KR101951015B1 - Server detecting abnormal game activity and operating method of thereof - Google Patents

Abstract

The server is started. One embodiment generates reference information including account identifiers and initial device identifiers, acquires the number of account identifiers mapped to each of the original device identifiers through the generated reference information, And detects abnormal game activity based on the obtained number.

Description

TECHNICAL FIELD [0001] The present invention relates to a server for detecting an abnormal game activity and a method of operating the same.

The following embodiments are directed to techniques for detecting abnormal game activity.

There are groups or individuals who have an illegal purpose, such as character sales, goods trading, etc., and use incorrect methods to create multiple accounts to inaccurate game indicators.

Korean Patent Laid-Open Publication No. 10-2017-012195 entitled " Method and apparatus for detecting an abnormal account in an online game, applicant: Nexon Korea Co., Ltd. " The apparatus disclosed in the patent publication monitors the behavior of at least one character in an online game, extracts a behavior pattern of each character, monitors the movement of goods from one character to another character for each of the at least one character A transaction pattern of each character according to the movement of the goods, and stores at least one of a detection behavior pattern, which is a behavior pattern of the character of the abnormal account, and a detection transaction pattern, which is a transaction pattern of the character of the abnormality account, Detects at least one character based on at least one of a behavior pattern and a transaction pattern, and determines whether the account for each character is an abnormal account.

A method of operating a server according to a side includes generating reference information including account identifiers and initial device identifiers; Obtaining the number of account identifiers mapped to each of the first device identifiers through the generated reference information; And detecting abnormal game activity based on the generated reference information and the obtained number.

Wherein the detecting the abnormal game activity comprises: detecting a target initial device identifier using the generated reference information and the obtained number; And determining that the detected target initial device identifier is associated with the abnormal game activity.

Wherein the detecting the target initial device identifier comprises: detecting an account identifier; Determining whether the number of account identifiers mapped to the first device identifier of the detected account identifier is greater than or equal to a first threshold value; Checking whether an account identifier having a game count of a second threshold value or more is logged in as a game ID with a device identifier different from the first device identifier among the account identifiers mapped to the first device identifier; And detecting the initial device identifier as the target initial device identifier based on the results of the identifying steps. At this time, the device identifier to be logged does not have an account identifier equal to or larger than the first threshold value. This may mean logging in from a generic normal device identifier.

Wherein the step of detecting the first device identifier as the target first device identifier comprises: if the number of account identifiers mapped to the first device identifier is equal to or greater than the first threshold value and the account access identifier is equal to or greater than the second threshold value, And detecting the first device identifier as the target first device identifier.

The step of detecting the account identifier may include detecting an account identifier that logs into the device identifier different from the original device identifier.

Wherein detecting the abnormal game activity comprises: checking whether the number of account identifiers mapped to the detected original device identifier is greater than or equal to a first threshold value; The number of game accesses logged in by a device identifier different from the first device identifier among the account identifiers mapped to the detected first device identifier when the number of account identifiers mapped to the detected first device identifier exceeds the first threshold determining whether an account identifier having a day count equal to or greater than a second threshold exists; And determining that the detected first device identifier is associated with the abnormal game activity if an account identifier whose number of game connection days is equal to or greater than the second threshold value exists.

Each of the original device identifiers may represent the device identifier when each of the account identifiers was created.

The reference information further includes login device identifiers, a creation date of each of the account identifiers, and a login date of each of the account identifiers.

Each of the login device identifiers may represent a device identifier when logged into each of the account identifiers.

A method of operating a server according to another aspect includes: detecting an initial device identifier satisfying a condition; Obtaining a number of account identifiers mapped to the detected first device identifier; Checking whether there is an account identifier that is connected to the detected first device identifier and the other device identifier among the account identifiers for a predetermined number of days or more; And determining whether the detected first device identifier is associated with an abnormal game activity based on the obtained number and the verification result.

The detecting may include detecting an initial device identifier mapped to the specific account identifier when a different login device identifier and an original device identifier are mapped to a specific account identifier.

The detected first device identifier may indicate the device identifier when the specific account identifier is generated.

The server according to one side generates reference information including account identifiers and initial device identifiers, acquires the number of account identifiers mapped with each of the original device identifiers through the generated reference information, And a controller for detecting an abnormal game activity based on the information and the obtained number.

The controller may detect the target initial device identifier using the generated reference information and the obtained number, and determine that the detected target initial device identifier is associated with the abnormal game activity.

Wherein the control unit detects an account identifier estimated to be changed by a game user, checks whether the number of account identifiers mapped to the first device identifier of the detected account identifier is equal to or greater than a first threshold value, The first device identifier and the first device identifier are compared with each other to determine whether there is an account identifier having a game count of a second threshold value or more, It can be detected as the target initial device identifier.

The control unit detects the first device identifier as the target first device identifier if the number of account identifiers mapped to the first device identifier is equal to or greater than the first threshold value and the game access days are equal to or greater than the second threshold value can do.

The controller may detect an account identifier different from the login device identifier and the first device identifier as an account identifier estimated that the game user has changed.

The controller checks whether the number of account identifiers mapped to the first device identifier is greater than or equal to a first threshold value in the generated reference information and determines whether the first device identifier is different from the first device identifier among the account identifiers mapped to the first device identifier And if there is an account identifier having a game connection day count greater than or equal to a second threshold value, if the game connection day count is equal to or greater than the second threshold value, It can be determined to be associated with an abnormal game activity.

Each of the original device identifiers may represent the device identifier when each of the account identifiers was created.

The reference information may further include login device identifiers, a creation date of each of the account identifiers, and a login date of each of the account identifiers.

Each of the login device identifiers may represent a device identifier when logged into each of the account identifiers.

A server according to another party detects an initial device identifier that satisfies a condition, acquires the number of account identifiers mapped to the detected first device identifier, and acquires the first device identifier that is different from the detected first device identifier among the account identifiers And determining whether the first device identifier is associated with an abnormal game activity based on the obtained number and the result of the check.

The controller may detect an initial device identifier mapped to the specific account identifier when different login device identifiers and initial device identifiers are mapped to specific account identifiers.

The detected first device identifier may indicate the device identifier when the specific account identifier is generated.

Embodiments can distinguish a workplace immediately after a game is opened by using login information, and can distinguish and control an account that disturbs game indicators. Embodiments can also control or sanction accounts created through the workplace prior to sale.

1 is a view for explaining a game system according to an embodiment.
2 to 6 are views for explaining a reference information generating method of a detector according to an embodiment.
7 to 8 are views for explaining a method of detecting a workplace of a detector according to an embodiment.
9 is a flowchart for explaining an example of a method of operating a server according to an embodiment.
10 is a flowchart for explaining another example of the operation method of the server according to the embodiment.
11 is a block diagram illustrating a server according to an embodiment.

In the following, embodiments will be described in detail with reference to the accompanying drawings. However, various modifications may be made in the embodiments, and the scope of the patent application is not limited or limited by these embodiments. It is to be understood that all changes, equivalents, and alternatives to the embodiments are included in the scope of the right.

The terms used in the examples are used for descriptive purposes only and are not to be construed as limiting. The singular expressions include plural expressions unless the context clearly dictates otherwise. In this specification, the terms "comprises" or "having" and the like refer to the presence of stated features, integers, steps, operations, elements, components, or combinations thereof, But do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, or combinations thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art to which this embodiment belongs. Terms such as those defined in commonly used dictionaries are to be interpreted as having a meaning consistent with the contextual meaning of the related art and are to be interpreted as either ideal or overly formal in the sense of the present application Do not.

In the following description of the present invention with reference to the accompanying drawings, the same components are denoted by the same reference numerals regardless of the reference numerals, and redundant explanations thereof will be omitted. In the following description of the embodiments, a detailed description of related arts will be omitted if it is determined that the gist of the embodiments may be unnecessarily blurred.

1 is a view for explaining a game system according to an embodiment.

Referring to FIG. 1, a game system 100 according to an embodiment includes a server 110, a database 120, and a plurality of terminals 130-1 to 130-n.

A game client is installed in each of the terminals 130-1 to 130-n. Each of the terminals 130-1 to 130-n accesses the server 110 through a game client. The game client may be represented as a game application, game software, or the like.

Each of the terminals 130-1 to 130-n corresponds to a mobile terminal (e.g., a smart phone, a tablet, or the like) or a fixed terminal (e.g., a PC).

The server 110 collects log information of each of the terminals 130-1 to 130-n when there is a connection to each of the terminals 130-1 to 130-n. The log information includes, for example, an account identifier, a device identifier, a login date, and the like. The account identifier is an identifier for distinguishing a particular account from another account, and the device identifier is an identifier for distinguishing a specific terminal from another terminal. The device identifier may include, for example, an advertisement ID (ADID), which is not limited to the above-mentioned ADID.

The server 110 stores log information of each of the terminals 130-1 to 130-n in the database 120. [

According to one embodiment, the server 110 includes a detector 111. A person who generates a large number of accounts in the same game user, the same device (or terminal), and the same IP address is called a work site. The detector 111 can determine or specify a work site in consideration of log information. Accordingly, the detector 111 can discriminate the workplace immediately after the game is opened, distinguish and control the account that disturbs the game index, and can control the account created through the workplace before the sale. The operation of the detector 111 will be described in detail.

2 to 6 are views for explaining a reference information generating method of a detector according to an embodiment.

Referring to FIG. 2, a detector 111 according to one embodiment generates reference information (210). The reference information is information for detecting or determining the workplace, and the detector 111 generates reference information based on the first information and the second information. The first information may include, for example, account identifiers, a creation date of each of the account identifiers, and an original device identifier of each of the account identifiers, and the second information may include, for example, account identifiers The login date of each account identifier, and the login device identifier of the account identifier.

An example of the first information is shown in Fig. 3, the detector 111 stores the account identifiers, such as uk1, uk2, ..., uv158, the creation date of each corresponding account identifier, and the original device identifier of each account identifier, Or other repository to generate the first information. The initial device identifier may represent the device identifier of the account identifier when the corresponding account identifier is created. In other words, the first device identifier may correspond to the first one of the device identifiers of the account identifier and the corresponding device identifier. 4, uk1 is mapped to device identifiers aaa, aac, abz, ..., dfg, where aaa, aac, abz, ..., If it is a device identifier, aaa corresponds to the original device identifier. For reference, when each of the different terminals accesses the server 110 via uk1, different device identifiers may be mapped to one account identifier, as shown in the example shown in Fig.

An example of the second information is shown in Fig. Referring to FIG. 5, the detector 111 includes account identifiers such as uk1, uk2, uk3, uk4, ..., uk100, login date information of respective account identifiers, and respective login device identifiers May be extracted from the database 130 or other repository to generate the second information. The login device identifier refers to a device identifier used when connecting (or logging in) to the server 110 or a game with an account identifier. In other words, the terminal accesses the game with an account identifier, in which the device identifier of the corresponding terminal corresponds to the login device identifier. In the example shown in Fig. 5, the login date of uk1 is 2018.05.31 and the login device identifier is aaa, which means that the terminal having aaa has connected to the game at uk1 as of 2018.05.31.

As described above, the detector 111 generates reference information based on the first information and the second information. For example, the detector 111 may generate the reference information by joining the first information and the second information to the account identifier. An example of the reference information is shown in Fig.

Referring to FIG. 6, the reference information may include account identifiers, login device identifiers and initial device identifiers of respective account identifiers, login dates of respective account identifiers, and creation dates of respective account identifiers . The reference information shown in Fig. 6 is arranged based on the login date.

The detector 111 may count the number of account identifiers generated by the original device identifier in the reference information. This may mean that the number of account identifiers generated by the detector 111 through the terminal having the initial device identifier can be grasped in the reference information. In other words, the detector 111 may count the number of account identifiers mapped to the original device identifier in the reference information. For example, the detector 111 may count the number of account identifiers generated by the first device identifiers aaa, abd, bce, etc. on a day or an arbitrary date in the reference information shown in Fig. Table 1 below shows an example of the counting result of the detector 111.

Initial Device Identifier Count aaa 400 usd 44 bce 2 def One

In Table 1 above, the number of account identifiers generated by the first device identifier aaa on a day or on a random date is 400. This may mean that 400 game accounts have been created through the terminal with the original device identifier aaa. In other words, it may mean that the number of account identifiers mapped to the original device identifier aaa is 400 based on a particular day.

If the detector 111 obtains the number of account identifiers mapped to each of the original device identifiers, it detects or identifies the workplace. A method of detecting a workplace will be described with reference to FIGS. 7 to 8. FIG.

7 to 8 are views for explaining a method of detecting a workplace of a detector according to an embodiment.

Referring to Figure 7, the detector 111 detects 710 the workplace based on the reference information and the number obtained. An example of the step 710 will be described in detail with reference to FIG.

Referring to FIG. 8, the detector 111 may detect an account identifier that satisfies a condition (810). In other words, the detector 111 may detect an account identifier that is logged in with a different device identifier than the original device identifier. For example, the detector 111 may detect an account identifier different from the login device identifier and the initial device identifier in the reference information shown in FIG. In the example shown in Fig. 6, the login device identifier of uk3 is bdu and the initial device identifier is bce, since the login device identifier of uk3 is different from the original device identifier of uk3, the detector 111 can detect uk3 . In this case, since the log-in device identifier of uk3 and the original device identifier of uk3 are different from each other, the detector 111 can estimate or specify that the game user has been changed. In other words, the detector 111 can estimate that the account of uk3 is changed or sold as a game user playing a game with a device identifier of bdu in a game user playing a game with a device identifier of bce. In addition, the detector 111 may detect an account identifier uk 100 that is different from the login device identifier and the original device identifier.

The detector 111 checks 820 whether the number of account identifiers mapped to the first device identifier of the detected account identifier is equal to or greater than a threshold value. In other words, the detector 111 checks whether the number of account identifiers generated by the corresponding original device identifier is equal to or greater than a threshold value. For example, if the detector 111 detects uk3 and uk100, it can check whether the number of account identifiers mapped to the uk3 and uk100 respective first device identifiers is greater than or equal to a threshold value. Referring to Table 1 above, the number of account identifiers mapped to the initial device identifier bce of uk3 is two, and the number of account identifiers mapped to the initial device identifier aaa of uk100 is 400. Since the number of account identifiers mapped to the initial device identifier bce of uk3 is less than the threshold value, for example, when the threshold value is 150, the detector 111 detects the initial device identifier bce of uk3 as the workplace (850). ≪ / RTI > On the other hand, since the number of account identifiers mapped to the original device identifier aaa of uk 100 is greater than or equal to the threshold, the detector 111 may perform step 830, which will be described later.

One example of the above-mentioned threshold value 150 is only an example, and the threshold value is not limited to 150. [ Depending on the implementation, the detector 111 may be able to conditionally adjust or adjust the threshold value. For example, the detector 111 can set a large threshold to detect a large workplace and set a small threshold to detect a small workplace.

The detector 111 checks 830 whether there is an account identifier that is connected to the first device identifier of the detected first account identifier and the other device identifier of the first account identifier of the detected account identifier. As a result of the checking in step 830, if there is an account identifier that is accessed for a specific number of days or longer, the detector 111 may determine the initial device identifier of the corresponding account identifier as the device identifier of the workplace (840). For example, if the specified number of days is three days and uk100 of the account identifiers of the initial device identifier aaa logs in (or accesses the game) with the device identifier of bbb for four days or more, the detector 111 transmits the initial device identifier aaa of uk100 to the work center The device identifier of the device. The detector 111 can guess the device identifier bbb as the transfer subject of ownership of the uk100 account.

In an embodiment, the detector 111 or the server 110 may control the account identifiers mapped to aaa determined by the device identifier of the workplace.

If the detector 111 does not have an account identifier that has logged in for more than three days with the first device identifier aaa and the other device identifier among the account identifiers of the first device identifier aaa, then the first device identifier aaa corresponds to the workplace It can be decided not to do so.

It is to be understood that the three days of the specific days described above are exemplary only, and the specific days are not limited to those described above. Depending on the implementation, the detector 111 may calibrate or adjust a certain number of days.

In FIG. 8, step 830 is represented as being dependent on step 820. This is only an example, and steps 820 and 830 may be performed independently of each other or may be performed in parallel.

According to one embodiment, when the detector 111 determines a specific initial device identifier as the device identifier of the workplace through the workplace detection process, it can verify the accounts created in the workplace based on the game data. This verification process can make it clear that the accounts are created in the workplace. For example, when the detector 111 determines the initial device identifier aaa as the device identifier of the workplace, it checks at least one of the game access log, the game nickname, and the game level of each of the account identifiers mapped to the original device identifier aaa, Verification can be performed. The detector 111 determines whether the game connection log of each of the account identifiers mapped to the first device identifier aaa is a disconnected login logon, whether the game nicknames of respective account identifiers are consecutive nicknames, (Or an account that can be sold), and so on.

9 is a flowchart for explaining an example of a method of operating a server according to an embodiment.

Referring to FIG. 9, the server 110 generates reference information including account identifiers and initial device identifiers (910).

The server 110 obtains the number of account identifiers mapped to each of the original device identifiers through the generated reference information (920).

The server 110 detects an abnormal game activity based on the generated reference information and the obtained number (930). For example, the server 110 may detect the target initial device identifier using the generated reference information and the obtained number. More specifically, the server 110 can detect an account identifier estimated that the game user has changed and can check whether the number of account identifiers mapped to the original device identifier of the detected account identifier is equal to or greater than the first threshold value And it is possible to check whether or not there is an account identifier having a game count of day or more that is logged in with a device identifier different from the first device identifier of the first device identifier mapped to the first device identifier to a second threshold value or more, To detect the initial device identifier as the target initial device identifier. Here, the first threshold value may be, for example, 150, and the second threshold value may be, for example, 3 days. The first threshold value and the second threshold value may be corrected or adjusted. The server 110 may determine that the detected target initial device identifier is associated with an abnormal game activity. Here, the abnormal game activity may correspond to the above-mentioned work place.

1 through 8 can be applied to the matters described with reference to FIG. 9, so that a detailed description will be omitted.

10 is a flowchart for explaining another example of the operation method of the server according to the embodiment.

Referring to FIG. 10, the server 110 detects an initial device identifier satisfying a condition (1010). In one example, the server 110 may detect an initial device identifier of a particular account identifier if the login device identifier and the original device identifier are mapped to each other for a particular account identifier. As shown in FIG. 6, the server 110 may detect the initial device identifier bce and the initial device identifier aaa.

The server 110 obtains 1020 the number of account identifiers mapped to the detected initial device identifier. For example, the server 110 can confirm that two account identifiers are mapped to the first device identifier bce, and that 400 account identifiers are mapped to the first device identifier aaa, as in the example illustrated in Table 1 above Can be confirmed.

The server 110 checks whether there is an account identifier that is accessed for a predetermined number of days or more among the account identifiers mapped to the detected initial device identifier (step 1030). For example, the server 110 can check whether there is an account identifier that is connected to the game for at least three days using the first device identifier aaa and the other device identifier among the 400 account identifiers mapped to the first device identifier aaa.

The server 110 determines 1040 whether the detected initial device identifier is associated with an abnormal game activity based on the obtained number and the result of the check. For example, the server 110 may determine that the number 400 of account identifiers mapped to the initial device identifier aaa is equal to or greater than a threshold value (e.g., 150), and that the account identifier other than the initial device identifier aaa If there is an account identifier connected to the game, the initial device identifier aaa may be determined to be associated with an abnormal game activity.

1 through 9 can be applied to the matters described with reference to FIG. 10, so that a detailed description thereof will be omitted.

11 is a block diagram illustrating a server according to an embodiment.

Referring to FIG. 11, the server 110 includes a control unit 1110.

The control unit 1110 corresponds to the detector 111 and is implemented as a processor.

The description of the detector 111 of FIGS. 1 to 8 and the description of the server 110 of FIGS. 9 to 10 may be applied to the control unit 1110, so that the description of the control unit 1110 will be omitted.

The apparatus described above may be implemented as a hardware component, a software component, and / or a combination of hardware components and software components. For example, the apparatus and components described in the embodiments may be implemented within a computer system, such as, for example, a processor, a controller, an arithmetic logic unit (ALU), a digital signal processor, a microcomputer, a field programmable gate array (FPGA) , A programmable logic unit (PLU), a microprocessor, or any other device capable of executing and responding to instructions. The processing device may execute an operating system (OS) and one or more software applications running on the operating system. The processing device may also access, store, manipulate, process, and generate data in response to execution of the software. For ease of understanding, the processing apparatus may be described as being used singly, but those skilled in the art will recognize that the processing apparatus may have a plurality of processing elements and / As shown in FIG. For example, the processing unit may comprise a plurality of processors or one processor and one controller. Other processing configurations are also possible, such as a parallel processor.

The software may include a computer program, code, instructions, or a combination of one or more of the foregoing, and may be configured to configure the processing device to operate as desired or to process it collectively or collectively Device can be commanded. The software and / or data may be in the form of any type of machine, component, physical device, virtual equipment, computer storage media, or device , Or may be permanently or temporarily embodied in a transmitted signal wave. The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI > or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (22)

In a method of operating a server,
Generating reference information including account identifiers and initial device identifiers;
Obtaining the number of account identifiers mapped to each of the first device identifiers through the generated reference information; And
Detecting abnormal game activity based on the generated reference information and the obtained number
Lt; / RTI >
Wherein detecting the abnormal game activity comprises:
Whether the number of account identifiers mapped to a specific initial device identifier is greater than or equal to a first threshold value and whether the number of game accesses logged in with a device identifier different from the specific initial device identifier among the account identifiers mapped to the specific initial device identifier Determining whether the particular initial device identifier is associated with the abnormal game activity through the presence or absence of an account identifier that is greater than or equal to a second threshold value
/ RTI >
How the server works.
delete The method according to claim 1,
Wherein detecting the abnormal game activity comprises:
Determining whether the number of account identifiers mapped to the specific initial device identifier is greater than or equal to the first threshold value; And
Determining whether an account identifier having the game connection day number equal to or greater than the second threshold value is present
/ RTI >
How the server works.
The method according to claim 1,
Wherein detecting the abnormal game activity comprises:
Determining that the specific initial device identifier is associated with the abnormal game activity if the number of account identifiers mapped to the specific initial device identifier is equal to or greater than the first threshold value and the game access days are equal to or greater than the second threshold value Step
/ RTI >
How the server works.
The method according to claim 1,
Wherein detecting the abnormal game activity comprises:
Detecting an account identifier that logs in with an original device identifier and a different device identifier
≪ / RTI >
How the server works.
The method according to claim 1,
Wherein detecting the abnormal game activity comprises:
When the number of account identifiers mapped to the specific initial device identifier exceeds the first threshold value, an account identifier whose number of game connection days is equal to or greater than the second threshold value among the account identifiers mapped to the specific initial device identifier exists ; And
Determining that the specific initial device identifier is associated with the abnormal game activity if an account identifier with the game access days greater than or equal to the second threshold exists;
/ RTI >
How the server works.
The method according to claim 1,
Wherein each of the first device identifiers indicates a device identifier when each of the account identifiers is generated,
How the server works.
The method according to claim 1,
Wherein the reference information further comprises login device identifiers, a creation date of each of the account identifiers, and a login date of each of the account identifiers,
Wherein each of the login device identifiers indicates a device identifier when logging in each of the account identifiers,
How the server works.
Detecting an initial device identifier satisfying a condition;
Obtaining a number of account identifiers mapped to the detected first device identifier;
Checking whether there is an account identifier that is connected to the detected first device identifier and the other device identifier among the account identifiers for a predetermined number of days or more; And
Determining whether the acquired number is greater than or equal to a threshold value and based on the confirmation result whether the detected first device identifier is associated with an abnormal game activity
/ RTI >
How the server works.
10. The method of claim 9,
Wherein the detecting comprises:
If a different login device identifier and an original device identifier are mapped to a specific account identifier, detecting an original device identifier mapped to the specific account identifier
/ RTI >
How the server works.
11. The method of claim 10,
Wherein the detected first device identifier indicates a device identifier when the specific account identifier is generated,
How the server works.
Generating reference information including account identifiers and initial device identifiers, acquiring the number of account identifiers mapped to each of the initial device identifiers through the generated reference information, and generating the generated reference information and the obtained number A controller for detecting an abnormal game activity
Lt; / RTI >
Wherein,
Whether the number of account identifiers mapped to a specific initial device identifier is greater than or equal to a first threshold value and whether the number of game accesses logged in with a device identifier different from the specific initial device identifier among the account identifiers mapped to the specific initial device identifier Determining whether the particular initial device identifier is associated with the abnormal game activity through determining whether there is an account identifier that is greater than or equal to a second threshold value,
server.
delete 13. The method of claim 12,
Wherein,
Determining whether the number of account identifiers mapped to the specific initial device identifier is greater than or equal to the first threshold value,
Determining whether there is an account identifier whose number of game access days is equal to or greater than the second threshold,
server.
13. The method of claim 12,
Wherein,
Determining that the specific initial device identifier is associated with the abnormal game activity if the number of account identifiers mapped to the specific initial device identifier is equal to or greater than the first threshold value and the game access days are equal to or greater than the second threshold value doing,
server.
13. The method of claim 12,
Wherein,
Detecting an account identifier that logs in with an original device identifier and a different device identifier,
server.
13. The method of claim 12,
Wherein,
Determining whether the number of account identifiers mapped to the specific initial device identifier is greater than or equal to the first threshold value,
If the number of account identifiers mapped to the specific initial device identifier exceeds the first threshold value, whether an account identifier whose number of game access days is equal to or greater than the second threshold exists,
Determining that the specific initial device identifier is associated with the abnormal game activity if the account access period is greater than the second threshold,
server.
13. The method of claim 12,
Wherein each of the first device identifiers indicates a device identifier when each of the account identifiers is generated,
server.
13. The method of claim 12,
Wherein the reference information further comprises login device identifiers, a creation date of each of the account identifiers, and a login date of each of the account identifiers,
Wherein each of the login device identifiers indicates a device identifier when logging in each of the account identifiers,
server.
And acquires a number of account identifiers mapped to the detected first device identifier, and acquires a specific day count from the detected first device identifier and a device identifier different from the detected account identifier, Determining whether or not the acquired number is greater than or equal to a threshold value and determining whether the first device identifier is associated with an abnormal game activity based on the check result,
/ RTI >
server.
21. The method of claim 20,
Wherein,
When the different login device identifier and the first device identifier are mapped to the specific account identifier, the first device identifier mapped to the specific account identifier is detected,
server.
22. The method of claim 21,
Wherein the detected first device identifier indicates a device identifier when the specific account identifier is generated,
server.

Images