KR20200019079A - Apparatus and method for detection of abnormal user - Google Patents

Abstract

An abnormal user detection apparatus and method are presented. According to an embodiment of the present disclosure, a server may include an I / O interface for receiving an input for a game program that performs an item transaction using an exchange, a memory for storing a game log based on the input to the game program, and the game. And a processor for detecting a first abnormal user based on a transaction log of the program, wherein the processor detects the second abnormal user using IP (Internet Protocol) information of a terminal connected to the game program. And removing information about the detected first abnormal user and the second abnormal user from all user information, and generating index data for operation of the game program based on the removal result.

Description

Abnormal user detection apparatus and method {APPARATUS AND METHOD FOR DETECTION OF ABNORMAL USER}

The description below relates to techniques for stabilizing the indicators of game programs.

The indicators of the game are essential to the operation of the game. The game operator can check the operation status of the game based on the indicators of the game and determine the future operation direction. Even in a game of trading items using an exchange, the purpose of the user may be to generate revenue through the game rather than enjoying the game. These abnormal users perform trading activities based on mutually specific appointments. Thus, abnormal users may exhibit abnormal trading patterns.

According to an embodiment of the present disclosure, a server may include an I / O interface for receiving an input for a game program that performs an item transaction using an exchange, a memory for storing a game log based on the input to the game program, and the game. And a processor for detecting a first abnormal user based on a transaction log of the program, wherein the processor detects the second abnormal user using IP (Internet Protocol) information of a terminal connected to the game program. And removing information about the detected first abnormal user and the second abnormal user from all user information, and generating index data for operation of the game program based on the removal result.

The processor may extract a transaction log of a candidate abnormal user from the transaction log, generate a transaction relationship graph based on the candidate transaction log, and detect a first abnormal user based on the transaction relationship graph.

The processor may extract, as a transaction log of the candidate abnormal user, a transaction log having a time from a time point at which an item is registered to an exchange to a point of sale from the transaction log to a sale point or less.

The processor may classify the candidate abnormal user associated with the extracted transaction log and generate a transaction relationship graph based on the classified candidate abnormal user.

The processor may generate the transaction relationship graph using a node representing the candidate abnormal user and an edge indicating a transaction relationship.

The node may include classification information, a transaction amount, a transaction number, or state information of the candidate abnormal user, and the edge may include a seller, a buyer, and a transaction amount.

The processor may further include a time period from when the item is registered on the exchange to the time of sale, the number of purchasers who purchased the item from the same candidate abnormal user, and the total number of nodes connected to the node representing the candidate abnormal user in the trading relationship graph. The first abnormal user may be detected on the basis of.

The processor may obtain IP-user information from the IP information corresponding to the first abnormal user and filter the IP-user information.

The processor acquires IP information corresponding to the first abnormal user, generates the IP-user information based on the user information related to the IP information and the IP information, and updates the IP-user information on a daily basis. can do.

According to an embodiment, the terminal may include an I / O interface for transmitting an input for a game program for performing item trading using an exchange to a server, a memory for storing the game program, and an input for the game program. And a processor for executing a first abnormal user based on a transaction log of the game program, by using IP (Internet Protocol) information of a terminal accessing the game program. A second abnormal user is detected, information about the detected first abnormal user and the second abnormal user is removed from all user information, and index data for operating the game program is generated based on the removal result.

An indicator stabilization system according to an embodiment of the present invention includes a server for receiving an input for a game program for performing item trading using an exchange from a terminal, and storing a game log based on the input for the game program, and the game program. And a terminal configured to execute the game program based on an input to the terminal, and to transmit an input of the game program to a server, wherein the server is configured to generate a first abnormal user based on a transaction log of the game program. Detects a second abnormal user using IP (Internet Protocol) information of a terminal connecting to the game program, and removes the information about the detected first abnormal user and the second abnormal user from all user information; Based on the removal result, index data for operating the game program is generated.

An indicator stabilization method according to an embodiment includes detecting a first abnormal user based on a transaction log of the game program in a game program where item trading using an exchange is performed, and accessing the game program. Detecting a second abnormal user using IP (Internet Protocol) information of the terminal; removing information about the detected first abnormal user and the second abnormal user from all user information; and based on the removal result And generating indicator data for operating the game program.

The detecting of the first abnormal user may include extracting a transaction log of a candidate abnormal user from the transaction log, generating a transaction relationship graph based on the candidate transaction log, and based on the transaction relationship graph. Detecting an abnormal user.

The extracting may include extracting, as a transaction log of the candidate abnormal user, a transaction log whose time from when the item is registered to the exchange to the point of sale is less than or equal to a threshold value among the transaction logs.

The generating may include classifying the candidate abnormal user associated with the extracted transaction log and generating a transaction relationship graph based on the classified candidate abnormal user.

In the generating of the transaction relationship graph, the transaction relationship graph may be generated using a node representing the candidate abnormal user and an edge indicating a transaction relationship.

The node may include classification information, a transaction amount, a transaction number, or state information of the candidate abnormal user, and the edge may include a seller, a buyer, and a transaction amount.

The detecting of the first abnormal user may include: a time from when the item is registered to the exchange to the time of sale, the number of buyers who purchased the item from the same candidate abnormal user, and the candidate abnormal user in the trading relationship graph. The first abnormal user may be detected based on the total number of nodes connected to the node.

The detecting of the second abnormal user may include acquiring IP-user information from the IP information corresponding to the first abnormal user and filtering the IP-user information.

The acquiring of the IP-user information may include obtaining IP information corresponding to the first abnormal user, generating the IP-user information based on the user information related to the IP information and the IP information; And updating the IP-user information on a daily basis.

A computer readable storage medium according to one embodiment may store instructions for executing the method.

The computer program according to an embodiment may be stored in a storage medium for executing the method in combination with a computer.

1 is a diagram illustrating the overall configuration of a system for indicator stabilization of a game program according to an embodiment.
2 is a diagram illustrating a detailed configuration of a server for indicator stabilization of a game program according to an embodiment.
3 is a diagram illustrating a detailed configuration of a terminal for index stabilization of a game program according to an exemplary embodiment.
4 is a flowchart illustrating the overall operation of the indicator stabilization method according to an embodiment.
5 is a diagram illustrating an example of a transaction relationship graph.
6A is a diagram illustrating an example of abnormal users using a transaction relationship graph.
6B is a diagram illustrating another example of abnormal users using a transaction relationship graph.
7A is a diagram illustrating an example of updating IP-user information.
7B is a diagram illustrating an example of updating IP-user information.
8A is a diagram illustrating an example of IP-user grouping.
8B illustrates an example of removing an abnormal user using IP-user grouping.
9 is a flowchart illustrating an operation of an indicator stabilization method according to another embodiment.

Hereinafter, exemplary embodiments will be described in detail with reference to the accompanying drawings. However, various changes may be made to the embodiments so that the scope of the patent application is not limited or limited by these embodiments. It is to be understood that all changes, equivalents, and substitutes for the embodiments are included in the scope of rights.

The terminology used herein is for the purpose of description and should not be construed as limiting. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this specification, terms such as "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described on the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art, and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

In addition, in the description with reference to the accompanying drawings, the same components will be given the same reference numerals regardless of the reference numerals and duplicate description thereof will be omitted. In the following description of the embodiment, if it is determined that the detailed description of the related known technology may unnecessarily obscure the gist of the embodiment, the detailed description thereof will be omitted.

1 is a diagram illustrating the overall configuration of a system for indicator stabilization of a game program according to an embodiment.

According to an embodiment, the system for stabilizing the index of the game program 100 may stabilize the index by removing data associated with abnormal users 111 and 113 in the game program 100. Here, the indicator may mean data for operating the game program 100. Indicators can be used to check the operation status and situation of the game and determine the direction of operation. Thus, the indicator is an important factor in the operation of the game program 100.

In general, in a game in which P2P transactions are possible, the indicators are often contaminated by transactions between users. For example, in an MMORPG that can trade between users, there are a large number of abnormal users whose purpose is cashing through transactions, and the indicators for game operation may be contaminated by them. In general, games that support transactions between users without exchanges are able to unilaterally deliver goods to the other party without conditions, while exchange-oriented transactions are prohibited from unilateral delivery of goods, unpublished goods registrants, and designation of product price limits. The trading activity of the abnormal user may be limited.

Unlike PC games, there are many game programs in mobile games that do not allow transactions between users, but only through exchanges. Even in the case of operating an exchange, abnormal trading may be possible using pre-promised trading activities. The system for indicator stabilization can keep indicators healthy by eliminating abnormal users for game programs that adopt exchange-based trading. Surface stabilization can increase the efficiency of game operations.

The system for stabilizing the indicators of the game program 100 may detect abnormal users 111 and 113 using a transaction-based analysis method and an IP-based analysis method. The system can detect the IP of the workplace using a transaction based analysis method and an IP based analysis method. The system may be applied to the game program 100 in which item trading is implemented around the exchange 101.

The abnormal users 111 and 113 mean users whose main purpose is to generate revenue 123 using the exchange 101 rather than play the game program 100. The abnormal users 111 and 113 exhibit abnormal behavior different from that of the general users. In particular, the trading activity using the exchange 101 of the abnormal users 111 and 113 is different from the general users.

The trading activities of the abnormal users 111 and 113 are promised in advance, for example, a method of registering an item 121 that greatly exceeds an average price, or registering an item 121 of a promised quantity at a promised time. This belongs here. And the simplest and most common feature that can be seen as the trading activity of the abnormal user (111, 113) is that the transaction between the abnormal user (111, 113) is performed in a very short time.

According to an embodiment of the present disclosure, the system may obtain information about a transaction item 121, a seller, a buyer, a transaction time, and an item registration time of the game program 100. This information is stored as a transaction log. The system analyzes the transaction log to identify abnormal users 111 and 113 using the behavior patterns of the abnormal users 111 and 113 and the characteristics of the exchange 101-based system, which are completed within a short time from item registration to purchase of the goods. Can be detected.

According to an embodiment of the present disclosure, the indicator stabilization system receives an input for a game program 100 through which an item 121 transaction using the exchange 101 is performed from a terminal, and based on the input for the game program 100, a game log. A server for storing a log and a terminal for executing the game program 100 based on an input to the game program 100 and transmitting an input for the game program 100 to the server.

Here, the server detects the first abnormal user based on the transaction log of the game program 100. The server detects the second abnormal user using IP (Internet Protocol) information of the terminal connecting to the game program 100. The server removes the information about the first abnormal user and the second abnormal user detected from the total user information. The server generates indicator data for operating the game program 100 based on the removal result.

2 is a diagram illustrating a detailed configuration of a server for indicator stabilization of a game program according to an embodiment.

According to one embodiment, the server 200 includes a memory 201, a processor 203 and an I / O interface 205. The I / O interface 205 may receive an input from the terminal for a game program in which item trading using an exchange is performed. The memory 201 may store a game log based on an input for a game program. The processor 203 may detect the first abnormal user based on the transaction log of the game program.

The processor 203 detects the second abnormal user using IP (Internet Protocol) information of the terminal connecting to the game program. The processor 203 removes the information about the first abnormal user and the second abnormal user detected from the total user information. The processor 203 generates indicator data for operating the game program based on the removal result.

According to an embodiment, the processor 203 may extract a transaction log of a candidate abnormal user from the transaction log. The processor 203 may generate a transaction relationship graph based on the candidate transaction log. The processor 203 may detect the first abnormal user based on the transaction relationship graph.

According to an embodiment of the present disclosure, the processor 203 may extract, as a transaction log of a candidate abnormal user, a transaction log whose time from when the item is registered on the exchange to the point of sale is less than or equal to the threshold value among the transaction logs.

The processor 203 may classify the candidate abnormal user associated with the extracted transaction log. The processor 203 may generate a transaction relationship graph based on the classified candidate abnormal user. The processor 203 may generate a transaction relationship graph using a node representing a candidate abnormal user and an edge representing a transaction relationship.

Here, the node may include classification information, a transaction amount, a transaction number, or state information of a candidate abnormal user, and an edge may include a seller, a buyer, and a transaction amount. However, the node is only an example, and any term may be used as long as it includes classification information, transaction amount, transaction number, or status information of a candidate abnormal user. An edge is merely an example and any term may be used as long as it includes a seller, a buyer and a transaction amount.

The processor 203 determines the time from when the item is registered on the exchange to the time of sale, the number of buyers who purchased the item from the same candidate abnormal user, and the total number of nodes connected to the node representing the candidate abnormal user in the trading relationship graph. The first abnormal user can be detected on the basis.

According to an embodiment, the processor 203 may obtain IP-user information from the IP information corresponding to the first abnormal user and filter the IP-user information.

The processor 203 may obtain IP information corresponding to the first abnormal user. The processor 203 may generate IP-user information based on the user information and the IP information related to the IP information. The processor 203 may update the IP-user information on a daily basis.

3 is a diagram illustrating a detailed configuration of a terminal for index stabilization of a game program according to an exemplary embodiment.

According to an embodiment, the terminal 300 includes a memory 301, a processor 303, and an I / O interface 305. The I / O interface 305 may transmit an input for a game program that performs item trading using an exchange to a server. The memory 301 stores a game program. The processor 303 executes the game program based on the input to the game program.

Here, the first abnormal user (User) is detected by the server based on the transaction log of the game program, and the second abnormal user is detected by using IP (Internet Protocol) information of the terminal connecting to the game program, and all the users are detected. Information about the first abnormal user and the second abnormal user detected in the information is removed, and index data for operating the game program is generated based on the removal result.

4 is a flowchart illustrating the overall operation of the indicator stabilization method according to an embodiment.

According to one embodiment, the system may achieve indicator stabilization by extracting suspicious transaction history, generating a transaction relationship graph, and removing abnormal users.

According to one embodiment, in step 401, the server for indicator stabilization detects the first abnormal user based on the transaction log of the game program. The server may extract the transaction log of the candidate abnormal user from the transaction log. The server may extract, as a transaction log of a candidate abnormal user, a transaction log whose time from when the item is registered on the exchange to the point of sale is less than or equal to the threshold value in the transaction log. In the following, the transaction log may be mixed with the transaction details.

Transactions between abnormal users are usually made in a short time. The server may extract suspicious transaction details. The server may extract a transaction history of which a difference from registration of goods to completion of sale of goods is less than or equal to a threshold value among daily transaction details. In the extracted transaction log, users are classified into three types according to the role of seller and buyer. Seller refers to the user who sells the item, Buyer refers to the user who purchases the item, and Seller / Both refers to the user who has both characteristics. Specifically, the seller may refer to a user having only a record of selling goods in the entire transaction record for one day. The buyer may refer to a user who has only a record of purchase of goods in the entire transaction record of the day. The sale / buyer may refer to a user who has both a record of goods sales and a purchase among the entire day's transaction records.

The server may generate a transaction relationship graph based on the candidate transaction log. The server may classify the candidate abnormal user associated with the extracted transaction log. The server may generate a transaction relationship graph based on the classified candidate abnormal user. The server may generate a transaction relationship graph using a node representing a candidate abnormal user and an edge representing a transaction relationship. The node may include classification information, transaction volume, transaction count or status information of the candidate abnormal user, and the edge may include seller, buyer, and transaction amount.

The transaction-based detection method performs index stabilization through a transaction relationship graph, and can detect abnormal users with high accuracy, but there is a problem in that user behavior before a transaction time cannot be determined because a transaction record is necessary. .

According to one embodiment, in step 403, the server for index stabilization detects the second abnormal user using IP (Internet Protocol) information of the terminal accessing the game program. The server may determine whether the user is abnormal even with respect to user behavior before the transaction time by detecting the abnormal user using the IP information.

According to one embodiment, in step 405, the server for indicator stabilization removes the information about the first abnormal user and the second abnormal user detected in the total user information. According to one embodiment, in step 407, the server for indicator stabilization generates indicator data for the operation of the game program based on the removal result.

The server is based on the time from when the item is registered on the exchange to the time of sale, the number of buyers who purchased the item from the same candidate abnormal user, and the total number of nodes connected to the node representing the candidate abnormal user in the trading relationship graph. 1 Abnormal user can be detected.

The server may obtain IP-user information from the IP information corresponding to the first abnormal user. The server can filter the IP-user information. The server may obtain IP information corresponding to the first abnormal user. The server may generate IP-user information based on the user information and the IP information related to the IP information. The server can update the IP-user information on a daily basis.

IP-based anomaly detection method for new users takes advantage of the fact that many abnormal users create and use large-scale accounts on the same IP. The server may perform the index stabilization operation in two stages: detecting abnormal subscription users, removing abnormal users, and stabilizing the index.

Through this, unlike the transaction-based analysis, the server has an advantage that can check the fast and stabilized indicators with only one day of log data. The server may apply an IP-based analysis method to generate marketing indicators that need to be determined quickly, such as inflow rate or remaining rate of new users.

The server can detect the abnormal new user. In the abnormal new user detection step, the server may detect the abnormal subscription user by analyzing the connection IP of the new account creation date. The detection process first stores the relationship between the newly subscribed users and all IPs accessed by the users in a table, and groups the information into IPs. The number of accounts connected to each IP is defined as a new user by filtering out users whose threshold is greater than or equal to n.

The server may perform abnormal user removal and index stabilization. The server excludes the detected abnormal new users from the target for extracting the stabilized index, and may use the IP list accessed by the server for the abnormal user detection in real time.

The server may detect abnormal users using the transaction information and the IP information. Since the transaction analysis-based method is detected when a user performs an abnormal transaction, it takes a certain time until the detection, and the IP-based abnormal user detection method requires a log for one day. In practice, however, there may be a need for faster user trending. For example, if you are marketing by the hour, but suddenly the number of new users is suddenly increasing, you can't make accurate decisions because you don't know whether it is the effect of marketing or the inflow of workplace. For this reason, the server can apply a method for providing real-time indicators. The server can also apply a more generalized method that can be used to generate daily indicators by mixing transaction-based analysis and IP-based anomaly detection. The server may perform three stages of index stabilization by obtaining IP information, grouping and filtering IP users, and removing abnormal users.

5 is a diagram illustrating an example of a transaction relationship graph.

The transaction relationship graph 500 is a graph representing a relationship between users generated through a transaction. The graph is composed of nodes (510, 521, 523, 525) and edge (Edge), the node represents the information about the user, the edge represents the relationship about the transaction. When the transaction relationship is expressed in the form of a graph and the analysis is performed, information such as how often a transaction occurs between users and how much money is traded can be displayed, and thus the relationship between users can be easily identified. .

Nodes include the type of user (Type: Seller (Banker, 510), Buyer (Worker), Both (Banker, Seller, 521, 523, 535)), IP information (min (IP) per day), and user status (user_status). : static, changed), the amount of transactions (sales, purchases), the number of transactions (sales, number of purchases) or the number of users having the same IP and the like. An edge may include a source of a node, a destination of a node, and a weight of a node.

Seller, Buyer, and Seller / Both may have the following roles in terms of goods movement. Seller may have a role of receiving goods through the sale of goods. Buyer may have a role of delivering goods through the purchase of goods. Seller / Both may have a role to receive and deliver goods.

The server may detect the first abnormal user based on the transaction relationship graph. Anomalous users can be categorized into bankers who collect goods for reasons of time or efficiency, and workers who collect them. And some of the bankers may pass the goods to other bankers, or may act to cash the goods after delivering the goods to the normal user. Because workers have a purpose to collect goods, they can only deal with bankers without trading with other users. This feature allows the worker to act as a buyer, with only a record of purchase of goods. Because bankers have a purpose to hold goods, they can play the role of a seller who has only records of goods sold. However, in some cases, the goods may be delivered to a normal user for the purpose of cashing, or the goods may be delivered to other bankers. In this case, the banker may serve as a seller / buyer.

The server may detect a worker and a banker based on this feature for a certain period of transactions using a transaction relationship graph, and determine that the user is an abnormal user and remove the user. Here, the predetermined period may include, for example, one day. The server can detect these users as abnormal users only when a large number of buyers are connected to a seller who only sells one of the users who have suspicious transactions registered and sold within t minutes. have.

The server may apply three criteria when determining an abnormal user using the transaction relationship graph.

-Item transaction time threshold t: represents the time required between the item registration and the item purchase. Within t minutes, all transactions become data for graph generation. For example, a condition of commodity trading time <= t may apply.

Buyer threshold b: indicates the number of buyers who have purchased goods from the same user. An abnormally large number of buyers buying exchange items from the same user may indicate that both the registered user and the purchased user are abnormal users. For example, the condition of the number of buyers> = b may apply.

Connection group threshold c: represents the total number of nodes connected in a transaction relationship. The server may first detect the users exceeding the value of b, and then adjust the size of the candidate abnormal user according to the size among the abnormal users through the size of c.

6A is a diagram illustrating an example of abnormal users using a transaction relationship graph. 6B illustrates another example of abnormal users using a transaction relationship graph.

6A illustrates a result of determining abnormal users using a transaction relationship graph. Each point represents a node representing a user, and the line between the points represents an edge representing a transaction between users. In this case, the node is expressed as the sum of the transaction amounts is larger, and the seller is represented by dark gray, the seller / buyer is represented by light gray, and the buyer is represented by white. For example, a server filters nodes whose nodes are dark gray (seller) or light gray (sales and buyers) in the transaction relationship graph, with a large number of connected white nodes (buyers) and the number of all connected nodes above the threshold. Can be detected as an abnormal user.

FIG. 6B is a diagram illustrating only an abnormal user extracted by applying the three criteria described in FIG. 6A. According to Figure 6b, it can be confirmed that a large number of buyers are connected to the same user. Indicator stabilization refers to the process of excluding abnormally divided users from indicator data.

7A is a diagram illustrating an example of updating IP-user information. 7B is a diagram illustrating an example of updating IP-user information.

The server can obtain IP information. In order to apply the workplace analysis method using the transaction information and the IP information, the process of acquiring the information about the abnormal IP must be preceded by the new accounts. Here, the abnormal IP refers to an IP in which multiple account access information is detected at the same IP among all IP information accessed at the time of creating a new account of the user, or an abnormal user has been detected through a transaction-based analysis method. The IP information thus obtained is updated daily in the form of IP-user together with the relevant user information and can be used for the subsequent abnormal user removal process.

1(비정상)로는 갱신이 가능하지만 1(비정상)

0(정상)으로는 갱신되지 않는다. 이는 최대한 많은 이상 유저들을 검출하여 지표 안정화에 도움을 주기 위함이며, 비정상으로 판단하는 방법이 모든 이상 유저를 검출하지는 못할 수도 있기 때문이다.The daily IP-user information update consists of updating the abnormal IP-user information detected on the day to the updated IP-user information up to the previous day. 7A and 7B illustrate this update process (701, 702, 703, 704, 705, 706). Here, the daily abnormality is determined as 1 (abnormal) when detected by the transaction-based analysis method or IP-based abnormal user detection method, and 0 (normal) in other cases. This anomaly value is 0 (normal) at the time of update.

Update is possible in 1 (abnormal), but 1 (abnormal)

It is not updated to 0 (normal). This is to assist in stabilizing the indicator by detecting as many abnormal users as possible, since the method of determining abnormality may not detect all abnormal users.

Since IP information can be changed, it can be used more flexibly by selectively selecting and updating only the information of the last period (T days). FIG. 7B is a diagram illustrating an example of updating using only information of a recent period (T = 2).

8A is a diagram illustrating an example of IP-user grouping. 8B is a diagram illustrating an example of removing an abnormal user using IP-user grouping.

Servers can group and filter IP users. IP user grouping is the process of grouping by IP at the time of new account creation using the data obtained through the IP information acquisition process, and identifying the total number of users and the number of workplace users connected to individual IPs.

The server may perform filtering to remove abnormal users after grouping. There are two filtering methods, IP based filtering and user-IP based filtering. IP-based filtering refers to a method of performing filtering above a specific threshold based on the probability of anomaly by IP. The filtering method for each user-IP is a method of calculating a probability based on access IP information of each user and filtering based on a threshold value since there may be a record of access by multiple IPs on account creation date for each user. 8B illustrates a method of IP-based filtering and user-IP-based filtering by applying a threshold value of zero. Since the user-IP anomaly probability calculation method is calculated based on all IPs accessed by a user during a day, the time required for a day is required. Can be calculated. Therefore, if an abnormal user is to be detected in real time, an IP abnormality probability calculation method is used. If a user-based probability detection is used, a user-IP abnormality probability calculation method may be used.

According to FIG. 8B, in step 803, the server may generate a table based on the IP of the new user and the user identifier. In step 802, the server may perform IP grouping. In steps 804 and 805, the server may perform an abnormal probability calculation. In steps 806 and 807, the server may perform filtering if the abnormal user is greater than zero. Where steps 804 and 806 are IP probability based filtering and steps 805 and 807 represent user-IP probability based filtering.

9 is a flowchart illustrating an operation of an indicator stabilization method according to another embodiment.

In step 901, the server can configure a transaction tool. In step 902, the server may perform a transaction based analysis. In step 903, the server may detect an abnormal new user. In step 904, the server may collect IP information. In step 905, the server may perform IP grouping. In step 906, the server may perform an IP anomaly probability calculation. In operation 907, the server may check whether there is an error in real time. In step 908, the server may perform a user-IP anomaly probability calculation. In step 909, the server can secure the abnormal user information. In operation 910, the server may perform an index calculation based on the result.

The method according to the embodiment may be embodied in the form of program instructions that can be executed by various computer means and recorded in a computer readable medium. Computer-readable media may include, alone or in combination with the program instructions, data files, data structures, and the like. The program instructions recorded on the media may be those specially designed and constructed for the purposes of the embodiments, or they may be of the kind well-known and available to those having skill in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks, and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic disks, such as floppy disks. Magneto-optical media, and hardware devices specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include not only machine code generated by a compiler, but also high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate as one or more software modules to perform the operations of the embodiments, and vice versa.

The software may include a computer program, code, instructions, or a combination of one or more of the above, and may configure the processing device to operate as desired, or process independently or collectively. You can command the device. Software and / or data may be any type of machine, component, physical device, virtual equipment, computer storage medium or device in order to be interpreted by or to provide instructions or data to the processing device. Or may be permanently or temporarily embodied in a signal wave to be transmitted. The software may be distributed over networked computer systems so that they may be stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

Although the embodiments have been described with reference to the accompanying drawings, those skilled in the art may apply various technical modifications and variations based on the above. For example, the described techniques may be performed in a different order than the described method, and / or components of the described systems, structures, devices, circuits, etc. may be combined or combined in a different form than the described method, or other components. Or even if replaced or replaced by equivalents, an appropriate result can be achieved.

Therefore, other implementations, other embodiments, and equivalents to the claims are within the scope of the following claims.

[One]

Claims (1)

An I / O interface for receiving input from a terminal for a game program in which item trading using an exchange is performed;
A memory for storing a game log based on an input to the game program; And
A processor for detecting a first abnormal user based on a transaction log of the game program,
The processor,
A second abnormal user is detected using IP (Internet Protocol) information of a terminal accessing the game program,
Removing information on the detected first abnormal user and second abnormal user from all user information,
Generating indicator data for operation of the game program based on the removal result;
server.

Images