Identifying MMORPG Bots: Identifying MMORPG Bots: A Traffic - - PowerPoint PPT Presentation

Identifying MMORPG Bots: Identifying MMORPG Bots:

A Traffic Analysis Approach A Traffic Analysis Approach

(MMORPG: Massively Multiplayer Online Role Playing Game) (MMORPG: Massively Multiplayer Online Role Playing Game)

Kuan-Ta Chen National Taiwan University

Jhih-Wei Jiang Polly Huang Hao-Hua Chu Chin-Laung Lei Wen-Chin Chen Collaborators:

2 Identifying MMORPG Bots: A Traffic Analysis Approach

Talk Outline Talk Outline

Motivation Trace collection Traffic analysis and bot identification schemes Performance evaluation S cheme Robustness Conclusion

3 Identifying MMORPG Bots: A Traffic Analysis Approach

Game Bots Game Bots

AI programs that can perform many tasks in place of gamers Can reap rewards efficiently in 24 hours a day break the balance of power and economies in the game world Therefore bots are forbidden in most games

4 Identifying MMORPG Bots: A Traffic Analysis Approach

Bot Detection Bot Detection

Detecting whether a character is controlled by a bot is difficult since a bot obeys the game rules perfectly No general detection methods are available today The state of practice is identifying via human intelligence (as bots cannot talk like humans)

Labor-intensive and may annoy innocent players

This work is dedicated to automatic detection of game bots

(without intrusion in players’ gaming experience)

5 Identifying MMORPG Bots: A Traffic Analysis Approach

Key Contributions Key Contributions

We proposed to detect bots with a traffic analysis approach We proposed four strategies to distinguish bots from human players based on their traffic characteristics

6 Identifying MMORPG Bots: A Traffic Analysis Approach

Bot Detection: A Decision Problem Bot Detection: A Decision Problem

Game client Game server Traffic stream

Q: Whether a bot is controlling a game client given the traffic stream it generates? A: Yes or No

7 Identifying MMORPG Bots: A Traffic Analysis Approach

Ragnarok Online Ragnarok Online --

• - a screen shot

a screen shot

Figure courtesy of www.Ragnarok.co.kr

Ragnarok Online

One of the most popular MMORPGs (they claimed 17 million subscribers worldwide recently) Notorious for the prevalence of the use of game bots

8 Identifying MMORPG Bots: A Traffic Analysis Approach

Game Bots in Ragnarok Online Game Bots in Ragnarok Online

Two mainstream bot series: Kore -- KoreC, X-Kore, modKore, S

• los, Kore, wasu, Erok,

iKore, and VisualKore

DreamRO (popular in China and Taiwan) Both bots are standalone (game clients not needed), fully-automated, script-based, and interactive

9 Identifying MMORPG Bots: A Traffic Analysis Approach

DreamRO DreamRO --

• - A Screen Shot

A Screen Shot

World Map View S cope Character S tatus

Character is here

10 Identifying MMORPG Bots: A Traffic Analysis Approach

Trace Collection Trace Collection

Category Trace # Participants 8 traces 2 rookies 2 experts 2 bots 11 traces Average Length Network 2.6 hours Bots 17 hours ADSL, Cable Modem, Campus Network Human players

Player skills Character levels / equipments Network connections Network conditions (RTT, loss rate, etc)

Heterogeneity was preserved

206 hours and 3.8 million packets were traced in total

11 Identifying MMORPG Bots: A Traffic Analysis Approach

Traffic Analysis of Collected Game Traces Traffic Analysis of Collected Game Traces

Traffic is analyzed in terms of

Command timing Traffic burstiness Reaction to network conditions

Four bot identification strategies are proposed

12 Identifying MMORPG Bots: A Traffic Analysis Approach

Command Timing Command Timing

Observation Bots often issue their commands based on arrivals of server packets, which carry the latest status of the character and environment

game client game server

time

Client response time (response time) Time difference between the release of a client packet and the arrival

• f the most recent server packet

S t a t e u p d a t e

t1

C l i e n t c

• m

m a n d

t2

Response time T = t2 – t1

13 Identifying MMORPG Bots: A Traffic Analysis Approach

CDF of Response Times CDF of Response Times

DreamRO > 50% response times are extremely small Kore Zigzag pattern (multiples

• f a certain value)

14 Identifying MMORPG Bots: A Traffic Analysis Approach

Histograms of Response Times Histograms of Response Times (DreamRO traces)

(DreamRO traces)

1 ms

multiple peaks

1 ms

multiple peaks Many client packets are sent in response to server packets

15 Identifying MMORPG Bots: A Traffic Analysis Approach

Histograms of Response Times Histograms of Response Times

Regularity in the distribution of bots’ response times

S cheme #1: Command Timing A traffic stream is considered from a bot if it has … Quick response times (< 10 ms) clustered Regularity in the distribution of response times, i.e., if any frequency component exists

16 Identifying MMORPG Bots: A Traffic Analysis Approach

Traffic Burstiness Traffic Burstiness

Traffic burstiness

An indicator of how traffic fluctuates over time The variability of packet/ byte counts observed in successive periods

Index of Dispersion for Counts (IDC)

The IDC at time scale t is defined as It = Var(Nt) E(Nt) , where Nt indicates the number of arrivals in intervals

• f time t.

17 Identifying MMORPG Bots: A Traffic Analysis Approach

Example: Wine Sales and IDC Example: Wine Sales and IDC

The period is approximately 12 months The IDC at 12 months is the lowest

18 Identifying MMORPG Bots: A Traffic Analysis Approach

The Trend of Traffic Burstiness The Trend of Traffic Burstiness

Traffic generated by human players, of course, has no reason to exhibit such property Conj ecture for Bot Traffic

• 1. Each iteration of the bot program’ s main loop takes roughly

the same amount of time

• 2. Each iteration of the main loop sends out roughly the same

number of packets

• 3. Bot traffic burstiness will be the lowest in the time scale

around the time needed to complete each iteration

19 Identifying MMORPG Bots: A Traffic Analysis Approach

Examining the Trend of Traffic Burstiness Examining the Trend of Traffic Burstiness

Regularity in the distribution of bots’ response times

S cheme #2: Trend of Traffic Burstiness A traffic stream is considered from a bot if … the IDC curve has a falling trend at first and after that a rising trend, and both trends are detected at time scales < 10 sec

20 Identifying MMORPG Bots: A Traffic Analysis Approach

The Magnitude of Traffic Burstiness The Magnitude of Traffic Burstiness

Difficulty no “ typical” burstiness of human player traffic S

• lution

compare the burstiness of client traffic with that of the corresponding server traffic (as servers treat all game clients equally) S cheme #3: Burstiness Magnitude A traffic stream is considered to be generated by a bot if the client traffic burstiness is much lower than the corresponding server traffic burstiness Conj ecture Bot traffic is relatively smooth than human player traffic

21 Identifying MMORPG Bots: A Traffic Analysis Approach

Human Reaction to Network Conditions Human Reaction to Network Conditions

Conj ecture for Human Player Traces

• 1. The network delay of packets will influence the pace of game

playing (the rate of screen updates, character movement)

• 2. Human players will unconsciously adapt to the game pace

(the faster the game pace is, the faster the player acts)

server

Traffic j am!!

Is there any relationship between network delay and the pace of user actions?

22 Identifying MMORPG Bots: A Traffic Analysis Approach

Packet Rate vs. Network Delay Packet Rate vs. Network Delay

S cheme #4: Pacing A traffic stream is considered from a bot if … correlation between pkt rate vs. network delay is non- negative Human player traces: downward trend

23 Identifying MMORPG Bots: A Traffic Analysis Approach

Performance Evaluation Performance Evaluation

Evaluate the sensitivity of input size by dividing traces into segments, and computing the above metrics on a segment basis

Metrics Correct rate the ratio the client type of a trace is correctly determined False positive rate the ratio a player is misj udged as a bot False negative rate the ratio a bot is misj udged as a human player

24 Identifying MMORPG Bots: A Traffic Analysis Approach

Performance Evaluation Results Performance Evaluation Results

[Burst iness magnit ude] always achieves low false positive rates (< 5% ) and yields a moderate correct rate (≈ 75% ) [Command t iming and Burst iness t rend] Correct rates higher than 95%and false negative rates lower than 5%given an input size > 2,000 packets

25 Identifying MMORPG Bots: A Traffic Analysis Approach

An Integrated Approach An Integrated Approach

In practice, we can carry out multiple schemes simultaneously and combine their results according to preference Conservative approach: command t iming AND burst iness t rend Aggressive approach: command t iming OR burst iness t rend

26 Identifying MMORPG Bots: A Traffic Analysis Approach

An Integrated Approach An Integrated Approach --

• - Results

Results

Aggressive approach (2,000 packets): false negative rate < 1%and 95%correct rate Conservative approach (10,000 packets):

≈ 0%false positive rate and > 90%correct rate

Aggressive

27 Identifying MMORPG Bots: A Traffic Analysis Approach

Robustness against Counter Robustness against Counter-

• Attacks

Attacks

Just like anti-virus software vs. virus writers Our schemes only rely on packet timings An obvious attack is adding random delays to the release time of client packets

Command timing scheme will be ineffective S chemes based on traffic burstiness are robust

Adding random delays will not eliminate the bot signature

unless the added delay is longer than the iteration time by

• rders of magnitude or heavy-tailed

However, adding such long delays will make the bots

incompetent as this will slowdown the character’ s actions by

• rders of magnitude

28 Identifying MMORPG Bots: A Traffic Analysis Approach

Simulating the Effect of Random Delays on IDC Simulating the Effect of Random Delays on IDC

29 Identifying MMORPG Bots: A Traffic Analysis Approach

Summary Summary

Traffic analysis is effective to identify game bots Proposed four bot decision strategies and two integrated schemes for practical use The proposed schemes (except the one based on command timing) are robust under counter-attacks

Thank You! Thank You!

Kuan-Ta Chen