box plot 510, it is estimated that the cluster label '3' having a large feature value of x2 corresponds to the buyer, and in the box plot 520, the cluster label '2' having a large feature value of y2 corresponds to the farmer. You can. In the box plot 525, it can be estimated that the cluster label '4' having a large feature value of xy corresponds to a banker, and the cluster label '1' having the largest number corresponds to a general game user.

Considering the box plot for each cluster label and the reference characteristic aspect for each type of game user, it is possible to correspond to the cluster label and the type of game user as shown in Table 1 below. Table 1 shows an example of a game user distribution table for each cluster label.

Cluster label Number of game users (persons) 1: General game user 501,583 2: Farmer 563 3: Buyer 291 4: Banker 27

Referring to FIG. 5B, each of the box plots 530, 535, 540, 545, and 550 clusters nodes for each reference feature (characteristics of x, from_xy_max, y, to_xy_max, and xy calculated through the above equation). It shows the results and shows the tendency of the reference feature. In each of the box plots 530, 535, 540, 545, and 550, the x-axis represents the cluster label, and the y-axis represents the feature value. In the case of the cluster label, '1' means a regular game user, '2' means a farmer, '3' means a middle banker, '4' means a buyer, and '5' means a banker. ) And the box plot 540 indicate the clustering result according to the feature x, y calculated through Equation 2, and the box plot 550 represents the clustering result according to the feature xy calculated through Equation (4). The box plot 535 represents the clustering result according to the feature from_xy_max calculated through Equation 8, and the box plot 545 represents the clustering result according to the feature to_xy_max calculated through Equation 7. In the box plot 525, it can be estimated that the cluster label '5' having a large feature value of xy corresponds to the banker, and the cluster label '3' having a large feature value of to_xy_max in the box plot 545 corresponds to the intermediate banker. . In the box plot 535, it is estimated that the cluster label '4' having a large feature value of from_xy_max corresponds to the buyer, and the cluster label '1' having the largest number corresponds to the general game user. The remaining cluster label '2' can be estimated to correspond to the farmer.

Considering a box plot for each cluster label and a reference feature aspect for each type of game user, it is possible to correspond to the cluster label and the type of game user as shown in Table 2 below. Table 2 shows an example of a game user distribution table for each cluster label.

Cluster label Number of game users (persons) 1: General game user 475,922 2: Farmer 25,497 3: Medium banker 598 4: Buyer 406 5: Banker 41

In one embodiment, if a particular type of game observer is detected in the transaction network structure, it is also possible to detect other game observers based on the transaction record. For example, when a banker is detected due to the structure of the transaction network, it is also possible to detect intermediate bankers, farmers, and buyers by tracking transaction records of the detected bankers. Each game user type can be determined from the transaction network data shown in FIG. 4B. In FIG. 4A, the node 430 corresponds to a farmer that mechanically acquires game goods, and the node 420 corresponds to a banker that receives and collects game goods from the farmer. The node 410 corresponds to a buyer who purchases game goods from a banker. In FIG. 4B, the node 460 corresponds to the farmer, and the node 450 corresponds to the intermediate banker receiving and collecting game goods from the farmer. The node 470 corresponds to a banker receiving and collecting game goods from an intermediate banker, and the node 440 corresponds to a buyer.

When the detection of the game viewer is completed according to the process of the above steps 310 to 350, the process proceeds to step 220 of FIG. 2 and a verification process of the detection result may be performed.

6 is a flow chart for explaining a verification process of a game observer detection result according to an embodiment.

Referring to FIG. 6, in step 610, the game observer detection device selects an action log (or log action) based on the action log data. The game observer detection device may select an action log to be used as a feature indicating a behavior pattern. In step 620, the game viewer detection device may extract the action log count value for each game user and perform data pre-processing based on the action log count value for each game user. The game observer detection device may calculate a ratio of the corresponding action log count to the total action log count in order to consider the ratio instead of the number of action logs.

The features used for verification are distinct from those used in clustering of the transaction network analysis of FIG. 3. In the verification process, for example, features such as action log count values per game user, ratio of action log counts, total number of action log counts, and max battle power may be used. Here, Max Battle Power is the highest value of the in-game combat power value that appears during the day.

In one embodiment, the apparatus for detecting a game viewer may perform data preprocessing such as normalization and log scaling for each feature. According to an embodiment, the game observer detection apparatus may perform various other data preprocessing in addition to normalization and log scaling. Since the ratio of the action log count is a small value close to 0, log scaling can be performed for each feature. 10 ^-10 can be added to prevent divergence by logarithmic scaling, and the absolute value of the logarithmic scaling value can be used. This process can be expressed as Equation 11 below.

Here, x represents a feature value used for verification, and x 'represents a result value of data pre-processing.

In step 630, the game viewer detection device may merge the characteristics of each game user based on the action log data and the labels of each game user (cluster label) derived as the clustering result of FIG. 3. For example, the apparatus for detecting a game viewer may merge features per game user based on action log data and labels per game user based on a player identifier (PID) for identifying a game user.

The apparatus for detecting a game viewer generates a confusion matrix in step 640 and performs verification based on the confusion matrix in step 650.

The game observer detection device may construct a new verification model to verify the clustering results derived through the analysis of the transaction network. As a verification model, a verification model based on neural networks may be used. For example, the game observer detection device may verify whether the farmer, the middle banker, the banker, the buyer, and the general game user are well classified in the clustering result using the verification model.

The verification model may input action log data related to actions on gameplay of game users, and output a label for classifying a group to which each game user belongs. According to an embodiment, a fully connected neural network 700 as illustrated in FIG. 7 may be used as a verification model. Depending on the embodiment, a neural network having a structure other than a fully connected neural network may be used as a verification model. 7 shows an example of the structure of a fully connected neural network 700. The fully connected neural network 700 may include an input layer 710, a hidden layer 720 and an output layer 730. For example, the hidden layer 720 includes 5 hidden layers, and each hidden layer may have 512, 512, 256, 256, and 128 artificial neurons, but the number of hidden layers and each hidden layer are configured. The number of artificial neurons is not limited thereto. The tanh function may be used as an active function for the fully connected neural network 700, but is not limited thereto. In addition, as the neural network for the verification model, a neural network of various structures / functions as well as the fully connected neural network of FIG. 7 may be used.

Returning to FIG. 6 again, the game observer detection apparatus detects the detection result of the game viewer derived as the transaction network analysis result based on the classification result predicted by the neural network-based verification model and the clustering classification result described in FIG. 3. Can be verified. The game observer detection apparatus may generate a confusion matrix based on the detection result and the output result of the verification model, and determine a verification result of the detection result based on the generated confusion matrix. The game observer detection apparatus may select a training set and a validation set for training the verification model, and train the verification model using the selected learning set. And, a confusion matrix can be obtained based on the output of the verification model and the authentication set.

In one embodiment, the game observer detection apparatus may randomly select the training set and the authentication set to have the same class balance, and classify the authentication set by training the verification model several times based on the training set. . The apparatus for detecting a game viewer may represent the classification result of the authentication set as a confusion matrix. Since the training set and the authentication set are randomly selected, in order to reduce the variance of the output data of the verification model, the game observer detection apparatus may repeat this process several times to generate a plurality of confusion matrices. The game observer detection apparatus may generate the final confusion matrix through the normalization process after summing all the generated confusion matrices.

The game observer detection apparatus can verify whether cluster labeling in the transaction network analysis is good through the final confusion matrix. For example, the apparatus for detecting a game viewer may calculate a representative value based on diagonal element values of a confusion matrix, and determine whether the calculated representative value is greater than or equal to a threshold value to determine a verification result. The average value of the diagonal elements of the confusion matrix may be calculated as a representative value, and the average value may indicate the degree of the verification model.

If the value of the off-diagonal elements in the final confusion matrix is large, it can be interpreted that the actual label is not properly clustered. In this case, the feature for clustering can be re-adjusted to better differentiate the game viewer. For example, the game observer detection apparatus identifies features with low accuracy in the final confusion matrix, and features used in clustering of the transaction network analysis (ie, reference features) so that items corresponding to the identified elements can be more accurately classified. ). Thereafter, the transaction network analysis may be performed again based on the changed reference feature.

8A and 8B are diagrams illustrating an example of a confusion matrix according to an embodiment.

FIG. 8A shows a confusion matrix related to a workplace structure having the form Farmer-> Banker-> Buyer, and FIG. 8B shows a confusion matrix related to a workshop structure having the form Farmer-> Medium Banker-> Banker-> Buyer. Diagonal elements in each confusion matrix represent an accurately estimated degree, and non-diagonal elements represent an incorrectly estimated result. The unit of value of the elements is%. The accuracy of the confusion matrix shown in FIG. 8A represents (93.07 + 97.27 + 91.23 + 95.14) /4=94.1775%, and the accuracy of the confusion matrix shown in FIG. 8B is (83.76 + 93.70 + 93.76 + 96.72 + 87.09) / 5 = 91.006%. 'Predict' corresponds to the prediction result predicted by the verification model learned based on the behavior log data, and 'Actual' corresponds to the labeling result through clustering of the transaction network analysis.

9 is a diagram illustrating the configuration of a game observer detection device according to an embodiment.

Referring to FIG. 9, the game observer detection device 900 may include a processor 910, a memory 920, and a communication interface 930. According to an embodiment, the game observer detection device 900 may further include a database 940. The game observer detection device 900 corresponds to the game avuser detection device described herein.

The memory 920 is connected to the processor 910 and may store instructions executable by the processor 910, data to be processed by the processor 910, or data processed by the processor 910. Memory 920 includes non-transitory computer-readable media, such as high-speed random access memory and / or non-volatile computer-readable storage media (eg, one or more disk storage devices, flash memory devices, or other non-volatile solid state memory devices). It can contain.

The communication interface 930 provides an interface for communicating with an external device (eg, a game exchange or game server). The communication interface 930 may communicate with an external device through a wired or wireless network.

The database 940 may store information and data necessary for the game observer detection device 900 to operate. For example, the database 940 may store log data related to the transaction of the game goods, log data related to the behavior of the game user, clustering result data through analysis of the transaction network, learning data for learning the verification model, and the like.

The processor 910 is configured to control each component of the game observer detection device 900. The processor 910 executes functions and instructions for executing in the game avager detection apparatus 900, and controls the overall operation of the game avager detection apparatus 900. The processor 910 may perform one or more operations related to the operation of the game observer detection device 900 described with reference to FIGS. 1 to 8.

For example, the processor 910 may receive log data related to the transaction of the game goods, and generate transaction network data based on the log data. The processor 910 may determine a reference characteristic based on a connection relationship between nodes included in the transaction network data. The processor 910 may classify nodes included in the transaction network data by clustering the transaction network data based on the determined reference characteristic. The processor 910 may classify game users by selecting a reference feature among a plurality of features that can be calculated based on a connection relationship between nodes, and performing clustering based on the selected reference feature. The processor 910 may detect a game viewer based on the classification result.

In addition, the processor 910 may verify the detection result of the game viewer using a neural network-based verification model. When the verification result does not satisfy the preset condition, the processor 910 re-detects the game viewer by changing the reference feature used for clustering to another reference feature and performing clustering based on the changed reference feature. You can. Through such a process, the game observer detection device 900 can accurately detect a game observer such as a workplace force.

The device described above may be implemented with hardware components, software components, and / or combinations of hardware components and software components. For example, the devices and components described in the embodiments include, for example, processors, controllers, arithmetic logic units (ALUs), digital signal processors (micro signal processors), microcomputers, field programmable gate arrays (FPGAs). , A programmable logic unit (PLU), microprocessor, or any other device capable of executing and responding to instructions, may be implemented using one or more general purpose computers or special purpose computers. The processing device may run an operating system (OS) and one or more software applications running on the operating system. In addition, the processing device may access, store, manipulate, process, and generate data in response to the execution of the software. For convenience of understanding, a processing device may be described as one being used, but a person having ordinary skill in the art, the processing device may include a plurality of processing elements and / or a plurality of types of processing elements. It can be seen that may include. For example, the processing device may include a plurality of processors or a processor and a controller. In addition, other processing configurations, such as parallel processors, are possible.

The software may include a computer program, code, instruction, or a combination of one or more of these, and configure the processing device to operate as desired, or process independently or collectively You can command the device. Software and / or data may be interpreted by a processing device, or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or may be permanently or temporarily embodied in the transmitted signal wave. The software may be distributed on networked computer systems, and stored or executed in a distributed manner. Software and data may be stored in one or more computer-readable recording media.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded on a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, or the like alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiments or may be known and usable by those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs, DVDs, and magnetic media such as floptical disks. -Hardware devices specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of program instructions include high-level language code that can be executed by a computer using an interpreter, etc., as well as machine language codes produced by a compiler. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

As described above, although the embodiments have been described by a limited embodiment and drawings, those skilled in the art can make various modifications and variations from the above description. For example, the described techniques are performed in a different order than the described method, and / or the components of the described system, structure, device, circuit, etc. are combined or combined in a different form from the described method, or other components Alternatively, even if replaced or substituted by equivalents, appropriate results can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

100: game system
110: game server
120: network
130: game user terminal
900: a game observer detection device
910: processor
920: memory
930: communication interface
940: database

Claims (1)

Receiving log data related to the transaction of the game good;
Generating transaction network data based on the log data;
Determining a reference characteristic based on a connection relationship between nodes included in the transaction network data;
Classifying the nodes by performing clustering based on the determined reference feature; And
Detecting a game viewer based on the classification result
Containing,
How to detect game viewers.

Images