800 likes | 813 Views
On Statistical Approaches to Online Game Bot Detection. P9592205 廖宜財 Advisor: 朱浩華 博士 Co-advisor: 陳昇瑋 博士 Date: 2009/7/21. Outlines. Introduction Related Work FPS Bots Detection Rhythm Bot Detection Future Work Conclusion. MMOG.
E N D
On Statistical Approaches to Online Game Bot Detection P9592205 廖宜財 Advisor: 朱浩華 博士 Co-advisor: 陳昇瑋 博士 Date: 2009/7/21
Outlines • Introduction • Related Work • FPS Bots Detection • Rhythm Bot Detection • Future Work • Conclusion
MMOG • MMOG (Massively Multiplayer Online Game) has become the most popular Internet activities www.mic.iii.org.tw
MMOG Genres • RPG (Role Playing Game) • SLG (Simulation game) • FPS (First-Player-Shooter) Game • Gaming • Rhythm Game • …
Major Challenge: Cheating • Why cheating? • Get profit from game • Self-transcendence • Game cheating types • Hacker/Game exploits • Expert Programmers • Serious, but can be prevented by hardware/game architecture • Game Bots • AI programs that can perform some tasks in place of gamers • Everyone can download and use it!
Game Bots • Unfair competition • Bots accumulating rewards efficiently in 24 hours a day • Economy problem • Easy money Currency inflation • Reduce new-comers to join • Game provider will close the game
The Challenge of Bot Detection • Hard to detect • Bots obeys the game rules perfectly • No general detection methods are available today Internet
Our Goal for Bot Detection • Propose bot detect approaches as general as possible • Passive detection • No intrusion in players’ gaming experience • No client software is required
Related Work - Bot Prevention (1/2) • Human intelligence • Detection: Bots may show regular or peculiar behavior • Confirmation: Most of bots will off-line immediately while detect GM (Game Master) • Pros and cons • Easy • A lot of GM, a lot of salary • Judge by subjective feeling of GM
Related Work - Bot Prevention (2/2) • CAPTCHA tests (Completely Automated Public Turing test to tell Computer and Human Apart) • Bots are hard to recognize distorted images • Pros and cons • Accurately • Annoy innocent players
Related Work - Bot Detection • Process monitoring at client side • Constantly changing the bot program’s signature • Traffic analysis at the network • Remove bot traffic’s regularity by heavy-tailed random delays • Aiming-bot detection using Dynamic Bayesian Network • Specific to aiming bots that help aim the target accurately
Progress • Introduction • Related Works • FPS Bots Detection • Rhythm Bot Detection • Future Work • Conclusion
Quake 2 • A classic FPS game • “The Best Game Ever” by PC Gamer in 1998 • Sell over one million copies • Many real-life human traces are available on the Internet • There are in-game recording functions • Open source (include Quake 3) • Scholarly research • A lot of bots
Data Collection (1/2) • Human traces can be downloaded from websites • Competition records • Experience shared • To show off themselves • Traces downloaded from: GotFrag Quake Planet Quake Revilla Quake Sites Demo Squad http://www.gotfrag.com/ http://planetquake.gamespy.com/ http://q2scene.net/ds/ http://www.revilla.nildram.co.uk/
Data Collection (2/2) • Bot traces collected on our own Quake server • CR BOT 1.14 (http://arton.cunst.net/quake/crbot/) • Eraser Bot 1.01 (http://impact.frag.com) • ICE Bot 1.0 (http://planetquake.com/ice) • For automation, we implement a bot-launcher program • Launch Quake 2 and bot program • Monitor the time spent • Create bots • Select bot’s AI • …
Screen Shot of “Q2BotLauncher” *Bots selection Game map name *In-game trace recording file name
Trace Data Description • Quake 2 official trace format • DM2 • Types of dm2 file format • Client side recording • Player point of view • Replay-able • Server side recording • Server point of view • Non-replay-able Players’ traces Bots’ traces
DM2 Format Reference • Source packages from Id-soft • The newest release from the end of November 1998 with both Mission Packs • Plain game • Linux version: ftp://ftp.idsoftware.com/pub/quake2/source/q2src320.shar.Z • Windows version: ftp://ftp.idsoftware.com/pub/quake2/source/q2src320.exe • Xatrix Quake II Mission Pack 1 • Linux version: ftp://ftp.idsoftware.com/pub/quake2/source/xatrixsrc320.shar.Z • Windows version: ftp://ftp.idsoftware.com/pub/quake2/source/xatrixsrc320.exe • Rouge Quake II Mission Pack 2: • Linux version: ftp://ftp.idsoftware.com/pub/quake2/source/roguesrc320.shar.Z • Windows version: ftp://ftp.idsoftware.com/pub/quake2/source/roguesrc320.exe
Parsing Example of DM2 MsgID Block size Frame Move EOF
Example: Frame Move Server frame Frame Move Area bits Read n bytes Delta frame Position View Angle Weapon Player tag # Entity Entity data State Read size *2 byte state Total entity 0x80=need next byte Player-flags, need parse that for other player data Package entity tag
Tools We Developed • DM2 Parser • DM2 is inconvenient to parse by Statistical tools • Filter out the information we don’t need • Convert traces to a CSV file format • 3D trace viewer • Quake 2 is 3D game, we need observe traces in 3D space to figure out trace features
DM2 Parser Output (Time) (X, Y, Z)
Data Summary • Each cut into 1,000-second segments • Totally 143.8 hours of traces were collected ICE bot tends to stay in a place, and try to ambush other players
Our Solution: Trajectory-based Detection • Based on the avatar’s moving trajectory in game • Applicable for all genres of games where players control the avatar’s movement directly • Avatar’s trajectory is high-dimensional (both in time and spatial domains)
The Rationale behind Our Scheme • The trajectory of the avatar controlled by a human player is hard to simulate for two reasons: • Complex context information: Players control the movement of avatars based on their knowledge, experience, intuition, and a great deal of information provided in the game. • Human is not always logical and optimal • How to model and simulate realistic movements is still an open question in the AI field?!
Data Representation • We give up the z value of trace • Avatar moving on ground, unless fall/climb, the z-vale is not changed (X, Y) t (X, Y) (X, Y) (X, Y)
Trails of CRBot Building, obstacles Color density= visit frequency
Trails of Human Players Human tend to explore all areas For finding items Human players normally avoid open area For safety Human players spent more time in narrow area For safety
Individual Trajectory • Human tend to turn their directions continuously and slightly • Searching • Quick movement CRBOT Human player Eraser Bot ICE Bot
Detection Scheme • Feature Based • Given a segment of a trajectory, {xt, yt}, 1 ≤ t ≤ T, we extract the following features from this two-dimensional time series • ON/OFF Activity • Pace • Path • Turn • SVM classifier
ON/OFF Activity • Move (ON) or stop (OFF) • We define ON periods as consecutive periods of movement longer than 1 second, and OFF periods as the remaining time frames
Pace • Avatars are allowed to move at different speeds • Running, slow walking, step-by-step walking, lateral shifting, and moving backwards • Fast move • The SD paces > 10 units • Teleportation frequency • Some players are like to jump into teleport for quick and long distance moving, some are not • Bots has their probability to do that • Avatar die • Offset in one second >= 60 units
Path: Linger • Why linger? • Waiting for item spawn • Dog-fight with enemies • Subconscious • Linger definition (t1, x1, y1) | t1-t2 | > 30 sec. and < 300 units (t2, x2, y2)
Path: Smoothness • Avatar moves in straight or zig-zag patterns • In dog-fight, it is clearly more ‘zig-zag’ • Follow the cover, it is more ‘zig-zag’ • Subconscious • Smoothness definition (t1, x1, y1) The number of times the avatar moves across the line (x1, y1)-(x2,y2) during the period (t1,t2) (t2, x2, y2)
Path: Detourness • The effectiveness of avatar’s movements • Detourness definition (t1, x1, y1) length of the movement (t2, x2, y2)
Turn • The frequency and amplitude of how avatars change direction • Turn definition (t1, x1, y1) t3 - t2 = t2 - t1 θ>= 30° θ>= 60° θ>= 90° (t2, x2, y2) θ (t3, x3, y3)
Evaluation (1/2): Bot Detection Accuracy is > 90% Good accuracy Time > 800 Result is ok
Evaluation (2/2): Player-Type Classification Accuracy > 90% Accuracy > 98% Good accuracy
Progress • Introduction • Related Work • FPS Bots Detection • Rhythm Bot Detection • Future Work • Conclusion
Casual Game • Simple and easy gameplay • Poker, puzzle… • Short term • Quickly reach final stage during work break • Free (Item mall)
Market Scale of Casual Game in Taiwan www.mic.iii.org.tw
Rhythm Game • One of the most popular game in casual games