1. May 31, 2007 Network Game Design: User Identification based on Game-Play ActivityPatternsChun-Yang Chen, Academia SinicaLi-Wen Hong, Academia Sinica ACM NetGames 2007

2. Motivation Password-based User Identity VulnerabilityAccount hijacking (Identity Theft)Severity & prevalenceNo general solution until the victim appearsAccount sharingIncrease the difficulty of demographical studies of game Authors / Paper Title 2 3. User Identity: Current Solutions Digital signatureSmart cardBiometrical signaturefingerprintvoicekeystroke Authors / Paper Title3 4. Our Solution A novel biometric:Game-Play Activity PatternsAuthors / Paper Title4 5. OutlineMotivationData CollectionPlayer Activity AnalysisProposed SchemePerformance EvaluationContribution & Future WorkAuthors / Paper Title 5 6. Observation More RegularMore Unpredictable Motivation Data Collection Player Activity Analysis Proposed Schemes Authors / Paper Title6 7. Data Collection A MMORPG -- Angels LoveA commercial game in Taiwan40 thousands of players onlineThe player activity logs we useTrace period of 3 days287 randomly chosen accountsRemove logs shorter than 200 minutes Motivation Data Collection Player Activity Analysis Proposed Schemes Authors / Paper Title7 8. Definitions Active periodAn active period of a game character is defined as a timeinterval (t1 , t 2 ) which the character continuously moves, inwith a tolerance of discontinuity up to 1 second.Idle periodAn idle period of a game character is defined as a timeinterval (t1 , t 2 ) which the character has no movements, inwhere t 2 t1 second. 1 Data Collection Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title8 9. Data Summary Player # :DataActivity Active Idle 287 LengthRatePeriodPeriod0.355%7 hr 3 sec 7 seccycle/min 2.28 50%51 hr6 sec 18 seccycle/min 5.12 95%67 hr9 sec181 seccycle/min Data Collection Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title9 10. Distribution of Active / Idle Period 4Data Collection Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title10 11. Idle time is much more diversethan active time Data Collection Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title11 12. Average Active Time v.s. Idle Time Players active/idle patterns can be very different candidate features for user identification Data Collection Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title12 13. Why choosing idle time ratherthan active time Idle time distribution captures more variability Idle time process has smaller degree of auto- correlations Data Collection Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title13 14. Idle Time Distribution ofRandom Players Data Collection Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title14 15. KL Distances ITD: Idle time distribution RET: Relative Entropy Testrelative entropy between two ITDsbased on the KL distance KL distance: Kullback-Leibler distance P(i ) DKL ( P || Q) = P(i ) log i Q(i )DSKL ( P || Q) = DSKL (Q || P) = DKL ( P || Q) + DKL (Q || P) Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title15 16. KL distances of Players Player Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title16 17. Identification Scheme:Consistency Test Perform consistency testKLD: distribution of KL distance2 KLDs for each playerKLDs are tested by two-sided Wilcoxon test0.95 Authors / Paper Title 17 18. Identification Scheme:Discriminability Test Perform discriminability testKLDi,j : distribution of KL distances between ni ITDs of player i& nj ITDs of player j KLDs are tested by one-sided Wilcoxon test Authors / Paper Title18 19. Factor Consideration Consideration: effect of the detection time & the history sizeTrec: how long the player history kept in database (in minutes)Tobs : the detection time once the player log in (inminutes)Proposed Schemes Performance Evaluation Contribution & Future Work Authors / Paper Title19 20. Evaluation Result Proposed Schemes Performance Evaluation Contribution & Future Work Authors / Paper Title20 21. Performance Evaluation Effect of Trecmean of activity cycles is one minuteTrec = idle timesassuming one million user accounts, Trec = 200 minutes, eachidle time uses 4 bytes storage space = 800 MBEffect of Tobsassuming 10,000 players are online, Tobs = 20 minutesmain memory = 0.8 MBPlayer Activity Analysis Proposed Schemes Performance Evaluation Authors / Paper Title 21 22. Contribution & Future Work Contribution: Propose the RET scheme for user identification from the aspect of idle time.With a 20-minute detection time period given a 200-minutehistory size achieve higher than 90% accuracy.Future PlanCut down the detection timeUtilizing more aspects of game-play activities.Analyzing from the way users control the character. Proposed Schemes Performance Evaluation Contribution & Future Work Authors / Paper Title22 23. Thank you! Chun-Yang Chen Li-Wen Hong ACM NetGames 2007