Method for detecting abnormal device operation and electronic device

Abstract

The present invention provides a method and electronic device for detecting abnormal device operation. The method comprises: obtaining multiple motion events of a movable input device, each motion event including relative coordinates and a timestamp of the movable input device; generating multiple absolute coordinates based on the relative coordinates of each motion event; estimating multiple velocity vectors based on the multiple absolute coordinates and the timestamp of each motion event; estimating multiple acceleration vectors based on the multiple velocity vectors and the timestamp of each motion event; and estimating the probability of abnormal operation based on the multiple velocity vectors and the multiple acceleration vectors. This method allows game administrators to effectively identify which players' mobile devices may have scripts installed in their firmware, thereby better maintaining game fairness.

Description

Technical Field

[0001] The present invention relates to a mechanism for detecting device operation, and more particularly to a method and an electronic device for detecting abnormal device operation. Background Art

[0002] In today's online gaming industry, having players team up to compete against each other is a common gameplay method. However, competitive games often test players' acquired skills through practice. In this context, exploiting additional software and hardware to gain an unfair advantage is often a major factor in undermining healthy competition in games. Therefore, timely detection and identification of players using these methods can better ensure game fairness.

[0003] Generally speaking, players who use the aforementioned methods to play games often do so with the help of auxiliary scripting tools (hereinafter referred to as scripts). From a system-level perspective, scripts can be broadly categorized into two types: software-level and firmware-level.

[0004] At the software level, scripts are programs that run on the operating system of a gaming device (e.g., a computer). At the firmware level, players or other stakeholders can install scripts within the firmware of a hardware device (e.g., a mouse) to directly output signals to the gaming device.

[0005] Existing anti-cheat software systems, such as VAC (Valve Anti-Cheat) and BattleEye, can proactively detect tool software running in parallel with the main game program. These methods include scanning system threads, checking for system file tampering, and abnormal network packets. However, since firmware-level scripts do not utilize any of these methods, other methods are required for detection. Summary of the Invention

[0006] In view of this, the present invention provides a method and an electronic device for detecting abnormal device operation, which can be used to solve the above technical problems.

[0007] The present invention provides a method for detecting abnormal device operation, which is suitable for an electronic device connected to a movable input device. The method includes: obtaining action data of the movable input device, wherein the action data includes multiple action events, and each action event includes a relative coordinate of the movable input device and a timestamp; generating multiple absolute coordinates corresponding to the action data based on the relative coordinates of each action event; estimating multiple velocity vectors corresponding to the action data based on the multiple absolute coordinates and the timestamp of each action event; estimating multiple acceleration vectors corresponding to the action data based on the multiple velocity vectors and the timestamp of each action event; and estimating a probability that the action data corresponds to an abnormal operation based on the multiple velocity vectors and the multiple acceleration vectors.

[0008] The present invention provides an electronic device comprising a storage circuit and a processor. The storage circuit stores a program code. The processor is coupled to the storage circuit and loads the program code to execute the following steps: obtaining motion data of a movable input device, wherein the motion data includes a plurality of motion events, and each motion event includes a relative coordinate of the movable input device and a timestamp; generating a plurality of absolute coordinates corresponding to the motion data based on the relative coordinates of each motion event; estimating a plurality of velocity vectors corresponding to the motion data based on the plurality of absolute coordinates and the timestamp of each motion event; estimating a plurality of acceleration vectors corresponding to the motion data based on the plurality of velocity vectors and the timestamp of each motion event; and estimating a probability that the motion data corresponds to an abnormal operation based on the plurality of velocity vectors and the plurality of acceleration vectors. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The accompanying drawings are included to provide a further understanding of the present invention and are incorporated in and constitute a part of this specification. The drawings illustrate embodiments of the present invention and together with the description serve to explain the principles of the present invention.

[0010] Figure 1 is a schematic diagram showing an electronic device and a movable input device according to an embodiment of the present invention;

[0011] Figure 2 FIG. 4 is a flow chart of a method for detecting abnormal device operation according to an embodiment of the present invention. DETAILED DESCRIPTION

[0012] Please refer to Figure 1 , which is a schematic diagram of an electronic device and a movable input device according to an embodiment of the present invention. In different embodiments, the electronic device 100 is, for example, various devices that can be used to run games, such as computer devices and various smart devices, but is not limited thereto. Figure 1As shown, electronic device 100 can be connected to a movable input device 199. The movable input device 199 can be, for example, any input device that allows a user to control / operate the aforementioned game in a mobile manner, such as, but not limited to, a mouse device or other similar handheld device. For ease of explanation, the following uses a mouse device as an example of the movable input device 199, but this does not limit the possible implementations of the present invention. In other embodiments, the designer can choose to implement the movable input device 199 using any input device that can report coordinates.

[0013] exist Figure 1 In the embodiment, electronic device 100 may include a storage circuit 101, a display 102, and a processor 104. Storage circuit 101 may be, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory, a hard disk, or other similar device, or a combination of these devices, and may be used to store multiple program codes or modules. Display 102 may be, for example, a screen that may be used to display / present the aforementioned game screen / content.

[0014] The processor 104 is coupled to the memory circuit 101 and the display 102 and can be a general-purpose processor, a special-purpose processor, a conventional processor, a digital signal processor, a plurality of microprocessors, one or more microprocessors combined with a digital signal processor core, a controller, a microcontroller, an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA), any other type of integrated circuit, a state machine, an Advanced RISC Machine (ARM)-based processor, and the like.

[0015] In an embodiment of the present invention, the processor 104 may access the modules and program codes recorded in the storage circuit 101 to implement the method for detecting abnormal device operation proposed by the present invention, the details of which are described below.

[0016] Please refer to Figure 2 , which is a flow chart of a method for detecting abnormal device operation according to an embodiment of the present invention. The method of this embodiment can be performed by Figure 1 The electronic device 100 is executed as follows: Figure 1 Description of components shown Figure 2 Details of each step.

[0017] First, in step S210, the processor 104 may obtain the motion data MD of the movable input device 199, wherein the motion data MD may include a plurality of motion events E1-E2. N (N is its number), and each action event E1~E N The relative coordinates of the movable input device 199, the timestamp, and the event type may be included.

[0018] In the embodiment of the present invention, when the movable input device 199 is assumed to be a mouse device, the action data MD is, for example, session data of the mouse device, and the action events E1 to E2 are included in the action data MD. N For example, it may be multiple mouse events of the mouse device.

[0019] In an embodiment of the present invention, the processor 104 may, for example, obtain a default number (i.e., N) of consecutive motion events from the operating system of the electronic device 100 to form the motion data MD of the movable input device 199, but the present invention is not limited thereto. In another embodiment, upon detecting a motion event corresponding to a button press (e.g., pressing the left button) on the mouse device, the processor 104 may obtain N consecutive motion events including this motion event to form the motion data MD of the movable input device 199.

[0020] In other embodiments, upon detecting a motion event corresponding to a key press operation on the mouse device, the processor 104 may combine this motion event and subsequent (N-1) consecutive motion events into motion data MD for the movable input device 199, but the present invention is not limited thereto. In this case, the motion event corresponding to the key press operation may be understood as the first motion event in the motion data, but the present invention is not limited thereto.

[0021] For ease of description, it is assumed below that N is 7, and the N consecutive action events obtained by the processor 104 may have the contents shown in Table 1 below.

[0022] Action Events Relative coordinates Event Type Timestamp (ms) 1 (342,897) Press the left button 74015 2 (339,897) move 74016 3 (334,897) move 74018 4 (333,899) move 74019 5 (326,899) move 74021 6 (324,900) move 74022 7 (319,900) other 74023

[0023] Table 1

[0024] In the scenario of Table 1, the relative coordinates of each action event are, for example, the current cursor position of the mouse cursor of the movable input device 199 on the display 102 of the electronic device 100. For example, assume that the resolution of the display 102 is 1920x1080 and the coordinates of the upper left corner of the display 102 are (0,0). In this case, the coordinates of the cursor position corresponding to action event 1 (i.e., the first action event) on the display 102 are, for example, (342,897); the coordinates of the cursor position corresponding to action event 2 (i.e., the second action event) on the display 102 are, for example, (339,897); and the coordinates of the cursor position corresponding to action event 3 (i.e., the third action event) on the display 102 are, for example, (334,897). The coordinates of the cursor positions on the display 102 for the remaining action events can be inferred based on the above teachings and are not further described here.

[0025] Then, in step S220, the processor 104 may generate a plurality of absolute coordinates corresponding to the motion data MD based on the relative coordinates of each motion event. In one embodiment, the processor 104 may set the first absolute coordinate of the plurality of absolute coordinates to (0, 0) or other desired coordinate values, but is not limited thereto.

[0026] In one embodiment, in the process of obtaining the i+1th absolute coordinate (1≤i≤N-1) among the multiple absolute coordinates, the processor 104 can, for example, subtract the relative coordinates of the i+1th action event from the relative coordinates of the i-th action event and add the i-th absolute coordinate among the above absolute coordinates to generate the i+1th absolute coordinate.

[0027] For example, when i is 1, the processor 104 may, for example, subtract the relative coordinates of the first (i-th) action event from the relative coordinates of the second (i.e., i+1) action event, and add the first (i-th) absolute coordinate of the above absolute coordinates to generate the second (i.e., i+1) absolute coordinate. Taking Table 1 as an example, the processor 104 may, for example, subtract the relative coordinates of action event 1 (i.e., (342,897)) from the relative coordinates of action event 2 (i.e., (339,897)), and add the first absolute coordinate (i.e., (0,0)) to obtain (-3,0) as the second absolute coordinate.

[0028] For another example, when i is 2, the processor 104 may, for example, subtract the relative coordinates of the second (i.e., i-th) action event from the relative coordinates of the third (i.e., i+1th) action event, and add the second (i.e., i-th) absolute coordinate of the above absolute coordinates to generate the third (i.e., i+1th) absolute coordinate. Taking Table 1 as an example, the processor 104 may, for example, subtract the relative coordinates of action event 2 (i.e., (349,897)) from the relative coordinates of action event 3 (i.e., (334,897)), and add the second absolute coordinate (i.e., (-3,0)) to obtain (-8,0) as the third absolute coordinate.

[0029] In addition, when i is 3, the processor 104 may, for example, subtract the relative coordinates of the third (i.e., i-th) action event from the relative coordinates of the fourth (i.e., i+1th) action event, and add the third (i.e., i-th) absolute coordinate of the above absolute coordinates to generate the fourth (i.e., i+1th) absolute coordinate. Taking Table 1 as an example, the processor 104 may, for example, subtract the relative coordinates of action event 3 (i.e., (334,897)) from the relative coordinates of action event 4 (i.e., (333,899)), and add the fourth absolute coordinate (i.e., (-8,0)) to obtain (-9,2) as the third absolute coordinate.

[0030] For other values ​​of i, the processor 104 can obtain the corresponding absolute coordinates based on the above teachings, as shown in Table 2 below.

[0031] Absolute coordinate index value Absolute coordinates 1 (0,0) 2 (-3,0) 3 (-8,0) 4 (-9,2) 5 (-16,2) 6 (-18,3) 7 (-23,3)

[0032] Table 2

[0033] Thereafter, in step S230 , the processor 104 may estimate a plurality of velocity vectors corresponding to the motion data MD based on the plurality of absolute coordinates and the timestamps of the motion events.

[0034] In one embodiment, the processor 104 may set the first velocity vector of the plurality of velocity vectors to (0, 0) or other desired vectors, but is not limited thereto.

[0035] In other embodiments, when 1≤i≤N-1, the processor 104 may subtract the timestamp of the i-th motion event from the timestamp of the i+1-th motion event to generate the i-th time difference among the multiple time differences. Thereafter, the processor 104 may subtract the i-th absolute coordinate from the i+1-th absolute coordinate to generate the i-th coordinate difference among the multiple coordinate differences, and divide the i-th coordinate difference by the i-th time difference to generate the i+1-th velocity vector among the multiple velocity vectors.

[0036] For example, when i is 1, the processor 104 may subtract the timestamp of the first motion event (i.e., 74015ms) from the timestamp of the second motion event (i.e., 74016ms) to generate a first time difference (i.e., 1ms) among the multiple time differences. Thereafter, the processor 104 may subtract the first absolute coordinate (i.e., (0,0)) from the second absolute coordinate (i.e., (-3,0)) to generate a first coordinate difference (i.e., (-3,0)) among the multiple coordinate differences, and divide the first coordinate difference by the first time difference to generate a second velocity vector (i.e., (-3,0)) among the multiple velocity vectors.

[0037] When i is 2, the processor 104 may subtract the timestamp of the second motion event (i.e., 74016ms) from the timestamp of the third motion event (i.e., 74018ms) to generate a second time difference (i.e., 2ms) among the multiple time differences. Thereafter, the processor 104 may subtract the second absolute coordinate (i.e., (-3,0)) from the third absolute coordinate (i.e., (-8,0)) to generate a second coordinate difference (i.e., (-5,0)) among the multiple coordinate differences, and divide the second coordinate difference by the second time difference to generate a third velocity vector (i.e., (-2.5,0)) among the multiple velocity vectors.

[0038] When i is 3, the processor 104 may subtract the timestamp of the third motion event (i.e., 74018 ms) from the timestamp of the fourth motion event (i.e., 74019 ms) to generate a third time difference value (i.e., 1 ms) among the multiple time differences. Thereafter, the processor 104 may subtract the third absolute coordinate (i.e., (-8, 0)) from the fourth absolute coordinate (i.e., (-9, 2)) to generate a third coordinate difference value (i.e., (-1, 2)) among the multiple coordinate differences, and divide the third coordinate difference value by the third time difference to generate a fourth velocity vector (i.e., (-1, 2)) among the multiple velocity vectors.

[0039] For other values ​​of i, the processor 104 may obtain corresponding velocity vectors based on the above teachings, as shown in Table 3 below.

[0040] Absolute coordinate index value Absolute coordinates Velocity vector 1 (0,0) (0,0) 2 (-3,0) (-3.0,0) 3 (-8,0) (-2.5,0) 4 (-9,2) (-1.0,2.0) 5 (-16,2) (-3.5,0) 6 (-18,3) (-2.0,1) 7 (-23,3) (-5.0,0)

[0041] Table 3

[0042] Thereafter, in step S240 , the processor 104 may estimate a plurality of acceleration values ​​corresponding to the motion data MD based on the plurality of velocity values ​​and the timestamps of the respective motion events.

[0043] In one embodiment, the processor 104 may set the first acceleration vector of the plurality of acceleration vectors to (0, 0) or other desired vectors, but is not limited thereto.

[0044] In other embodiments, when 1≤i≤N-1, the processor 104 may subtract the i-th velocity vector from the i+1-th velocity vector to generate the i-th velocity difference value among the plurality of velocity differences. Thereafter, the processor 104 may divide the i-th velocity difference value by the i-th time difference value to generate the i+1-th acceleration vector among the plurality of acceleration vectors.

[0045] For example, when i is 1, the processor 104 may subtract the first velocity vector (i.e., (0, 0)) from the second velocity vector (i.e., (-3.0, 0)) to generate a first velocity difference value (i.e., (-3.0, 0)) among the plurality of velocity differences. Thereafter, the processor 104 may divide the first velocity difference value by the first time difference value (i.e., 1 ms) to generate a second acceleration vector (i.e., (-3.0, 0)) among the plurality of acceleration vectors.

[0046] For another example, when i is 2, the processor 104 may subtract the second velocity vector (i.e., (-3.0, 0)) from the third velocity vector (i.e., (-2.5, 0)) to generate a second velocity difference value (i.e., (0.5, 0)) among the plurality of velocity differences. Subsequently, the processor 104 may divide the second velocity difference value by the second time difference value (i.e., 2 ms) to generate a third acceleration vector (i.e., (0.25, 0)) among the plurality of acceleration vectors.

[0047] When i is 3, the processor 104 may subtract the third velocity vector (i.e., (-2.5, 0)) from the fourth velocity vector (i.e., (-1.0, 2.0)) to generate a third velocity difference value (i.e., (1.5, 2.0)) among the plurality of velocity differences. Thereafter, the processor 104 may divide the third velocity difference value by the third time difference value (i.e., 1 ms) to generate a fourth acceleration vector (i.e., (1.5, 2.0)) among the plurality of acceleration vectors.

[0048] For other values ​​of i, the processor 104 may obtain the corresponding acceleration vector based on the above teachings, as shown in Table 4 below.

[0049] Absolute coordinate index value Absolute coordinates Velocity vector acceleration vector 1 (0,0) (0,0) (0,0) 2 (-3,0) (-3.0,0) (-3.0,0) 3 (-8,0) (-2.5,0) (0.25,0) 4 (-9,2) (-1.0,2.0) (1.5,2.0) 5 (-16,2) (-3.5,0) (-1.25,-1.0) 6 (-18,3) (-2.0,1) (1.5,1.0) 7 (-23,3) (-5.0,0) (-3.0,-1.0)

[0050] Table 4

[0051] Next, in step S250 , the processor 104 may estimate a probability that the motion data MD corresponds to an abnormal operation based on the plurality of velocity values ​​and the plurality of acceleration values.

[0052] In one embodiment, the processor 104 may input the multiple speed values ​​and the multiple acceleration values ​​into a pre-trained machine learning model, wherein the machine learning model may output a probability that the motion data MD corresponds to an abnormal operation in response to the multiple speed values ​​and the multiple acceleration values. In various embodiments, the machine learning model may be implemented using a long short term memory (LSTM) model, a hidden Markov model (HMM), a recurrent neural network (RNN), an attention-based neural network, or other models, but is not limited thereto.

[0053] During the pre-training process of the machine learning model, the processor 104 may, for example, obtain historical motion data corresponding to abnormal operations of the movable input device 199 (which may include N consecutive historical motion events) and convert them into corresponding multiple historical velocity vectors and multiple historical acceleration vectors through the operations taught in steps S220 to S240. Thereafter, the processor 104 may input the multiple historical velocity vectors and the multiple historical acceleration vectors as training data into the machine learning model, so that the machine learning model can accordingly predict the probability that the above-mentioned historical motion data corresponds to abnormal operations. Thereafter, the processor 104 may determine the prediction accuracy of the machine learning model based on this predicted probability, and then update various parameters of the machine learning model accordingly.

[0054] After repeating the above process, the probability of abnormal operations predicted by this machine learning model should gradually become more accurate.

[0055] Therefore, when processor 104 inputs the multiple velocity values ​​and the multiple acceleration values ​​in Table 4 into the aforementioned machine learning model in step S250, the probability that the motion data MD corresponds to an abnormal operation, as predicted by the machine learning model, can be used as a reference by game administrators or other relevant personnel. This allows game administrators to effectively identify which players' mobile devices may have scripts installed in their firmware, thereby maintaining game fairness.

[0056] In summary, embodiments of the present invention can, after collecting motion data comprising multiple motion events, obtain multiple velocity vectors and acceleration vectors corresponding to this motion data, and then use a neural network to predict the probability of abnormal operation on a mobile input device. This allows game administrators to effectively identify which players' mobile devices may have scripts installed in their firmware, thereby better maintaining game fairness.

[0057] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the above embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the above embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting abnormal device operation, suitable for an electronic device connected to a movable input device, characterized in that: The method comprises: Obtaining motion data of the movable input device, wherein the motion data includes a plurality of motion events, and each motion event includes relative coordinates and a timestamp of the movable input device; generating a plurality of absolute coordinates corresponding to the motion data based on the relative coordinates of each of the motion events; estimating a plurality of velocity vectors corresponding to the motion data based on the plurality of absolute coordinates and the timestamp of each of the motion events; estimating a plurality of acceleration vectors corresponding to the motion data based on the plurality of velocity vectors and the timestamp of each of the motion events; and The method further includes estimating a probability that the motion data corresponds to an abnormal operation based on the plurality of velocity vectors and the plurality of acceleration vectors, comprising: The plurality of velocity vectors and the plurality of acceleration vectors are input into a pre-trained machine learning model, wherein the machine learning model outputs the probability that the motion data corresponds to the abnormal operation in response to the plurality of velocity vectors and the plurality of acceleration vectors.

2. The method according to claim 1, wherein the movable input device comprises a mouse device, each of the action events further comprises an event type, and the event type corresponding to the i-th action event among the multiple action events comprises a button pressing operation of the mouse device. The method according to claim 2 , wherein i is 1. 4 . The method of claim 2 , wherein the electronic device comprises a display, and the relative coordinates of each of the motion events correspond to a cursor position of a mouse cursor on the display.

5. The method according to claim 1 , wherein the plurality of motion events include an i-th motion event and an i+1-th motion event, 1≤i≤N-1, where N is the number of the plurality of motion events, and the step of generating the plurality of absolute coordinates corresponding to the motion data based on the relative coordinates of each of the motion events comprises: The relative coordinates of the i+1th motion event are subtracted from the relative coordinates of the i+1th motion event and the i-th absolute coordinate among the plurality of absolute coordinates is added to generate the i+1th absolute coordinate among the plurality of absolute coordinates. The method according to claim 5 , wherein the absolute coordinates of the first motion event of the plurality of motion events are (0, 0).

7. The method according to claim 1, wherein the plurality of motion events include an i-th motion event and an i+1-th motion event, the plurality of absolute coordinates include an i-th absolute coordinate and an i+1-th absolute coordinate, 1≤i≤N-1, N is the number of the plurality of motion events, and the step of estimating a plurality of velocity vectors corresponding to the motion data based on the plurality of absolute coordinates and the timestamps of the respective motion events comprises: subtracting the timestamp of the i-th action event from the timestamp of the i+1-th action event to generate an i-th time difference value among a plurality of time difference values; subtracting the i-th absolute coordinate from the i+1-th absolute coordinate to generate an i-th coordinate difference value among a plurality of coordinate difference values; as well as The i-th coordinate difference is divided by the i-th time difference to generate an (i+1)-th velocity vector among the plurality of velocity vectors. The method according to claim 6 , wherein a first velocity vector of the plurality of velocity vectors is (0, 0).

9. The method according to claim 1, wherein the plurality of motion events include an i-th motion event and an i+1-th motion event, the plurality of velocity vectors include an i-th velocity vector and an i+1-th velocity vector, 1≤i≤N-1, N is the number of the plurality of motion events, and the step of estimating the plurality of acceleration vectors corresponding to the motion data based on the plurality of velocity vectors and the timestamps of the respective motion events comprises: subtracting the timestamp of the i-th action event from the timestamp of the i+1-th action event to generate an i-th time difference value among a plurality of time difference values; subtracting the i-th velocity vector from the i+1-th velocity vector to generate an i-th velocity difference value among a plurality of velocity difference values; as well as The i-th speed difference is divided by the i-th time difference to generate an (i+1)-th acceleration vector among the plurality of acceleration vectors. 10 . The method according to claim 9 , wherein a first acceleration vector of the plurality of acceleration vectors is (0, 0).

11. The method according to claim 1 , wherein the step of obtaining the motion data of the movable input device comprises: The motion data of the movable input device is obtained from the operating system of the electronic device.

12. An electronic device, characterized in that: include: a storage circuit for storing program codes; as well as A processor is coupled to the storage circuit and loads the program code to perform the following steps: Obtaining motion data of a movable input device, wherein the motion data includes a plurality of motion events, and each motion event includes relative coordinates and a timestamp of the movable input device; generating a plurality of absolute coordinates corresponding to the motion data based on the relative coordinates of each of the motion events; estimating a plurality of velocity vectors corresponding to the motion data based on the plurality of absolute coordinates and the timestamp of each of the motion events; estimating a plurality of acceleration vectors corresponding to the motion data based on the plurality of velocity vectors and the timestamp of each of the motion events; as well as The method further includes estimating a probability that the motion data corresponds to an abnormal operation based on the plurality of velocity vectors and the plurality of acceleration vectors, comprising: The plurality of velocity vectors and the plurality of acceleration vectors are input into a pre-trained machine learning model, wherein the machine learning model outputs the probability that the motion data corresponds to the abnormal operation in response to the plurality of velocity vectors and the plurality of acceleration vectors.

Images