Distributed aimbot detection system and method utilizing highly reliable execution environment and deep learning

Abstract

To provide a distributed aimbot detection system and method utilizing a highly reliable execution environment and deep learning.SOLUTION: An aimbot detection system according to one embodiment includes a data management module for receiving game play information including a game player's action data from a game server, and an aimbot detection module for deriving an aimbot detection result from action data included in the received game play information by utilizing an aimbot detection model, and the data management module and the aimbot detection module are configured within a highly reliable execution environment of a client.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The following description relates to aimbot detection techniques. [Background technology]

[0002] In recent years, the online gaming industry has been expanding rapidly due to the development of high-performance computers, graphic processing units, and high-speed Internet. E-sports games are structured so that all teams participating in the game are given a fair situation and victory or defeat is decided by ability. However, in competitive games, cheating acts that undermine fairness by tampering with game clients to gain an advantage over other game players and performing operations that ordinary game players cannot perform are continuing to occur. This is one of the most important threats that directly damages the online gaming industry in general, including e-sports. In particular, the damage caused by cheating is most noticeable in first-person shooter (FPS) games, and a typical example is the aimbot, which helps aiming at the enemy. To prevent aimbots, FPS game production companies and security experts have proposed and applied various methods, but players who use aimbots still exist, undermining the fairness of the game. Aimbot detection methods that have been used up until now can be broadly divided into two types: a method that records all player actions on a central server directly managed by the game development company and detects abnormal behavior, and a method that detects the presence of unauthorized programs on the player's computer that tamper with the game client or affect the game.

[0003] The technology that detects abnormal behavior by recording player actions on a central game server requires the construction of a high-performance server that can simultaneously monitor multiple games being played in real time, and as the number of players increases, the size of the server and the cost of managing it also increase, resulting in high costs and the problem of not being easily scalable. There are also detection techniques that minimize the calculations of the central server by using only game statistics information from player accounts such as win / loss rates, number of kills, and death rates, but such statistical-based detection methods have the disadvantage that they can be easily circumvented.

[0004] Methods for detecting game client tampering or unauthorized programs do not fundamentally stop aimbots, as there will always be ways for an attacker (a player utilizing an aimbot) to bypass detection by gaining higher privileges on the computer running the aimbot. Summary of the Invention [Problem to be solved by the invention]

[0005] Aimbot detection must not have scalability issues for the ever-increasing number of game users, must be highly accurate, and must not allow aimbot users to easily circumvent detection. The problem to be solved by the present invention is to accurately and efficiently detect players using aimbots and minimize the possibility of circumvention by a distributed aimbot detection system using a trusted execution environment and a deep learning model. [Means for solving the problem]

[0006] The aimbot detection system includes a data management module that receives gameplay information including game player behavioral data from a game server, and an aimbot detection module that utilizes an aimbot detection model to derive an aimbot detection result from the behavioral data included in the received gameplay information, and the data management module and the aimbot detection module may be configured within a client's trusted execution environment.

[0007] The data management module may transform game player behavior data contained in the received game play information for input into the aimbot detection model.

[0008] The data management module includes transmitting game play information including game player behavioral data received from the game server to each of the game engine and the aimbot detection module, and the aimbot detection module may receive time-related information and weapon firing information from the game player behavioral data.

[0009] The aimbot detection model may predict a game player's behavior after a certain amount of time and may be trained to detect an aimbot by comparing the difference between the predicted game player's behavior and the actual player's behavior.

[0010] The aimbot detection module may determine that the game player has used an aimbot if a difference between the game player's behavior and the actual player's behavior in the detection results derived from the aimbot detection model is greater than a reference value.

[0011] The aimbot detection module may transmit the derived detection results to a game server.

[0012] The aimbot detection system may implement encrypted communications that cannot be eavesdropped on or tampered with when receiving game play information from the game server and when transmitting the derived aimbot detection results to the game server.

[0013] The game server may act according to a policy set for the game player based on the derived aimbot detection result.

[0014] The aimbot detection method performed by the aimbot detection system includes the steps of receiving gameplay information including behavioral data of a game player from a game server, utilizing an aimbot detection model to derive an aimbot detection result from the behavioral data included in the received gameplay information, and transmitting the derived aimbot detection result to the game server, and the data management module and the aimbot detection module may be configured within a highly reliable execution environment of a client.

[0015] The present invention may include a computer program recorded on a computer-readable recording medium for executing an aimbot detection method executed by an aimbot detection system, the aimbot detection method including the steps of receiving game play information including behavioral data of a game player from a game server, deriving an aimbot detection result from the behavioral data included in the received game play information using an aimbot detection model, and transmitting the derived aimbot detection result to the game server, wherein the data management module and the aimbot detection module are configured within a highly reliable execution environment of a client. Effect of the Invention

[0016] This technology can efficiently and accurately detect players using aimbots in online FPS games without placing a strain on the central server.

[0017] Being based on a highly trusted execution environment makes it extremely difficult for aimbot players to easily circumvent or attack.

[0018] By punishing players who use aimbots, only legitimate players can enjoy the game on an equal footing. [Brief description of the drawings]

[0019] [Figure 1] FIG. 13 is a diagram illustrating an aimbot detection operation in one embodiment. [Diagram 2] FIG. 1 is a diagram illustrating a method for detecting an aimbot in one embodiment. [Diagram 3] FIG. 1 illustrates the angle between the line of sight and a potential target in one embodiment. [Figure 4] FIG. 11 is a diagram for explaining a method for calculating an anomaly score in one embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0020] Hereinafter, the embodiments will be described in detail with reference to the accompanying drawings.

[0021] In the embodiment, an operation will be described in which a game player who uses an aimbot in an FPS game is automatically detected using only a client while minimizing the load on a central server (game server).

[0022] FIG. 1 is a diagram for explaining an aimbot detection operation in one embodiment.

[0023] The aimbot detection system realizes distributed aimbot detection by solving aimbot detection operations by each client 101, i.e., all game players, while monitoring each other. Each client 101 may monitor the sophisticated operations of surrounding game players.

[0024] The aimbot detection system may be comprised of a data management module 110 and an aimbot detection module 120. The data management module 110 and the aimbot detection module 120 may be configured within the trusted execution environment 102 of each client 101. The data management module 110 may receive game play information of any game player. In this case, the game play information means information (including behavioral data) generated in association with game events occurring during game play. The data management module 110 may receive the behavioral data and transmit it to the game engine 140, and may transform the behavioral data to transmit it as an input for the aimbot detection model. The aimbot detection module 120 may detect whether an aimbot is used by using the transformed behavioral data from the data management module 110. Since the data management module 110 and the aimbot detection module 120 are located within the trusted execution environment, they cannot be easily tampered with by an attacker.

[0025] According to an embodiment, the aimbot detection system is executed on the client side, so there is no overhead on the game server. In addition, since it utilizes an aimbot detection model that analyzes the aiming movements of game players, it can achieve high accuracy in detection. In addition, since the aimbot detection system manages gameplay information in a highly trusted execution environment, it makes it difficult for powerful attackers to manipulate game data. Furthermore, by employing a range of game players from general to expert, a realistic dataset of game players who do and do not use aimbots can be collected.

[0026] The aimbot detection system may operate in three stages:

[0027] As a pre-processing step, each client 101 may perform two tasks before the game begins. First, each client 101 may set up a TLS session with the game server 130 (inside the TEE) to securely transmit detection reports. Next, each client 101 may temporarily store the game aimbot detection model in an enclave in the trusted execution environment 102. For example, the aimbot detection model may be downloaded from the game server 130. This ensures that an attacker cannot access the aimbot detection model.

[0028] When a game starts, each game engine 140 may receive user input and share action information with other clients over the network. In particular, the data management module 110 (located in the TEE of each client) may take all neighboring clients' game event streams from the network and convert them into vectorized data streams. The data management module 110 may also relay all received game play information to the game engine 140 (1) to render the game, and (2) to check who has cheated through the aimbot detection module 120. Due to the nature of FPS games, each game player, i.e., each client, can see the main actions of other game players within their visible range.

[0029] The aimbot detection module 120 (located in the TEE of each client) may read the vectorized data and determine whether or not to use the aimbot while analyzing the shooting behavior of other clients. The aimbot detection result derived from the aimbot detection module 120 may be immediately transmitted to the game server 130 using a secure channel. The aimbot detection module 120 can recognize abnormal shooting behavior that deviates from the essential normal behavior of humans through the aimbot detection model.

[0030] The game server 130 may collect a stream of detection reports from all clients to detect cheaters. If cheating is reported, the game server 130 may take necessary measures, such as disqualifying the cheater's account. Since the data management module 110 and the aimbot detection module 120 are in the trusted execution environment 102 and all detection reports are sent through a secure channel, the game server 130 can trust the reports of each client 101 and process the address. The game server 130 may make a delay decision after collecting a series of detection reports from each client 101.

[0031] More specifically, the data management module 110 tracks all observable gameplay information generated by all observable players, and each player may decide whether or not to use an aimbot, as all FPS game clients continuously propagate their behavioral data to others over the network in real time.

[0032] However, the gameplay information provides only partial information of the game player's behavioral data. For example, for efficiency, only some of the mouse movements are sent over the network, not all of them. Also, since the game engine 140 does not need to render invisible game players at all, each user can only observe the behavioral data of surrounding game players. Such limitations apply to the aimbot detection method in the same way.

[0033] The aimbot detection system of the embodiment is efficient because it does not require modification of the game engine 140 to detect aimbots and each client 101 processes only a portion of the gameplay information, allowing it to focus more on detection.

[0034] JPEG2025026285000002.jpg34164 In this case, gameplay information corresponds to all game events generated by or sent to the player, such as when the player (or another player) fires a weapon, is hit, or is killed by another player. Such incidents may be indicated as fire, hit, or dead, respectively. For timestamps where no such events occur, the fields should be left blank.

[0035] If there is more than one player observable at the same time, multiple events may occur for the same t. The data management module 110 may take the observable event stream as the input of the network and send a transformed feature vector stream as output upon the occurrence of an in-game event that triggers detection. This may include three main stages: (1) vector computation, (2) normalization, and (3) refinement.

[0036] (1) Vector calculation JPEG2025026285000003.jpg47164

[0037] For the data management module 110 to obtain the aim, each client 101 first obtains a vector d that indicates the minimum angular distance between the game player's current line of sight and an observable enemy. a 3 is a diagram showing the angle between the line of sight and the potential target. The enemy u2 is closer to the game player in terms of Euclidean distance, while u1 is closer to the game player in terms of angular distance. Therefore, the data management module 110 may consider u1 as the current target of the game player and calculate the data based on this. d aIf is less than a threshold (30° in the current implementation), we set aim as true, otherwise we set it to false. aim is an estimate since an observer may have a wrong value, e.g., a game player is aiming at an enemy that is currently not visible to the observer. This issue does not affect the detection result, because the aimbot detection model makes a decision only if both the player and the target are visible by the client. Moreover, the aim value does not affect the decision; only the aiming angle ultimately affects the decision.

[0038] (2) Normalization In practice, each client 101 may collect gameplay information at the exact time that an event occurs. This results in the collected gameplay information having irregular timestamps, generating a time series with non-constant time intervals. Since RNNs are expected to generally process periodic sequences, the collected logs need to be normalized to a fixed time interval.

[0039] The data management module 110 performs linear interpolation to fill in missing values ​​along a linear trend among existing observations. Since most modern FPS games run at 60 frames per second, in an embodiment, events collected at a time interval of 16 ms may be normalized. Assume that a game player is at (1.0, 1.0, 1.0) when t=0, (1.1, 0.9, 0.1) when t=8, and (1.5, 0.6, 0.8) when t=34. After the normalization step, three events may occur at t=0, 16, and 32. For example, there is an interpolated event (1.235, 0.811, 0.376) at t=16. At this time, the time interval (16 ms) is too short to cause any sudden changes, so linear interpolation is sufficient to normalize the collected game play logs.

[0040] (3) Refining The data management module 110 may filter unnecessary behavioral data before providing the converted gameplay information to the aimbot detection module 120. In particular, the data management module 110 may observe a sudden change in position and aiming direction when a game player resurrects after dying (i.e., e=dead). In this case, the aimbot detection model may erroneously display the game player as suspicious. This occurs in a deathmatch, where the goal is to kill as many other game players as possible. The data management module 110 may detect a sudden change in the position and aiming direction of a game player by always storing the previous game player's actions and comparing the player's current actions with the previous actions. If such a case is identified, the data management module 110 will not send the gameplay information (behavioral data) to the aimbot detection module 120.

[0041] The aimbot detection module 120 of each client can derive aimbot detection results from shooting events using the aimbot detection model. The aimbot detection module 120 can use an unsupervised learning approach to train the RNN. The aimbot detection module 120 can identify "abnormal" aiming behavior in shooting events using the aimbot detection model built from observing normal aiming behavior, and detect aimbots in a distributed manner. The aimbot detection model uses a recurrent neural network (RNN) trained only on observation logs of benign players to model normal aiming behavior. Using the preprocessed game event stream transformed by the data management module 110, the aimbot detection module 120 can analyze events in three stages: (1) event filtering, (2) anomaly scoring, and (3) reporting results.

[0042] (1) Event filtering To avoid easy detection, modern aimbots switch to an "inter-fire" mode where they lock onto the target only when the user triggers (fires) the weapon. With this mode on, it is essentially impossible to distinguish between aimbot users and benign users unless the weapon is fired. Therefore, it is not possible to track every event during gameplay. Instead, the aimbot detection module 120 focuses only on each fire event (i.e., e=fire) and the adjacent (before and after) related behavioral data. The aimbot detection module 120 may also filter out all fire events without a target (i.e., aim=false) since the aimbot will not be activated without a suitable target.

[0043] In practice, RNNs are typically able to accumulate many more events than the weapon fires before it must act upon a set of previously observed data points. For a given RNN window size w and a predefined duration d, it may accumulate w+2d events for each fine event, consisting of the w+d events before the fine and the remaining d events including the fine action.

[0044] Since setting w and d too small or large may provide insufficient or excessive information for each relevant event set, respectively, the parameters may be selected to be, for example, w=20 and d=10, to optimize detection performance.

[0045] (2) Anomaly score assignment To effectively detect aimbots, the aimbot detection module 120 may distribute a pre-trained RNN-based aimbot detection model that encodes the aiming movements of normal game players to each client 101. Using the aimbot detection model, each client 101 may calculate an anomaly score for each observed set of aiming movements (before and after a fire event), with a higher score indicating a higher likelihood of being an aimbot user.

[0046] JPEG2025026285000004.jpg12161 The anomaly score is a prediction error calculated by comparing the L1 distance between the predicted value and the actual value for the wth event. Because the aimbot detection model is trained only on the aiming movements of benign players, the aiming movements of the aimbot will perform significantly worse compared to the predictions of benign players. As a result, the aimbot detection module 120 may observe a higher anomaly score for the aimbot user due to the aimbot detection model.

[0047] 4 is a diagram illustrating how the anomaly score is calculated in one embodiment. The aimbot detection model divides the shooting-related event into multiple sliding windows to obtain 2d unique RNN input sequences of length w, and generates a total of 2d anomaly scores for each fine event. Among all the anomaly scores, the maximum value may be selected as the resulting anomaly score for the event.

[0048] The event-by-event inspection approach proposed in the embodiment has two major advantages over the conventional approach: first, it can determine the exact moment when a fraudulent activity occurs, and second, the need to monitor and control event-level behavior makes it much more difficult to develop an aimbot that can evade detection mechanisms.

[0049] (3) Report results After calculating the anomaly symptom score for each fine event, the aimbot detection module 120 compares the anomaly score to a threshold, which may be determined by a validation dataset, to determine a final label.

[0050] When determining the threshold, two basic criteria may be proposed and evaluated: (1) highest accuracy and (2) highest precision. The highest accuracy is to select the threshold such that the aimbot's prediction accuracy is maximized from the given validation data. The highest precision is to select the threshold such that there are no false positives from the given validation data. As a result, the former balances FP and FN to achieve the highest prediction accuracy, while the latter prevents good users from being falsely accused of cheating.

[0051] JPEG2025026285000005.jpg28164 Instead of sending a single aggregated result for the duration of the game, each client 101 sends a detection report for every fine event it observes. This prevents an attacker from guessing the decisions each client made and gives the server more flexibility when aggregating the results.

[0052] The game server 130 or game provider may also be responsible for making the final decision based on the detection reports obtained from each client 101. One simple policy is to strictly disqualify a game player if there is one or more reports of cheating. However, such a policy may be challenged by potential false alarms due to inaccuracies in aimbot detection models, even though each detection report is trustworthy.

[0053] Such a problem can be solved by postponing the decision. Since cheating reports are submitted multiple times during a game (e.g., 11.83 times on average in an experiment), the game server 130 can accumulate detection reports to make a more informed decision later. Specifically, if the number of consecutive cheating reports during game play is higher than a threshold θ, the game player may be disqualified. For example, assume that the true / false rate of the aimbot detection model is 5%. In this case, when θ=5, the probability of misidentifying a game player as a cheater is only 0.00003%. In this manner, game providers can easily offset the inaccuracy of the aimbot detection model.

[0054] FIG. 2 is a diagram illustrating a method for detecting an aimbot in one embodiment.

[0055] In step 210, the aimbot detection system may receive game play information including game player behavior data from the game server. Step 210 may be executed by a data management module configured in the aimbot detection system. The aimbot detection system may transform the game player behavior data included in the received game play information to input it into the aimbot detection model. The aimbot detection system may transmit the game play information including the game player behavior data received from the game server to the game engine and at the same time transmit the transformed behavior data to the aimbot detection module. The game engine may display the received behavior data on a computer screen for smooth game play. At this time, the game server and the data management module may perform encrypted communication to prevent eavesdropping and tampering. Here, the behavior data may include the game player's position, line of sight, weapon firing, and other actions.

[0056] In step 220, the aimbot detection system may derive an aimbot detection result from the behavioral data included in the received gameplay information using the aimbot detection model. Step 220 may be performed by an aimbot detection module configured in the aimbot detection system. The aimbot detection system may extract information related to the player's gaze and weapon firing information from the behavioral data included in the received gameplay information. The aimbot detection system may input the extracted information related to the player's gaze and weapon firing information into the aimbot detection model. The aimbot detection model is a model that predicts the player's movements after a certain time, and may be trained to detect an aimbot by comparing the difference between the predicted player's actions and the actual player's actions. If such a difference is higher than a reference value (threshold value), the aimbot detection system may determine that the player has used an aimbot.

[0057] In step 230, the aimbot detection system may transmit the derived aimbot detection result to the game server. Step 230 may be performed by an aimbot detection module configured in the aimbot detection system. The aimbot detection module and the game server may use encrypted communication that cannot be tapped or tampered with. The game server may act according to a related policy, such as sanctioning the detected player, based on the detection results received from each of the multiple clients.

[0058] The above-mentioned devices may be realized by hardware components, software components, and / or a combination of hardware and software components. For example, the devices and components described in the embodiments may be realized using one or more general-purpose or special-purpose computers, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA), a programmable logic unit (PLU), a microprocessor, or various devices capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications that run on the OS. The processing device may also respond to the execution of the software to access, record, manipulate, process, and generate data. For convenience of understanding, a single processing device may be described as being used, but one skilled in the art will understand that the processing device may include multiple processing elements and / or multiple types of processing elements. For example, the processing device may include multiple processors or one processor and one controller. Other processing configurations, such as parallel processors, are also possible.

[0059] The software may include computer programs, codes, instructions, or a combination of one or more of these, and may configure a processing device to operate as desired or instruct the processing device, either independently or collectively. The software and / or data may be embodied in any type of machine, component, physical device, virtual device, computer storage medium, or device to be interpreted by the processing device or to provide instructions or data to the processing device. The software may be distributed and stored or executed in a distributed manner on computer systems connected by a network. The software and data may be stored on one or more computer-readable storage media.

[0060] The method according to the embodiment may be implemented in the form of program instructions executable by various computer means and recorded on a computer readable medium. The computer readable medium may include, alone or in combination, program instructions, data files, data structures, and the like. The program instructions recorded on the medium may be specially designed and configured for the embodiment, or may be available to those skilled in the art of computer software. Examples of computer readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tapes, optical media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, and hardware devices specially configured to record and execute program instructions, such as ROMs, RAMs, flash memories, and the like. Examples of program instructions include high-level language codes executed by a computer using an interpreter, etc., as well as machine language codes such as those generated by a compiler.

[0061] Although the embodiments have been described based on the limited embodiments and drawings as above, those skilled in the art will be able to make various modifications and variations from the above description. For example, the described techniques may be performed in an order different from that described, and / or the components of the described systems, structures, devices, circuits, etc. may be combined or combined in a manner different from that described, or may be counterbalanced or replaced by other components or equivalents, and still achieve suitable results.

[0062] Therefore, different embodiments are within the scope of the appended claims provided that they are equivalent to the claims. [Explanation of symbols]

[0063] 110: Data management module 120: Aimbot detection module 130: Game server 140: Game Engine

Claims

1. 1. An Aimbot detection system, comprising: a data management module that receives game play information including game player behavior data from a game server; and an aimbot detection module that utilizes an aimbot detection model to derive an aimbot detection result from behavioral data included in the received game play information; Including, The data management module and the aimbot detection module are configured within a trusted execution environment of a client. The Aimbot detection system includes:

2. The data management module includes: transforming game player behavior data included in the received game play information for input into the aimbot detection model; 2. The aimbot detection system of claim 1 .

3. The data management module includes: transmitting game play information, including game player behavior data, received from the game server to each of the game engine and the aimbot detection module; The aimbot detection module receives time-related information and weapon firing information from the game player's behavior data.

2. The aimbot detection system of claim 1 .

4. the aimbot detection model predicts game player behavior after a certain time period and is trained to detect aimbots by comparing the difference between the predicted game player behavior and the actual game player behavior; 2. The aimbot detection system of claim 1 .

5. The aimbot detection module includes: In the detection result derived by the aimbot detection model, if the difference between the game player's behavior and the actual player's behavior is greater than a reference value, the game player is determined to have used an aimbot.

2. The aimbot detection system of claim 1 .

6. The aimbot detection module includes: The derived detection results are transmitted to a game server.

6. The aimbot sensing system of claim 5.

7. The aimbot detection system includes: When receiving game play information from the game server or transmitting the derived aimbot detection result to the game server, encrypted communication that cannot be intercepted or tampered with is performed.

2. The aimbot detection system of claim 1 .

8. The game server acts according to a policy set for the game player based on the derived aimbot detection result.

2. The aimbot detection system of claim 1 .

9. 1. An aimbot detection method performed by an aimbot detection system, comprising: receiving game play information from a game server, the game play information including game player behavior data; deriving an aimbot detection result from behavioral data included in the received gameplay information using an aimbot detection model; and transmitting the derived aimbot detection result to a game server; Including, The data management module and the aimbot detection module are configured within a trusted execution environment of a client. An aimbot detection method comprising:

10. A computer program recorded on a computer-readable recording medium for executing an aimbot detection method executed by an aimbot detection system, comprising: The aimbot detection method includes: receiving game play information from a game server, the game play information including game player behavior data; deriving an aimbot detection result from behavioral data included in the received gameplay information using an aimbot detection model; and transmitting the derived aimbot detection result to a game server; Including, The data management module and the aimbot detection module are configured within a trusted execution environment of a client. A computer program recorded on a computer-readable recording medium, comprising:

Images