KR20200143803A - Method and apparatus for determining abnormal user - Google Patents

Abstract

The present invention relates to a method and a device for determining an abnormal user. The method for determining an abnormal user comprises: obtaining a plurality of logs on a target user; using the logs to generate patterns of using multiple contents by the target user; generating user motion images based on the patterns; determining a class of the user motion image through a pre-trained image analysis algorithm; and determining the target user as an abnormal user when the determined class corresponds to the abnormal class.

Description

Method and device for determining abnormal users {METHOD AND APPARATUS FOR DETERMINING ABNORMAL USER}

The following embodiments relate to a technique for determining a user who uses contents abnormally.

In the online game, the user can purchase other items or goods by using the items or goods they own. Recently, in order to secure a specific item or a large amount of goods, a transaction has occurred in which items or goods are acquired using a plurality of user accounts and the acquired items or goods are driven to a specific user account. The system used to carry out such transactions may be referred to as a workshop. The game provider needs to detect the user accounts used in the workplace so that the workplace cannot be operated.

An embodiment may provide a method and apparatus for determining an abnormal user.

Another embodiment may provide a method and apparatus for determining a user who abnormally uses a plurality of contents provided in a game.

According to an aspect, an abnormal user determination method performed by a server includes obtaining a plurality of logs for a target user, generating a pattern in which the target user uses a plurality of contents by using the plurality of logs, Generating a user behavior image based on the pattern, determining a class of the user behavior image through a pretrained image analysis algorithm, and when the determined class corresponds to an abnormal class, the target user is referred to as an abnormal user. It includes the step of determining.

The plurality of contents may be provided in the same game.

Each of the plurality of logs may include an index indicating any one of a plurality of contents used by the target user.

The pattern may represent an order in which the target user moves from a first content to a second content among a plurality of contents.

The pattern may be in the form of a table.

The user action image may be generated based on the frequency of the table.

Generating a user behavior image based on the pattern includes: normalizing a frequency in the table as the pattern, determining a target pixel value corresponding to the normalized target frequency, and the user based on the target pixel value It may include generating an action image.

Generating a pattern in which the target user uses a plurality of contents using the plurality of logs includes generating a first pattern for a preset first level section of the user character of the user, and the pattern The generating of the user behavior image based on the includes generating a three-dimensional user behavior image based on the first pattern and the second pattern for the second level section, and the pretrained image analysis algorithm Determining the class of the user behavior image through may include determining the class of the three-dimensional user behavior image.

Generating a pattern in which the target user uses a plurality of contents using the plurality of logs includes generating a first pattern for a preset first level section of the user character of the user, and the pattern Generating the user behavior image based on, comprises generating a merged user behavior image based on the first pattern and the second pattern for the second level section, through the pretrained image analysis algorithm The determining of the class of the user behavior image may include determining the class of the merged user behavior image.

The abnormal user determination method further comprises training the image analysis algorithm, and the training of the image analysis algorithm includes obtaining sample logs of a sample user predetermined as an abnormal user, using the sample logs Generating a sample pattern using the plurality of contents by the sample user, generating a sample user behavior image based on the sample pattern, and the image analysis algorithm assigning a class for the sample user behavior image to an abnormal class And adjusting the image analysis algorithm to determine.

According to another aspect, a server for determining an abnormal user includes a memory in which a program for determining an abnormal user is recorded, and a processor that executes the program, wherein the program obtains a plurality of logs for a target user. The steps of: generating a pattern using the plurality of contents by the target user using the plurality of logs, generating a user behavior image based on the pattern, and analyzing the user behavior image through a pretrained image analysis algorithm. Determining a class, and when the determined class corresponds to an abnormal class, determining the target user as an abnormal user is performed.

The plurality of contents may be provided in the same game.

Each of the plurality of logs may include an index indicating any one of a plurality of contents used by the target user.

The pattern may represent an order in which the target user moves from a first content to a second content among a plurality of contents.

The pattern may be in the form of a table.

The user action image may be generated based on the frequency of the table.

Generating a user behavior image based on the pattern includes: normalizing a frequency in the table as the pattern, determining a target pixel value corresponding to the normalized target frequency, and the user based on the target pixel value It may include generating an action image.

Generating a pattern in which the target user uses a plurality of contents using the plurality of logs includes generating a first pattern for a preset first level section of the user character of the user, and the pattern The generating of the user behavior image based on the includes generating a three-dimensional user behavior image based on the first pattern and the second pattern for the second level section, and the pretrained image analysis algorithm Determining the class of the user behavior image through may include determining the class of the three-dimensional user behavior image.

Generating a pattern in which the target user uses a plurality of contents using the plurality of logs includes generating a first pattern for a preset first level section of the user character of the user, and the pattern Generating the user behavior image based on, comprises generating a merged user behavior image based on the first pattern and the second pattern for the second level section, through the pretrained image analysis algorithm The determining of the class of the user behavior image may include determining the class of the merged user behavior image.

The program further performs the step of training the image analysis algorithm, and the training of the image analysis algorithm includes obtaining sample logs of a sample user predetermined as an abnormal user, and using the sample logs Generating a sample pattern using the plurality of contents by a user, generating a sample user behavior image based on the sample pattern, and allowing the image analysis algorithm to determine a class for the sample user behavior image as an abnormal class It may include adjusting the image analysis algorithm.

A method and apparatus for determining an abnormal user may be provided.

A method and apparatus for determining a user who abnormally uses a plurality of contents provided in a game may be provided.

1 illustrates a method of transacting items or goods of users through an exchange provided by a server according to an example.
2 is a block diagram of a server for determining an abnormal user according to an exemplary embodiment.
3 is a flowchart of a method of determining an abnormal user according to an exemplary embodiment.
4 illustrates a pattern in which a user uses a plurality of contents according to an example.
5 is a flowchart of a method of generating a user behavior image based on a pattern according to an example.
6 is a user behavior image according to an example.
7 is a merged user behavior image according to an example
8 is a three-dimensional user behavior image according to an example.
9 is a flowchart of a method of training an image analysis algorithm according to an example.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. However, since various changes may be made to the embodiments, the scope of the rights of the patent application is not limited or limited by these embodiments. It should be understood that all changes, equivalents, or substitutes to the embodiments are included in the scope of the rights.

The terms used in the examples are used for illustrative purposes only and should not be interpreted as limiting. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present specification, terms such as "comprise" or "have" are intended to designate the presence of features, numbers, steps, actions, components, parts, or combinations thereof described in the specification, but one or more other features. It is to be understood that the presence or addition of elements or numbers, steps, actions, components, parts, or combinations thereof, does not preclude in advance.

Unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which the embodiment belongs. Terms as defined in a commonly used dictionary should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and should not be interpreted as an ideal or excessively formal meaning unless explicitly defined in this application. Does not.

In addition, in the description with reference to the accompanying drawings, the same reference numerals are assigned to the same components regardless of the reference numerals, and redundant descriptions thereof will be omitted. In describing the embodiments, when it is determined that a detailed description of related known technologies may unnecessarily obscure the subject matter of the embodiments, the detailed description thereof will be omitted.

1 illustrates a method of transacting items or goods of users through an exchange provided by a server according to an example.

The server 110 providing the game provides the exchange 112 in the game to users of the game. The user can access the server 110 through a user account. Hereinafter, the operation performed by the user account may be understood as an operation performed by the user through the user terminal.

The first user 120 may exchange game items or goods held by the user account with other users 130, 140, 150 through the exchange 112. For example, a target item held by a first user account and a product held by a second user account may be exchanged. When the first user 120 is a buyer of the workplace, and the second user 130, the third user 140, and the fourth user 150 are sellers of the workplace, the first user 120 ) May accumulate goods by selling the item to the second user 130, the third user 140, and the fourth user 150.

Transaction records between users 120 to 150 may be generated as log information. The server 110 may determine the user account of the first user 120 as an illegal user account by analyzing the transaction record. The server 110 may impose a penalty to a user determined as an illegal user account. Additionally, a penalty may be given to a user account (for example, the second user 130) determined to be closely related to the illegal user account. For example, the penalty may be a suspension of using a game by an illegal user account.

In addition to the above method, a user's behavior pattern may be considered as a condition for detecting a user (abnormal user) in the workplace. For example, the user of the workplace can use the contents in the game according to a predetermined schedule. In order to maximize the profits of the workplace, users of the workplace can repeatedly use only some of the contents. A method of determining an abnormal user using a user's behavior pattern will be described in detail below with reference to FIGS. 2 to 9.

2 is a block diagram of a server for determining an abnormal user according to an exemplary embodiment.

The server 200 for determining an abnormal user includes a communication unit 210, a processor 220, and a memory 230. For example, the server 200 may correspond to the server 110 described above with reference to FIG. 1. As another example, the server 200 may be a separate server or electronic device that is physically separated from the server 110.

The communication unit 210 is connected to the processor 220 and the memory 230 to transmit and receive data. The communication unit 210 may be connected to other external devices to transmit and receive data. Hereinafter, the expression "transmitting/receiving A" may indicate transmitting/receiving "information or data representing A".

The communication unit 210 may be implemented as a circuitry in the server 200. For example, the communication unit 210 may include an internal bus and an external bus. As another example, the communication unit 210 may be an element that connects the server 200 and an external device. The communication unit 210 may be an interface. The communication unit 210 may receive data from an external device and transmit the data to the processor 220 and the memory 230.

The processor 220 processes data received by the communication unit 210 and data stored in the memory 230. The “processor” may be a data processing device implemented in hardware having a circuit having a physical structure for executing desired operations. For example, desired operations may include code or instructions included in a program. For example, a data processing device implemented in hardware is a microprocessor, a central processing unit, a processor core, a multi-core processor, and a multiprocessor. , Application-Specific Integrated Circuit (ASIC), and Field Programmable Gate Array (FPGA).

The processor 220 executes computer-readable code (eg, software) stored in a memory (eg, memory 230) and instructions induced by the processor 220.

The memory 230 stores data received by the communication unit 210 and data processed by the processor 220. For example, the memory 230 may store a program (or application or software). The stored program may be a set of syntaxes that are coded to determine an abnormal user and executed by the processor 220.

According to an aspect, the memory 230 may include one or more volatile memories, nonvolatile memories and random access memories (RAM), flash memories, hard disk drives, and optical disk drives.

The memory 230 stores an instruction set (eg, software) for operating the server 200. The instruction set for operating the server 200 is executed by the processor 220.

The communication unit 210, the processor 220, and the memory 230 will be described in detail with reference to FIGS. 3 to 9 below.

3 is a flowchart of a method of determining an abnormal user according to an exemplary embodiment.

The steps 310 to 350 below are performed by the server 200 described above with reference to FIG. 2.

In step 310, the server 200 acquires a plurality of logs for the target user (or the user account of the target user). Each of the plurality of logs may include an index indicating any one of a plurality of contents used by the target user. For example, a plurality of contents may be provided within the same game, and the plurality of contents may include a dungeon, a store, an exchange, and the like, and are not limited to the described embodiment.

In step 320, the server 200 generates a pattern in which a target user uses a plurality of contents by using a plurality of logs. The server 200 may arrange a plurality of logs in chronological order, and may sequentially list contents used by the target user. For example, it may be detected what content the target user moved to while using what content. The pattern may represent an order in which the target user moves from the first content to the second content among a plurality of contents. For example, the pattern may be in the form of a table, and the pattern will be described in detail with reference to FIG. 4 below.

In step 330, the server 200 generates a user behavior image based on the pattern. For example, the table indicates a frequency of movement between contents, and the frequency of movement may be converted into a pixel value of a user action image. The transformed pixel value may be placed on coordinates in the image determined based on the order of listing contents in the table. The user behavior image will be described in detail with reference to FIGS. 5 to 8 below.

In step 340, the server 200 determines the class of the user behavioral image through a pretrained image analysis algorithm. For example, the image analysis algorithm may determine whether the input image corresponds to a normal class or an abnormal class. The operation of the image analysis algorithm can be compared to the operation of the algorithm for determining whether the input image corresponds to a cat or a dog.

According to one aspect, the image analysis algorithm may be trained in advance before step 310 is performed. A method of training the image analysis algorithm will be described in detail below with reference to FIG. 9.

In step 350, when the determined class corresponds to the abnormal class, the server 200 determines the target user as the abnormal user.

According to an aspect, a target user determined as an abnormal user may have restrictions on game use. For example, the target user's use of the game may be stopped or the use of specific content in the game may be stopped.

4 illustrates a pattern in which a user uses a plurality of contents according to an example.

According to an aspect, a pattern in which a target user uses a plurality of contents may be generated in the form of a table 400. The table 400 may represent a movement relationship between contents used by a target user. Each of the left-most column 410 and the top-most row 420 of the table 400 may be a list of a plurality of contents. The plurality of contents included in the left-most column 410 and the top-most row 420 may be entire contents provided in the game. For example, the frequency 430 of moving from the first content to the first content may be 64 times, and the frequency of moving from the first content to the second content may be 42.

When the target user is an abnormal user, a high frequency may appear in the relationship between specific contents. For example, a high frequency may appear for content provided with an expensive item.

5 is a flowchart of a method of generating a user behavior image based on a pattern according to an example.

According to one aspect, the step 330 described above with reference to FIG. 3 may include the following steps 510 to 530.

In step 510, server 200 normalizes the frequencies in the table as a pattern. For example, the normalized value may range from 0 to 1. As another example, the range of the normalized value may be 0 to 255.

In step 520, the server 200 determines a target pixel value corresponding to the normalized target frequency. The pixel value may be a gray value, and the pixel value may correspond to a normalized value. For example, when the range of the normalized value is 0 to 255 and the target pixel value is 255, the target pixel value may also be 255. A target pixel value of 0 may be white, and a target pixel value of 255 may be black.

In step 530, the server 200 generates a user action image based on the target pixel value. For example, when the number of the plurality of contents is 50, the user action image may have a size of 50 x 50. The coordinates of the target pixel in the user action image may be determined based on the table.

According to an example of the table 400 described with reference to FIG. 4, the size of the generated user action image may be 5 x 5, and the coordinates of the target pixel corresponding to the frequency 430 are the maximum of the user action image. -It can be (0, 4) in the upper left corner.

6 is a user behavior image according to an example.

According to an aspect, the user action image 600 may include a plurality of target pixels 601 to 605. Each coordinate of the plurality of target pixels 601 to 605 represents a movement relationship between contents, and a pixel value of each of the plurality of target pixels 601 to 605 represents a frequency. The higher the frequency, the larger the pixel value, and it appears darker in the user action image 600.

Since abnormal users use only specific contents, when the user is an abnormal user, the generated user behavior image 600 may have a similar shape to that of other abnormal users. However, since the degree of similarity between the user behavior images cannot be read with the naked eye, it may be determined whether the user behavior image 600 of the target user corresponds to the user behavior image of the abnormal user through an algorithm.

According to an aspect, step 320 described above with reference to FIG. 3 may include generating a first pattern for a preset first level section of the user character of the target user. For example, a first level section may be a low level section, a second level section may be a high level section, and a first pattern and a second pattern may be generated for each section.

According to an aspect, the step 330 described above with reference to FIG. 3 may include generating a merged user behavior image based on the first pattern and the second pattern for the second level section. The merged user behavior image will be described in detail below with reference to FIG. 7.

According to another aspect, the step 330 described above with reference to FIG. 3 may include generating a three-dimensional user behavior image based on the first pattern and the second pattern for the second level section. . The three-dimensional user behavior image will be described in detail with reference to FIG. 8 below.

According to an aspect, the step 340 described above with reference to FIG. 3 may include determining a class of a merged user behavior image or a three-dimensional user behavior image.

7 is a merged user behavior image according to an example

For example, when the level section is divided into four, four patterns may be generated for each level section, and user behavior images 710 to 740 for the four patterns may be generated.

The merged user behavior image 700 may be generated by merging the user behavior images 710 to 740. The merged user action image 700 is treated as one image.

The image analysis algorithm may be pre-trained using merged user behavior images for abnormal users, and may determine the class of the merged user behavior image 700.

8 is a three-dimensional user behavior image according to an example.

For example, when the level section is divided into four, four patterns may be generated for each level section, and user behavior images 810 to 840 for the four patterns may be generated.

A three-dimensional user behavior image 800 may be generated by stacking the user behavior images 810 to 840. The z-axis of the 3D user action image 800 may be a level section. The three-dimensional user action image 800 is treated as one image.

The image analysis algorithm may be pretrained using 3D user behavior images for abnormal users, and may determine the class of the 3D user behavior image 800.

9 is a flowchart of a method of training an image analysis algorithm according to an example.

Referring to FIG. 3, before the aforementioned step 310 is performed, the following step 900 may be performed first. Step 900 may be training an image analysis algorithm. Step 900 includes steps 910 to 940

In step 910, the server 200 acquires sample logs of a sample user predetermined as an abnormal user. The sample user may be a user determined to be an abnormal user through another method.

In step 920, the server 200 generates a sample pattern in which a sample user uses a plurality of contents by using the sample logs.

In step 930, the server 200 generates a sample user behavior image based on the sample pattern.

In step 940, the server 200 adjusts the image analysis algorithm so that the image analysis algorithm determines the class for the sample user behavioral image as an abnormal class. For example, when the image analysis algorithm is a neural network, the image analysis algorithm may be adjusted by adjusting a connection relationship between layers in the neural network.

The method according to the embodiment may be implemented in the form of program instructions that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, etc. alone or in combination. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be known and usable to those skilled in computer software. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, and magnetic media such as floptical disks. -A hardware device specially configured to store and execute program instructions such as magneto-optical media, and ROM, RAM, flash memory, and the like. Examples of the program instructions include not only machine language codes such as those produced by a compiler, but also high-level language codes that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operation of the embodiment, and vice versa.

The software may include a computer program, code, instructions, or a combination of one or more of these, configuring the processing unit to behave as desired or processed independently or collectively. You can command the device. Software and/or data may be interpreted by a processing device or to provide instructions or data to a processing device, of any type of machine, component, physical device, virtual equipment, computer storage medium or device. , Or may be permanently or temporarily embodyed in a transmitted signal wave. The software may be distributed over networked computer systems and stored or executed in a distributed manner. Software and data may be stored on one or more computer-readable recording media.

As described above, although the embodiments have been described by the limited drawings, those of ordinary skill in the art can apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order from the described method, and/or components such as a system, structure, device, circuit, etc. described are combined or combined in a form different from the described method, Alternatively, even if substituted or substituted by an equivalent, an appropriate result can be achieved.

Therefore, other implementations, other embodiments and claims and equivalents fall within the scope of the following claims.

200: server
210: communication department
220: processor
230: memory

Claims (21)

The method of determining abnormal users, performed by the server, is:
Acquiring a plurality of logs for a target user;
Generating a pattern in which the target user uses a plurality of contents by using the plurality of logs;
Generating a user behavior image based on the pattern;
Determining a class of the user behavioral image through a pretrained image analysis algorithm; And
If the determined class corresponds to an abnormal class, determining the target user as an abnormal user
Containing,
How to determine abnormal users.
The method of claim 1,
The plurality of contents are provided in the same game,
How to determine abnormal users.
The method of claim 1,
Each of the plurality of logs includes an index indicating any one of a plurality of contents used by the target user,
How to determine abnormal users.
The method of claim 1,
The pattern represents an order in which the target user moves from a first content to a second content among a plurality of contents,
How to determine abnormal users.
According to claim 4
The pattern is in the form of a table,
How to determine abnormal users.
The method of claim 5,
The user action image is generated based on the frequency of the table,
How to determine abnormal users.
The method of claim 1,
Generating a user behavior image based on the pattern,
Normalizing the frequency in the table as the pattern;
Determining a target pixel value corresponding to the normalized target frequency; And
Generating the user behavior image based on the target pixel value
Containing,
How to determine abnormal users.
The method of claim 1,
Generating a pattern in which the target user uses a plurality of contents by using the plurality of logs,
Generating a first pattern for a preset first level section of the user character of the user
Including,
Generating a user behavior image based on the pattern,
Generating a three-dimensional user behavior image based on the first pattern and the second pattern for the second level section
Including,
Determining the class of the user behavior image through the pretrained image analysis algorithm,
Determining a class of the three-dimensional user behavior image
Containing,
How to determine abnormal users.
The method of claim 1,
Generating a pattern in which the target user uses a plurality of contents by using the plurality of logs,
Generating a first pattern for a preset first level section of the user character of the user
Including,
Generating a user behavior image based on the pattern,
Generating a merged user behavior image based on the first pattern and the second pattern for the second level section
Including,
Determining the class of the user behavior image through the pretrained image analysis algorithm,
Determining a class of the merged user behavior image
Containing,
How to determine abnormal users.
The method of claim 1,
Training the image analysis algorithm
Including more,
Training the image analysis algorithm,
Obtaining sample logs of a sample user predetermined as an abnormal user;
Generating a sample pattern in which the sample user uses the plurality of contents by using the sample logs;
Generating a sample user behavior image based on the sample pattern; And
Adjusting the image analysis algorithm so that the image analysis algorithm determines a class for the sample user behavioral image as an abnormal class.
Containing,
How to determine abnormal users.
A computer-readable recording medium containing a program for performing the method of any one of claims 1 to 10.
The server that determines the abnormal user,
A memory in which a program for determining an abnormal user is recorded; And
Processor that executes the above program
Including,
The above program,
Acquiring a plurality of logs for a target user;
Generating a pattern in which the target user uses a plurality of contents by using the plurality of logs;
Generating a user behavior image based on the pattern;
Determining a class of the user behavioral image through a pretrained image analysis algorithm; And
If the determined class corresponds to an abnormal class, determining the target user as an abnormal user
To do,
server.
The method of claim 12,
The plurality of contents are provided in the same game,
server.
The method of claim 12,
Each of the plurality of logs includes an index indicating any one of a plurality of contents used by the target user,
server.
The method of claim 12,
The pattern represents an order in which the target user moves from a first content to a second content among a plurality of contents,
server.
The method of claim 15
The pattern is in the form of a table,
server.
The method of claim 16,
The user action image is generated based on the frequency of the table,
server.
The method of claim 12,
Generating a user behavior image based on the pattern,
Normalizing the frequency in the table as the pattern;
Determining a target pixel value corresponding to the normalized target frequency; And
Generating the user behavior image based on the target pixel value
Containing,
server.
The method of claim 12,
Generating a pattern in which the target user uses a plurality of contents by using the plurality of logs,
Generating a first pattern for a preset first level section of the user character of the user
Including,
Generating a user behavior image based on the pattern,
Generating a three-dimensional user behavior image based on the first pattern and the second pattern for the second level section
Including,
Determining the class of the user behavior image through the pretrained image analysis algorithm,
Determining a class of the three-dimensional user behavior image
Containing,
server.
The method of claim 12,
Generating a pattern in which the target user uses a plurality of contents by using the plurality of logs,
Generating a first pattern for a preset first level section of the user character of the user
Including,
Generating a user behavior image based on the pattern,
Generating a merged user behavior image based on the first pattern and the second pattern for the second level section
Including,
Determining the class of the user behavior image through the pretrained image analysis algorithm,
Determining a class of the merged user behavior image
Containing,
server.
The method of claim 12,
The above program,
Training the image analysis algorithm
Do more,
Training the image analysis algorithm,
Obtaining sample logs of a sample user predetermined as an abnormal user;
Generating a sample pattern in which the sample user uses the plurality of contents by using the sample logs;
Generating a sample user behavior image based on the sample pattern; And
Adjusting the image analysis algorithm so that the image analysis algorithm determines a class for the sample user behavioral image as an abnormal class.
Containing,
server.

Images