WO2010107149A1 - Method and apparatus for detecting automatic input event generated by hardware device - Google Patents

Method and apparatus for detecting automatic input event generated by hardware device Download PDF

Info

Publication number
WO2010107149A1
WO2010107149A1 PCT/KR2009/001425 KR2009001425W WO2010107149A1 WO 2010107149 A1 WO2010107149 A1 WO 2010107149A1 KR 2009001425 W KR2009001425 W KR 2009001425W WO 2010107149 A1 WO2010107149 A1 WO 2010107149A1
Authority
WO
WIPO (PCT)
Prior art keywords
event
data
events
input device
computer
Prior art date
Application number
PCT/KR2009/001425
Other languages
French (fr)
Inventor
Heean Park
Zhangwook Choi
Original Assignee
Ahnlab., Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Ahnlab., Inc. filed Critical Ahnlab., Inc.
Priority to PCT/KR2009/001425 priority Critical patent/WO2010107149A1/en
Publication of WO2010107149A1 publication Critical patent/WO2010107149A1/en

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F3/00—Input arrangements for transferring data to be processed into a form capable of being handled by the computer; Output arrangements for transferring data from processing unit to output unit, e.g. interface arrangements
    • G06F3/01—Input arrangements or combined input and output arrangements for interaction between user and computer
    • G06F3/03—Arrangements for converting the position or the displacement of a member into a coded form
    • G06F3/033—Pointing devices displaced or positioned by the user, e.g. mice, trackballs, pens or joysticks; Accessories therefor
    • G06F3/038—Control and interface arrangements therefor, e.g. drivers or device-embedded control circuitry
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • A—HUMAN NECESSITIES
    • A63—SPORTS; GAMES; AMUSEMENTS
    • A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
    • A63F2300/00—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game
    • A63F2300/50—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game characterized by details of game servers
    • A63F2300/55—Details of game data or player data management
    • A63F2300/5586—Details of game data or player data management for enforcing rights or rules, e.g. to prevent foul play
    • A—HUMAN NECESSITIES
    • A63—SPORTS; GAMES; AMUSEMENTS
    • A63F—CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR
    • A63F2300/00—Features of games using an electronically generated display having two or more dimensions, e.g. on a television screen, showing representations related to the game
    • A63F2300/60—Methods for processing data by generating or executing the game program
    • A63F2300/6045—Methods for processing data by generating or executing the game program for mapping control signals received from the input arrangement into game commands
    • A63F2300/6054—Methods for processing data by generating or executing the game program for mapping control signals received from the input arrangement into game commands by generating automatically game commands to assist the player, e.g. automatic braking in a driving game
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/21—Indexing scheme relating to G06F21/00 and subgroups addressing additional information or applications relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/2133—Verifying human interaction, e.g., Captcha

Definitions

  • the present invention relates to a method and apparatus for detecting an automatic input event generated by a hardware device, and more particularly, to a method and apparatus for detecting an automatically inputted event by analyzing a correlation between data transferred from an application program to a hardware-type of automatic input device and an event transferred from the automatic input device to an operating system.
  • MMORPG massive multiplayer online role playing game
  • MMORPG massive multiplayer online role playing game
  • Players of the MMORPG game manipulate their own characters and make their ways through diverse events that occur in a continuous story line provided by the game as if the events occurred in the real world. For instance, users may get a higher level by training their characters for the game through hunting or battles, organize a guild with other players, participate in a group battle as part of a team, or purchase items through trade.
  • a character’s level or experience point is increased only by repetitively performing a certain mission such as monster hunting, participating in a battle against enemies, visiting a particular area, etc.
  • a certain mission such as monster hunting, participating in a battle against enemies, visiting a particular area, etc.
  • Such repetitive missions can be accomplished by fixed, regular mouse motions, repetitive click, repetitive and regular stroke of a specific key on the keyboard, etc.
  • API application programming interface
  • SendInput provides a function to programmatically generate the mouse event or the keyboard event, but if there is an automatic input program that uses the API to serve a trick on others as if the mouse event or the keyboard event happened, the SendInput API is hooked to make the event fail when the automatic input program calls the SendInput API, thereby defending the game against the automatic input program.
  • USB devices with its unique Vendor IDs and product IDs to identify each USB device, may detect, through that unique IDs, a hardware-type of automatic input device that uses a USB port.
  • IDs are stored in firmware, it is easy to change the IDs, and moreover it is difficult to detect the hardware-type of automatic input device if the hardware-type of automatic input device disguises itself with a commonly used ID value such as Microsoft Corporation, Samsung Electronics Co., Ltd., or Logitech International S.A.
  • an object of the present invention to provide a method and apparatus for detecting an automatic input event by analyzing the correlation between data transferred from an application program to a hardware-type of automatic input device and another data transferred from the automatic input device to an operating system, detecting an automatic input event, thereby overcoming limitations of the defense method which uses an API hooking scheme, against the automatic input.
  • a method for detecting an automatic input event including:
  • the event corresponding to the detected data is determined to be transferred from the input device to the computer, processing the event corresponding to the detected data as an abnormal event.
  • a method for detecting an automatic input event including:
  • a method for detecting an automatic input event including:
  • an event monitor module to monitor events that are generated by an input device and transferred to a computer, within a computer operating system
  • an apparatus for detecting an automatic input event including:
  • an event monitor unit for monitoring an event generated by an input device and transferred to a computer
  • a data monitor unit for monitoring data transferred from the computer to the input device
  • an event processor upon receiving the event monitored by the event monitor unit and the data monitored by the data monitor unit for analyzing a correlation between the event and the data, and, if the event is determined to be generated by the data, processing the event generated by the input device as an abnormal event.
  • an apparatus for detecting an automatic input event comprising:
  • an event monitor unit for monitoring events generated by an input device and transferred to a computer to count the number of the events
  • a data monitor unit for monitoring data transferred from the computer to the input device to count the number of the data
  • an event processor upon receiving the count number of the events monitored by the event monitor unit and the count number of the data monitored by the data monitor unit for a predetermined period of time for calculating a difference between the count number of the events and the count number of the data, and, if the calculated difference is less than a predetermined threshold value, processing the events generated by the input device as abnormal events.
  • an apparatus for detecting an automatic input event generated by a hardware-type of automatic input device and inputted to a computer including:
  • an event monitor unit for monitoring events generated by an input device and transferred to a computer to count the number of the events
  • a data monitor unit for monitoring data transferred from the computer to the input device to count the number of the data
  • an event processor upon receiving the count number of the events monitored by the event monitor unit and the count number of the data monitored by the data monitor unit for a predetermined period of time for comparing the count number of the events and the count number of the data with a predetermined threshold value, and, if both the count number of the events and the count number of the data are greater the predetermined threshold value, processing the events generated by the input device as abnormal events.
  • the correlation between the data and the events that are communicated between the computer and the input device is analyzed and the presence or absence of the automatic input event is diagnosed, based on the fundamental operating scheme of the hardware-type of automatic input device.
  • nearly all hardware-type of automatic input devices can be diagnosed unless the communication method between the computer and the input device is fundamentally changed, or unless the hardware itself is newly changed.
  • Fig. 1 is a conceptual view showing a data transmission method using USB keyboard/USB mouse and an automatic input device
  • Fig. 2 illustrates a conceptual view showing the configuration of a computer operating system to perform a method for detecting an automatic input event, in accordance with one embodiment of the present invention
  • Fig. 3 shows a flow chart describing a method for detecting an automatic input event, in accordance with one embodiment of the present invention
  • Fig. 4 provides a flow chart describing a method for detecting an automatic input event, in accordance with another embodiment of the present invention.
  • Fig. 5 presents a flow chart describing a method for detecting an automatic input event, in accordance with still another embodiment of the present invention.
  • Fig. 6 illustrates a conceptual view showing the construction of an apparatus for detecting an automatic input event, in accordance with one embodiment of the present invention.
  • these computer program instructions may also be stored in computers or other programmable data processing equipments-oriented, computer-applicable memory or computer-readable memory, and the instructions stored in the computer-applicable memory or the computer-readable memory may produce a manufactured item which includes an instruction device performing the functions explained in each block of the block diagram or the functions explained in each step of the flow charts.
  • the computer program instructions may be loaded on the computers or other programmable data processing equipments, a series of operation steps may be carried out on the computers or other programmable data processing equipments to generate a process to be run in the computer, and then the instructions loaded on the computers or other programmable data processing equipments may provide steps of executing functions that are explained in each block of the block diagram or in each step of the flow charts.
  • Each block or each step may indicate parts of a module, a segment or a code, which include one or more executable instructions to carry out specific logical functions.
  • functions that are mentioned in blocks or in steps may occur in different sequence.
  • two blocks or two steps that are sequentially illustrated may be performed substantially at the same time, or sometimes may be performed in reverse order depending on the functions.
  • Fig. 1 is a conceptual view showing a data transmission method 100 using USB keyboard/USB mouse and an automatic input device.
  • FIG. 1 shows how data transmission between the computer 110 that supports a universal serial bus (USB) and an automatic input device are performed.
  • USB universal serial bus
  • a hardware device using a USB port communicates with a computer operating system and an application program via an Interrupt interface and a Bulk interface that may be designated and used by Control Endpoints and vendors. Therefore, any input devices using the USB port receive data from the computer operating system or the application program via one of the aforementioned interfaces.
  • an input device such as a mouse or a keyboard
  • only the minimum number of inputs are received from the operating system (e.g., when the Num Lock key is pressed, the operating system transmits control data to the keyboard to turn the Num Lock lamp on or off.), and most operations are usually done by having the input device transmit events to the operating system.
  • an input device 120 is connected to the computer 110 via the USB port.
  • a USB keyboard and a USB mouse 122 using a Control Endpoint 130 that commonly exists in the USB devices, transmit input information to the operating system, and receive information from the operating system. That is, bidirectional (IN/OUT) data transmission is possible between the USB devices and the operating system. Also, an event is generated when a user presses the keyboard or moves the mouse and is then sent to the operating system via an Interrupt IN Endpoint 140.
  • the hardware-type of automatic input devices 124 such as automouse, autoplay and the like cannot make decisions by themselves regarding which kind of a keyboard event or a mouse event needs to be generated, and so they always have to get the control data from exclusive application program that manage them. Therefore, unlike the case of the USB keyboard and the USB mouse 122 that receives the control data from the computer 110 (i.e., OUT direction) only for the initial connection, the automatic input device 124 continuously receives the control data from the computer 110 (OUT direction) via the Control Endpoint 130 even after the initial connection. Alternatively, the control data may be transferred from the computer 110 to the automatic input device 124 using a separate interface such as an Interrupt OUT Endpoint 150, even after the initial connection.
  • a correlation between the control data and the event data can be known and, based on this correlation, automatic inputs that are generated through the hardware-type of automatic input device 124 can be detected. That is, periodic inputs are provided from the exclusive application program and a driver to the hardware-type of automatic input device 124 so as to operate the automatic input device 124, and events corresponding to the periodic inputs are generated from the automatic input device 124, which are then analyzed to detect the automatic inputs.
  • Fig. 2 is a conceptual view showing the configuration of a computer operating system 200 to perform a procedure for detecting an automatic input event, in accordance with one embodiment of the present invention.
  • the computer operating system 200 may be largely divided into kernel level and user level.
  • the kernel level is a key element of the computer operating system that resides in the main memory unit of the computer, and includes special processes for system initialization and interrupt processing, a process monitor, a module for environment exchange between the processes and for generating a new process, and the like. Also, the kernel level includes device drivers to process interrupt signals from an input device connected to the computer.
  • the processes and interrupts are processed at the kernel level, are sent to the application program.
  • the processes and the interrupts are processed in diverse forms before they are sent to the application program.
  • the processes and the interrupts may be delivered in a message form by message queue, or they may be delivered directly as they are without being processed in a message form.
  • the events are processed as an interrupt signal by an interrupt service routine (ISR) located at the kernel level of the computer operating system.
  • ISR interrupt service routine
  • the events processed by ISR are processed via a device driver stack 230 where plural device drivers for driving the input device are gathered, and then transferred to the user level.
  • the events transferred to the user level is either delivered to an application program 240 as they are, or delivered to the application program 240 in a message form through message queue such as system message queue (SMQ), thread message queue (TMQ) or the like.
  • SMQ system message queue
  • TMQ thread message queue
  • the present invention incorporates a data monitor module 220 within the computer operating system 200 to monitor the control data that are transferred from the exclusive application program driving the automatic input devices 300 to the automatic input device 300.
  • the data monitor module 220 may be installed and operated at any position of the user level or kernel level on the computer operating system 200, as long as the data monitor module 220 can monitor the control data.
  • the data monitor module 220 may be a filter driver on the device driver 230 for operating the automatic input device 300, or may be a hooking driver for hooking a specific driver on the device driver 230.
  • the automatic input device 300 receives the control data from the exclusive application program and delivers a corresponding input event to the computer operating system 200.
  • an event monitor module 210 is operated within the computer operating system 200 to monitor the input events that are generated by the automatic input device 300.
  • the event monitor module 210 like the data monitor module 220, may be installed and operated at any position within the computer operating system 200, as long as the event monitor module 210 can monitor events that are transferred from the automatic input device 300 to the application program 240.
  • the event monitor module 210 may be a filter driver on the device driver 230 for operating the automatic input device 300, or may be a hooking driver for hooking a specific driver on the device driver 230.
  • all input events and all control data communicated between the computer operating system 200 and the automatic input device 300 are analyzed through the event monitor module 210 and the data monitor module 220. If the event monitoring module 210 detects that an input event corresponding to the control data detected by the data monitor module 220 is originated from the automatic input device 300, the input event that has been transferred from the automatic input device 300 to the application program 240 is processed as an abnormal event. If any event is processed as the abnormal event, the event may be either disregarded, or the application program 240 for receiving and processing the event may be ended.
  • the number of events that are determined as abnormal is counted, and, if the count number is greater than a predetermined threshold value, all events that are being inputted after that may be either disregarded, or the application program 240 for receiving and processing the events may be ended.
  • a correlation between the control data detected by the data monitor module 220 and the input events detected by the event monitor module 210 can be determined by analyzing whether the number of the control data is equal or proportional to the number of the input events, or whether a particular event is generated periodically and repetitively with respect to a particular control data.
  • the input events may be determined as abnormal.
  • Figs. 3 to 5 are flow charts describing a method for detecting an automatic input event in accordance with embodiments of the present invention.
  • step S310 the event monitor module 210 monitoring the input events that are generated by the input device and transferred to the computer, and the control data monitor module 220 monitoring data that is transferred from the computer to the input device are operated within the computer operating system 200.
  • the event monitor module 210 and the data monitor module 220 may be operated at any positions, if it is possible to monitor the events and the data, respectively, within the computer operating system 200.
  • step S320 while the application program 240 is being operated, the control data transmitted from the computer to the input device and the input events transmitted from the input device to the computer are monitored.
  • step S330 if the data monitor module 220 detects that a specific data is transferred from the computer to the input device, the event monitor module 210 monitors and detects the event transferred from the input devices, and then the event detected by the event monitor module 210 is analyzed in comparison with the specific data detected by the data monitor module 220. If the analysis result shows, in step S340, that there is a direct correlation between the data and the event, a control program goes to step 350 where the event is processed as the abnormal event.
  • the exclusive application program for controlling the automatic input device provides the input devices with the control data instructing the input devices to perform a specific operation, and it is analyzed whether the event corresponding to the control data is generated by the input device. This enables to find out a correlation between a series of specific data transferred to the input device and a series of specific events generated by the input device with respect to the series of specific data.
  • Fig. 4 shows a flow chart describing a method for detecting an automatic input event, in accordance with another embodiment of the present invention.
  • step S410 the event monitor module 210 and the data monitor module 220 are operated within the computer operating system. Then, in step S420, the number of the control data transferred to the input device and the number of the input events transferred from the input device to the computer for a predetermined period of time are counted. After the predetermined period of time elapses, in step S430, the number of the data and the number of the events, which have been counted for that period of time, are compared each other. If the count number of the data and the count number of the events are the same or almost the same, the input device that is currently transferring input events to the computer can be determined as an automatic input device.
  • step S440 if a difference between the count number of the data and the count number of the events is less than a predetermined threshold value, which may indicate that the count number of the data is the same or almost the same as the count number of the events, the input device is the automatic input device, thus in step S450, all events that are generated by the input device are determined as the abnormal events.
  • step S530 if, in step S530, both the count number of the data and the count number of the events are greater than another predetermined threshold value, it means that the input device is the automatic input device, thus in step S540, all events generated by the input device are determined as the abnormal events. Because the computer does not usually transmit a lot of serial data to the input device except for the time of initial connection, if a lot of data is transferred from the computer to the input device, which may be regarded as an abnormal operation, it is determined that the automatic input device is transmitting the automatic inputs to the computer. In this case, all of the input events are either disregarded, or the application program that receives and executes the events being currently inputted is ended.
  • Fig. 6 is a conceptual view showing the configuration of an apparatus 600 for detecting the automatic input event, in accordance with one embodiment of the present invention.
  • the automatic input event detection apparatus 600 includes an event monitor unit 610, a data monitor unit 620, and an event processor 630.
  • the event monitor unit 610 monitors the events that are transferred from the input device such as a keyboard or a mouse to the computer, and counts the number or the size of the events.
  • the data monitor unit 620 monitors the data such as control signals that are transferred from the computer to the input device, and counts the number or the size of the data.
  • the event processor 630 analyzes a correlation between the events and the data monitored by the event monitor unit 610 and the data monitor unit 620, respectively, or analyzes the number or the size of the events and the data, thereby blocking or disregarding the events being transferred from the input device to the computer, or ending the application program being executed on the computer that receives and processes the events being currently inputted.
  • the event processor 630 blocks or disregards the events being currently transferred from the input device to the computer, or ends the application program being executed on the computer that receives and processes events being currently inputted.
  • the automatic input event detection apparatus 600 may be configured in form of one of internal components in the computer, or in form of a separate external device connected to the computer. Also, modules for implementing functions of the event monitor unit 610, the data monitor unit 620 and the event processor 630, which are the components of the automatic input event detection apparatus 600, may be implemented virtually through the configuration of the computer itself, thereby allowing the computer itself to operate as the automatic input event detection apparatus 600.
  • the present invention may be implemented as computer-readable code on a computer-readable recording medium.
  • Any kind of data recording devices that can be read by a computer system may be employed as the computer-readable recoding medium.
  • the computer-readable recording medium may includes ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage unit and the like, and further includes such recording medium which may be implemented in form of a carrier wave (e.g., transmission via Internet).
  • the computer-readable recording medium may be distributed in a networked computer system, and thus, computer-readable codes may be stored and executed in distributed manner.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Human Computer Interaction (AREA)
  • Computer Hardware Design (AREA)
  • User Interface Of Digital Computer (AREA)

Abstract

A method for detecting an automatic input event includes operating an event monitor module to monitor an event that is generated by an input device and transferred to a computer (S310); operating a data monitor module to monitor data that is transferred from the computer to the input device (S320); if data is detected (S330), determining whether an event corresponding to the detected data is transferred from the input device to the computer (S340); and if the event corresponding to the detected data is determined to be transferred from the input device to the computer, processing the event corresponding to the detected data as the automatic input event (S350).

Description

METHOD AND APPARATUS FOR DETECTING AUTOMATIC INPUT EVENT GENERATED BY HARDWARE DEVICE
The present invention relates to a method and apparatus for detecting an automatic input event generated by a hardware device, and more particularly, to a method and apparatus for detecting an automatically inputted event by analyzing a correlation between data transferred from an application program to a hardware-type of automatic input device and an event transferred from the automatic input device to an operating system.
Recent technical advances in ultra high speed Internet network have brought explosive increase in the number of Internet users, and Internet related communication techniques are also continuously evolving into a new phase. Particularly, as network games that are designed for a number of users who access the Internet to play together at the same time have grown popular, game developers, based on the popularity, started releasing a variety of network games.
Among many Internet network games, a massive multiplayer online role playing game (MMORPG) is a game where a number of users access the game server at the same time and each player takes a role in a fantasy or mysterious world which is set in the game to play. Players of the MMORPG game manipulate their own characters and make their ways through diverse events that occur in a continuous story line provided by the game as if the events occurred in the real world. For instance, users may get a higher level by training their characters for the game through hunting or battles, organize a guild with other players, participate in a group battle as part of a team, or purchase items through trade. In most MMORPG games, a character’s level or experience point is increased only by repetitively performing a certain mission such as monster hunting, participating in a battle against enemies, visiting a particular area, etc. Such repetitive missions can be accomplished by fixed, regular mouse motions, repetitive click, repetitive and regular stroke of a specific key on the keyboard, etc.
Meanwhile, automatic input programs such as “automouse”, “autoplay” and the like are now being developed to perform those repetitive missions by automatically creating a mouse event or a keyboard event without the actual input from a user. A problem has arisen, however, as some game players use such an automatic input program to increase their character’s level or experience point. Since repetitive missions can be performed using the automatic input program or automatic input device, without necessarily getting a direct input from a user, one can readily increase his or her character’s level or experience point. However, the manipulation of a character through the automatic input not only destroys fair and just proceeding of the game and breaks down game balance, but also causes serious social problems by allowing unauthorized organizations or parties to sell game items illegally in off-line markets.
In order to prevent an automatic input of the mouse or of the keyboard, a method is currently being used, which involves hooking an application programming interface (API) used to programmatically generate a mouse event or a keyboard event in the automatic input program, and failing the mouse event or the keyboard event if the event affects the game. For example, API called ‘SendInput’ provides a function to programmatically generate the mouse event or the keyboard event, but if there is an automatic input program that uses the API to serve a trick on others as if the mouse event or the keyboard event happened, the SendInput API is hooked to make the event fail when the automatic input program calls the SendInput API, thereby defending the game against the automatic input program.
However, this defense based on the API hooking scheme is useless when the event is generated using hardware-type of automatic input device, not software-type of automatic input device.
Meanwhile, USB devices, with its unique Vendor IDs and product IDs to identify each USB device, may detect, through that unique IDs, a hardware-type of automatic input device that uses a USB port. However, since such IDs are stored in firmware, it is easy to change the IDs, and moreover it is difficult to detect the hardware-type of automatic input device if the hardware-type of automatic input device disguises itself with a commonly used ID value such as Microsoft Corporation, Samsung Electronics Co., Ltd., or Logitech International S.A.
It is, therefore, an object of the present invention to provide a method and apparatus for detecting an automatic input event by analyzing the correlation between data transferred from an application program to a hardware-type of automatic input device and another data transferred from the automatic input device to an operating system, detecting an automatic input event, thereby overcoming limitations of the defense method which uses an API hooking scheme, against the automatic input.
In accordance with a first aspect of the present invention, there is provided a method for detecting an automatic input event including:
operating an event monitor module within a computer operating system to monitor an event that is generated by an input device and transferred to a computer;
operating a data monitor module within the computer operation system to monitor data that is transferred from the computer to the input device;
if the data being transferred to the input device is detected, determining whether an event corresponding to the detected data is transferred from the input device to the computer; and
if the event corresponding to the detected data is determined to be transferred from the input device to the computer, processing the event corresponding to the detected data as an abnormal event.
In accordance with a second aspect of the present invention, there is provided a method for detecting an automatic input event including:
operating an event monitor module within a computer operating system to monitor events that are generated by an input device and transferred to a computer;
operating a data monitor module within the computer operation system to monitor data that are transferred from the computer to the input device;
counting the number of data which are transferred to the input device, the number of data detected by the data monitor module for a predetermined period of time;
counting the number of events detected by the event monitor module for the predetermined period of time;
comparing the number of data detected by the data monitor module with the number of events detected by the event monitor module; and
if a difference between the number of data detected by the data monitor module and the number of events detected by the event monitor module is less than a predetermined threshold, processing the events transferred from the input device to the computer as abnormal events.
In accordance with a third aspect of the present invention, there is provided a method for detecting an automatic input event including:
operating an event monitor module to monitor events that are generated by an input device and transferred to a computer, within a computer operating system;
operating a data monitor module to monitor data that are transferred from the computer to the input device, within the computer operating system;
counting the number of data which are transferred to the input device, the number of data detected by the data monitor module for a predetermined period of time;
counting the number of events detected by the event monitor module for the predetermined period of time; and
if both the number of data detected by the data monitor module and the number of events detected by the event monitor module are greater than a predetermined threshold value, processing the events transferred from the input device to the computer as abnormal events.
In accordance with a fourth aspect of the present invention, there is provided an apparatus for detecting an automatic input event including:
an event monitor unit for monitoring an event generated by an input device and transferred to a computer;
a data monitor unit for monitoring data transferred from the computer to the input device; and
an event processor, upon receiving the event monitored by the event monitor unit and the data monitored by the data monitor unit for analyzing a correlation between the event and the data, and, if the event is determined to be generated by the data, processing the event generated by the input device as an abnormal event.
In accordance with a fifth aspect of the present invention, there is provided an apparatus for detecting an automatic input event comprising:
an event monitor unit for monitoring events generated by an input device and transferred to a computer to count the number of the events;
a data monitor unit for monitoring data transferred from the computer to the input device to count the number of the data; and
an event processor, upon receiving the count number of the events monitored by the event monitor unit and the count number of the data monitored by the data monitor unit for a predetermined period of time for calculating a difference between the count number of the events and the count number of the data, and, if the calculated difference is less than a predetermined threshold value, processing the events generated by the input device as abnormal events.
In accordance with a sixth aspect of the present invention, there is provided an apparatus for detecting an automatic input event generated by a hardware-type of automatic input device and inputted to a computer, including:
an event monitor unit for monitoring events generated by an input device and transferred to a computer to count the number of the events;
a data monitor unit for monitoring data transferred from the computer to the input device to count the number of the data; and
an event processor, upon receiving the count number of the events monitored by the event monitor unit and the count number of the data monitored by the data monitor unit for a predetermined period of time for comparing the count number of the events and the count number of the data with a predetermined threshold value, and, if both the count number of the events and the count number of the data are greater the predetermined threshold value, processing the events generated by the input device as abnormal events.
In accordance with the present invention, the correlation between the data and the events that are communicated between the computer and the input device is analyzed and the presence or absence of the automatic input event is diagnosed, based on the fundamental operating scheme of the hardware-type of automatic input device. As a result, nearly all hardware-type of automatic input devices can be diagnosed unless the communication method between the computer and the input device is fundamentally changed, or unless the hardware itself is newly changed.
The above and other objects and features of the present invention will become apparent from the following description of embodiments, given in conjunction with the accompanying drawings, in which:
Fig. 1 is a conceptual view showing a data transmission method using USB keyboard/USB mouse and an automatic input device;
Fig. 2 illustrates a conceptual view showing the configuration of a computer operating system to perform a method for detecting an automatic input event, in accordance with one embodiment of the present invention;
Fig. 3 shows a flow chart describing a method for detecting an automatic input event, in accordance with one embodiment of the present invention;
Fig. 4 provides a flow chart describing a method for detecting an automatic input event, in accordance with another embodiment of the present invention;
Fig. 5 presents a flow chart describing a method for detecting an automatic input event, in accordance with still another embodiment of the present invention; and
Fig. 6 illustrates a conceptual view showing the construction of an apparatus for detecting an automatic input event, in accordance with one embodiment of the present invention.
The advantages and features of the present invention, and methods of accomplishing these will be clearly understood from the following embodiments taken in conjunction with the accompanying drawings. However, the present invention is not limited to those embodiments but may be implemented in various forms. It should be noted that the present embodiments are provided to make a full disclosure of the invention and also to allow those skilled in the art to know the full scope of the invention. Therefore, the present invention is to be defined only by the scope of the appended claims. Further, like reference numerals identify like or similar elements across the specification.
Also, it should be understood that combinations of all blocks in the accompanying block diagrams or combinations of all steps in the accompanying flow charts could be performed by computer program instructions. These computer program instructions are loaded on processors of a general-purpose computer, a special-purpose computer, or other programmable data processing equipments, and the instructions performed through the processors of the computers or other programmable data processing equipments generate schemes for performing the functions that are explained in each block of the block diagram or in each step of the flow charts. To implement certain functions with specific way, these computer program instructions may also be stored in computers or other programmable data processing equipments-oriented, computer-applicable memory or computer-readable memory, and the instructions stored in the computer-applicable memory or the computer-readable memory may produce a manufactured item which includes an instruction device performing the functions explained in each block of the block diagram or the functions explained in each step of the flow charts. In addition, since the computer program instructions may be loaded on the computers or other programmable data processing equipments, a series of operation steps may be carried out on the computers or other programmable data processing equipments to generate a process to be run in the computer, and then the instructions loaded on the computers or other programmable data processing equipments may provide steps of executing functions that are explained in each block of the block diagram or in each step of the flow charts.
Each block or each step may indicate parts of a module, a segment or a code, which include one or more executable instructions to carry out specific logical functions. Moreover, it should be noted that, in some alternative embodiments, functions that are mentioned in blocks or in steps may occur in different sequence. For example, two blocks or two steps that are sequentially illustrated may be performed substantially at the same time, or sometimes may be performed in reverse order depending on the functions.
Hereinafter, exemplary embodiments of the present invention will be explained in detail with reference to the accompanying drawings.
Fig. 1 is a conceptual view showing a data transmission method 100 using USB keyboard/USB mouse and an automatic input device.
Particularly, Fig. 1 shows how data transmission between the computer 110 that supports a universal serial bus (USB) and an automatic input device are performed. Generally, a hardware device using a USB port communicates with a computer operating system and an application program via an Interrupt interface and a Bulk interface that may be designated and used by Control Endpoints and vendors. Therefore, any input devices using the USB port receive data from the computer operating system or the application program via one of the aforementioned interfaces. Especially, when an input device such as a mouse or a keyboard is used, only the minimum number of inputs are received from the operating system (e.g., when the Num Lock key is pressed, the operating system transmits control data to the keyboard to turn the Num Lock lamp on or off.), and most operations are usually done by having the input device transmit events to the operating system.
Referring to Fig. 1, an input device 120 is connected to the computer 110 via the USB port. At this time, a USB keyboard and a USB mouse 122, using a Control Endpoint 130 that commonly exists in the USB devices, transmit input information to the operating system, and receive information from the operating system. That is, bidirectional (IN/OUT) data transmission is possible between the USB devices and the operating system. Also, an event is generated when a user presses the keyboard or moves the mouse and is then sent to the operating system via an Interrupt IN Endpoint 140. Therefore, in case of using the USB keyboard and the USB mouse 122, IN/OUT communication takes place via the Control Endpoint 130 only for the initial connection, and thereafter, most operations, i.e., event transmissions are performed using the Interrupt IN Endpoint 140 only in ‘IN’ direction from the input device 120 to the computer 110.
However, the hardware-type of automatic input devices 124 such as automouse, autoplay and the like cannot make decisions by themselves regarding which kind of a keyboard event or a mouse event needs to be generated, and so they always have to get the control data from exclusive application program that manage them. Therefore, unlike the case of the USB keyboard and the USB mouse 122 that receives the control data from the computer 110 (i.e., OUT direction) only for the initial connection, the automatic input device 124 continuously receives the control data from the computer 110 (OUT direction) via the Control Endpoint 130 even after the initial connection. Alternatively, the control data may be transferred from the computer 110 to the automatic input device 124 using a separate interface such as an Interrupt OUT Endpoint 150, even after the initial connection.
Therefore, by monitoring both the control data that are transferred from the computer 110 to the input device 120 and event data that are transferred from the input device 120 to the computer 110, a correlation between the control data and the event data can be known and, based on this correlation, automatic inputs that are generated through the hardware-type of automatic input device 124 can be detected. That is, periodic inputs are provided from the exclusive application program and a driver to the hardware-type of automatic input device 124 so as to operate the automatic input device 124, and events corresponding to the periodic inputs are generated from the automatic input device 124, which are then analyzed to detect the automatic inputs.
Based on the above principles, a method for detecting an automatic input event in accordance with one embodiment of the present invention will now be explained in more detail.
Fig. 2 is a conceptual view showing the configuration of a computer operating system 200 to perform a procedure for detecting an automatic input event, in accordance with one embodiment of the present invention.
The computer operating system 200 may be largely divided into kernel level and user level. The kernel level is a key element of the computer operating system that resides in the main memory unit of the computer, and includes special processes for system initialization and interrupt processing, a process monitor, a module for environment exchange between the processes and for generating a new process, and the like. Also, the kernel level includes device drivers to process interrupt signals from an input device connected to the computer.
Meanwhile, various kinds of application programs within the computer operating system are driven at the user level, and the processes and interrupts, which are processed at the kernel level, are sent to the application program. Here, the processes and the interrupts are processed in diverse forms before they are sent to the application program. For example, the processes and the interrupts may be delivered in a message form by message queue, or they may be delivered directly as they are without being processed in a message form.
As one example, when a user uses the keyboard or the mouse as the input device to generate input events, the events are processed as an interrupt signal by an interrupt service routine (ISR) located at the kernel level of the computer operating system. The events processed by ISR are processed via a device driver stack 230 where plural device drivers for driving the input device are gathered, and then transferred to the user level. The events transferred to the user level is either delivered to an application program 240 as they are, or delivered to the application program 240 in a message form through message queue such as system message queue (SMQ), thread message queue (TMQ) or the like. The application program 240 that receives the events performs the corresponding processes.
As discussed earlier, a hardware type of automatic input device 300 cannot generate the input events alone, and requires the exclusive application program to drive itself. Thus, the present invention incorporates a data monitor module 220 within the computer operating system 200 to monitor the control data that are transferred from the exclusive application program driving the automatic input devices 300 to the automatic input device 300. The data monitor module 220 may be installed and operated at any position of the user level or kernel level on the computer operating system 200, as long as the data monitor module 220 can monitor the control data. For instance, the data monitor module 220 may be a filter driver on the device driver 230 for operating the automatic input device 300, or may be a hooking driver for hooking a specific driver on the device driver 230.
The automatic input device 300 receives the control data from the exclusive application program and delivers a corresponding input event to the computer operating system 200. Here, an event monitor module 210 is operated within the computer operating system 200 to monitor the input events that are generated by the automatic input device 300. The event monitor module 210, like the data monitor module 220, may be installed and operated at any position within the computer operating system 200, as long as the event monitor module 210 can monitor events that are transferred from the automatic input device 300 to the application program 240. For instance, the event monitor module 210 may be a filter driver on the device driver 230 for operating the automatic input device 300, or may be a hooking driver for hooking a specific driver on the device driver 230.
Therefore, all input events and all control data communicated between the computer operating system 200 and the automatic input device 300 are analyzed through the event monitor module 210 and the data monitor module 220. If the event monitoring module 210 detects that an input event corresponding to the control data detected by the data monitor module 220 is originated from the automatic input device 300, the input event that has been transferred from the automatic input device 300 to the application program 240 is processed as an abnormal event. If any event is processed as the abnormal event, the event may be either disregarded, or the application program 240 for receiving and processing the event may be ended.
Alternatively, the number of events that are determined as abnormal is counted, and, if the count number is greater than a predetermined threshold value, all events that are being inputted after that may be either disregarded, or the application program 240 for receiving and processing the events may be ended.
Meanwhile, a correlation between the control data detected by the data monitor module 220 and the input events detected by the event monitor module 210 can be determined by analyzing whether the number of the control data is equal or proportional to the number of the input events, or whether a particular event is generated periodically and repetitively with respect to a particular control data.
Also, as mentioned earlier, it is abnormal case that the greater number of data than the predetermined threshold value is transferred from the computer to the input device. Thus, if the number of the control data detected by the data monitor module 220 and the number of the input events detected by the event monitor module 210 are greater than the predetermined threshold value, the input events may be determined as abnormal.
Now, the method for detecting the automatic input event in accordance with embodiments of the present invention will be described in more detail, step by step, with reference to Figs. 3 to 5.
Figs. 3 to 5 are flow charts describing a method for detecting an automatic input event in accordance with embodiments of the present invention.
Referring to Fig. 3, first, in step S310, the event monitor module 210 monitoring the input events that are generated by the input device and transferred to the computer, and the control data monitor module 220 monitoring data that is transferred from the computer to the input device are operated within the computer operating system 200. In this case, the event monitor module 210 and the data monitor module 220 may be operated at any positions, if it is possible to monitor the events and the data, respectively, within the computer operating system 200.
Next, in step S320, while the application program 240 is being operated, the control data transmitted from the computer to the input device and the input events transmitted from the input device to the computer are monitored.
Subsequently, in step S330, if the data monitor module 220 detects that a specific data is transferred from the computer to the input device, the event monitor module 210 monitors and detects the event transferred from the input devices, and then the event detected by the event monitor module 210 is analyzed in comparison with the specific data detected by the data monitor module 220. If the analysis result shows, in step S340, that there is a direct correlation between the data and the event, a control program goes to step 350 where the event is processed as the abnormal event.
In short, the exclusive application program for controlling the automatic input device provides the input devices with the control data instructing the input devices to perform a specific operation, and it is analyzed whether the event corresponding to the control data is generated by the input device. This enables to find out a correlation between a series of specific data transferred to the input device and a series of specific events generated by the input device with respect to the series of specific data.
Fig. 4 shows a flow chart describing a method for detecting an automatic input event, in accordance with another embodiment of the present invention.
First, in step S410, the event monitor module 210 and the data monitor module 220 are operated within the computer operating system. Then, in step S420, the number of the control data transferred to the input device and the number of the input events transferred from the input device to the computer for a predetermined period of time are counted. After the predetermined period of time elapses, in step S430, the number of the data and the number of the events, which have been counted for that period of time, are compared each other. If the count number of the data and the count number of the events are the same or almost the same, the input device that is currently transferring input events to the computer can be determined as an automatic input device. That is, in step S440, if a difference between the count number of the data and the count number of the events is less than a predetermined threshold value, which may indicate that the count number of the data is the same or almost the same as the count number of the events, the input device is the automatic input device, thus in step S450, all events that are generated by the input device are determined as the abnormal events.
Alternatively, in accordance with another embodiment of the present invention illustrated in Fig. 5, if, in step S530, both the count number of the data and the count number of the events are greater than another predetermined threshold value, it means that the input device is the automatic input device, thus in step S540, all events generated by the input device are determined as the abnormal events. Because the computer does not usually transmit a lot of serial data to the input device except for the time of initial connection, if a lot of data is transferred from the computer to the input device, which may be regarded as an abnormal operation, it is determined that the automatic input device is transmitting the automatic inputs to the computer. In this case, all of the input events are either disregarded, or the application program that receives and executes the events being currently inputted is ended.
Hereinafter, an apparatus for detecting the automatic input event in accordance with one embodiment of the present invention will now be explained.
Fig. 6 is a conceptual view showing the configuration of an apparatus 600 for detecting the automatic input event, in accordance with one embodiment of the present invention.
The automatic input event detection apparatus 600 includes an event monitor unit 610, a data monitor unit 620, and an event processor 630. The event monitor unit 610 monitors the events that are transferred from the input device such as a keyboard or a mouse to the computer, and counts the number or the size of the events. The data monitor unit 620 monitors the data such as control signals that are transferred from the computer to the input device, and counts the number or the size of the data. The event processor 630 analyzes a correlation between the events and the data monitored by the event monitor unit 610 and the data monitor unit 620, respectively, or analyzes the number or the size of the events and the data, thereby blocking or disregarding the events being transferred from the input device to the computer, or ending the application program being executed on the computer that receives and processes the events being currently inputted.
If there is a direct correlation between the events monitored by the event monitor unit 610 and the data monitored by the data monitor unit 620, or if the number of the events and the number of the data detected for the predetermined period of time are the same or almost the same, or if the number of the events and the number of the data detected for the predetermined period of time are greater than the another predetermined threshold value, the event processor 630 blocks or disregards the events being currently transferred from the input device to the computer, or ends the application program being executed on the computer that receives and processes events being currently inputted.
The automatic input event detection apparatus 600 may be configured in form of one of internal components in the computer, or in form of a separate external device connected to the computer. Also, modules for implementing functions of the event monitor unit 610, the data monitor unit 620 and the event processor 630, which are the components of the automatic input event detection apparatus 600, may be implemented virtually through the configuration of the computer itself, thereby allowing the computer itself to operate as the automatic input event detection apparatus 600.
The present invention may be implemented as computer-readable code on a computer-readable recording medium. Any kind of data recording devices that can be read by a computer system may be employed as the computer-readable recoding medium. Examples of the computer-readable recording medium may includes ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage unit and the like, and further includes such recording medium which may be implemented in form of a carrier wave (e.g., transmission via Internet). Also, the computer-readable recording medium may be distributed in a networked computer system, and thus, computer-readable codes may be stored and executed in distributed manner.
While the invention has been shown and described with respect to the embodiments, it will be understood by those skilled in the art that various changes and modification may be made without departing from the scope of the invention as defined in the following claims.

Claims (20)

  1. A method for detecting an automatic input event comprising:
    operating an event monitor module within a computer operating system to monitor an event that is generated by an input device and transferred to a computer;
    operating a data monitor module within the computer operation system to monitor data that is transferred from the computer to the input device;
    if the data being transferred to the input device is detected, determining whether an event corresponding to the detected data is transferred from the input device to the computer; and
    if the event corresponding to the detected data is determined to be transferred from the input device to the computer, processing the event corresponding to the detected data as an abnormal event.
  2. The method of claim 1, wherein the event monitor module is installed at a position on a device driver stack within the computer operating system related to the input device.
  3. The method of claim 2, wherein the event monitor module is a filter driver that is operated at any position on the device driver stack in order to filter the event from the input device.
  4. The method of claim 2, wherein the event monitor module is a hooking driver that monitors the event from the input device by hooking any driver existing on the device driver stack.
  5. The method of claim 1, wherein the data monitor module is operated at a position on a device driver stack within the computer operating system related to the input device.
  6. The method of claim 5, wherein the data monitor module is a filter driver that is operated at any position on the device driver stack in order to filter the data from the input device.
  7. The method of claim 5, wherein the data monitor module is a hooking driver that monitors the data transferred to the input device by hooking any driver existing on the device driver stack.
  8. The method of claim 1, wherein if the event transferred from the input device is determined as the abnormal event, said processing the event as the abnormal event includes disregarding the event or ending an application program that receives and processes the event.
  9. The method of claim 1, wherein said processing the event as the abnormal event includes:
    if the event transferred from the input device is determined as the abnormal event, increasing a monitor counter value; and
    if the monitor counter value is greater than a predetermined threshold value, disregarding the event or ending an application program that receives and processes the event.
  10. A method for detecting an automatic input event comprising:
    operating an event monitor module within a computer operating system to monitor events that are generated by an input device and transferred to a computer;
    operating a data monitor module within the computer operation system to monitor data that are transferred from the computer to the input device;
    counting the number of data which are transferred to the input device, the number of data detected by the data monitor module for a predetermined period of time;
    counting the number of events detected by the event monitor module for the predetermined period of time;
    comparing the number of data detected by the data monitor module with the number of events detected by the event monitor module; and
    if a difference between the number of data detected by the data monitor module and the number of events detected by the event monitor module is less than a predetermined threshold, processing the events transferred from the input device to the computer as abnormal events.
  11. The method of claim 10, wherein if the events transferred from the input device are determined as the abnormal events, said processing the events as the abnormal events includes disregarding the events or ending an application program that receives and processes the events.
  12. A method for detecting an automatic input event comprising:
    operating an event monitor module within a computer operating system to monitor events that are generated by an input device and transferred to a computer;
    operating a data monitor module within the computer operation system to monitor data that are transferred from the computer to the input device;
    counting the number of data which are transferred to the input device, the number of data detected by the data monitor module for a predetermined period of time;
    counting the number of events detected by the event monitor module for the predetermined period of time; and
    if both the number of data detected by the data monitor module and the number of events detected by the event monitor module are greater than a predetermined threshold value, processing the events transferred from the input device to the computer as abnormal events.
  13. The method of claim 12, wherein if the events transferred from the input device are determined as the abnormal events, said processing the events as the abnormal events includes disregarding the events or ending an application program that receives and processes the events.
  14. A computer-readable recording medium for storing a computer program to perform the method of any one of claims 1 to 13 on a computer.
  15. An apparatus for detecting an automatic input event comprising:
    an event monitor unit for monitoring an event generated by an input device and transferred to a computer;
    a data monitor unit for monitoring data transferred from the computer to the input device; and
    an event processor, upon receiving the event monitored by the event monitor unit and the data monitored by the data monitor unit for analyzing a correlation between the event and the data, and, if the event is determined to be generated by the data, processing the event generated by the input device as an abnormal event.
  16. The apparatus of claim 15, wherein if the event generated by the input device is determined as the abnormal event, the event processor disregards the event or ends an application program that receives and processes the event.
  17. An apparatus for detecting an automatic input event comprising:
    an event monitor unit for monitoring events generated by an input device and transferred to a computer to count the number of the events;
    a data monitor unit for monitoring data transferred from the computer to the input device to count the number of the data; and
    an event processor, upon receiving the count number of the events monitored by the event monitor unit and the count number of the data monitored by the data monitor unit for a predetermined period of time for calculating a difference between the count number of the events and the count number of the data, and, if the calculated difference is less than a predetermined threshold value, processing the events generated by the input device as abnormal events.
  18. The apparatus of claim 17, wherein if the events generated by the input device are determined as the abnormal events, the event processor disregards the events or ends an application program that receives and processes the events.
  19. An apparatus for detecting an automatic input event comprising:
    an event monitor unit for monitoring events generated by an input device and transferred to a computer to count the number of the events;
    a data monitor unit for monitoring data transferred from the computer to the input device to count the number of the data; and
    an event processor, upon receiving the count number of the events monitored by the event monitor unit and the count number of the data monitored by the data monitor unit for a predetermined period of time for comparing the count number of the events and the count number of the data with a predetermined threshold value, and, if both the count number of the events and the count number of the data are greater the predetermined threshold value, processing the events generated by the input device as abnormal events.
  20. The apparatus of claim 19, wherein if the events generated by the input device are determined as the abnormal events, the event processor disregards the events or ends an application program that receives and processes the events.
PCT/KR2009/001425 2009-03-19 2009-03-19 Method and apparatus for detecting automatic input event generated by hardware device WO2010107149A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/KR2009/001425 WO2010107149A1 (en) 2009-03-19 2009-03-19 Method and apparatus for detecting automatic input event generated by hardware device

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/KR2009/001425 WO2010107149A1 (en) 2009-03-19 2009-03-19 Method and apparatus for detecting automatic input event generated by hardware device

Publications (1)

Publication Number Publication Date
WO2010107149A1 true WO2010107149A1 (en) 2010-09-23

Family

ID=42739802

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/KR2009/001425 WO2010107149A1 (en) 2009-03-19 2009-03-19 Method and apparatus for detecting automatic input event generated by hardware device

Country Status (1)

Country Link
WO (1) WO2010107149A1 (en)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20040004319A (en) * 2003-12-19 2004-01-13 윤성일 Computer input signal repeater
EP1418725A2 (en) * 2002-11-09 2004-05-12 Microsoft Corporation Detection method based on the challenge and response principle between a server and a client and memory media thereof
KR20060059757A (en) * 2004-11-29 2006-06-02 주식회사 안철수연구소 Preventing method of computer programmed automatic input
US7177958B1 (en) * 2003-12-19 2007-02-13 Microsoft Corporation Automated input determination
WO2008020710A1 (en) * 2006-08-16 2008-02-21 Ahnlab., Inc. Method for detecting automatically generated input signals and apparatus thereof

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1418725A2 (en) * 2002-11-09 2004-05-12 Microsoft Corporation Detection method based on the challenge and response principle between a server and a client and memory media thereof
KR20040004319A (en) * 2003-12-19 2004-01-13 윤성일 Computer input signal repeater
US7177958B1 (en) * 2003-12-19 2007-02-13 Microsoft Corporation Automated input determination
KR20060059757A (en) * 2004-11-29 2006-06-02 주식회사 안철수연구소 Preventing method of computer programmed automatic input
WO2008020710A1 (en) * 2006-08-16 2008-02-21 Ahnlab., Inc. Method for detecting automatically generated input signals and apparatus thereof

Similar Documents

Publication Publication Date Title
KR101717494B1 (en) Apparatus and Method for processing interrupt
US6263392B1 (en) Method and apparatus for interfacing multiple peripheral devices to a host computer
CN101669101B (en) Bluetooth enabled computing system and associated methods
US6782411B2 (en) Virtualizing and controlling input and output of computer programs
US9498722B2 (en) User organizing apparatus, user organizing method, and cloud computing system
US20100255917A1 (en) Game system, game apparatus, game server, and recording medium recorded with a program for games
US20020072410A1 (en) Information processing system comprising a plurality of operation terminal devices and an information processing device
WO2013054983A1 (en) Apparatus and method for detecting abnormal account
WO2018236099A1 (en) Method and apparatus for detecting macro-program
WO2017171270A1 (en) Device for transmitting game application program and resource file between smart devices, application program, and transmission method therefor
AU2001278682A1 (en) Information processing system comprising a plurality of operation terminal devices and an information processing device
WO2018030554A1 (en) Method and system for providing message-based notification
WO2013054980A1 (en) Apparatus and method for detecting abnormal account
WO2014077454A1 (en) Method for providing game replay, game replay-providing server for performing the method, and recording medium for saving same
US5469570A (en) System for examining statuses of tasks when one task is interrupted in data processing system
KR100976861B1 (en) Method for detecting automatic input generated by hardware device and apparatus thereof
WO2010107149A1 (en) Method and apparatus for detecting automatic input event generated by hardware device
US9977795B1 (en) System and method for multiplayer network gaming
WO2013085206A1 (en) Online sport game providing method for providing rating and prediction information, and system therefor
CN110099051B (en) Detection method and device for stuck risk and electronic equipment
WO2021020746A1 (en) Apparatus and method for managing virtual machine
WO2022270861A1 (en) Streaming betting game method and system
CN102262708A (en) Method for displaying information about use of hack tool in online game
WO2013085195A1 (en) Method and server for providing items according to event participation in an online game
WO2022201281A1 (en) License management device, license management method, and computer program

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09841933

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09841933

Country of ref document: EP

Kind code of ref document: A1