PREVENTION OF CHEATING IN ON-LINE INTERACTION

• US 20080305869A1
• Filed: 04/15/2008
• Published: 12/11/2008
• Est. Priority Date: 09/05/2006
• Status: Abandoned Application

• Current Assignee: Cognisafe Ltd.
• Original Assignee: Cognisafe Ltd.
• Inventors: Shimon, Yitzhak, Konforty, Shmuel
• Application Number:
  US12/103,522
• Publication Number:
  US 20080305869A1
• Time in Patent Office: Days
• US Class Current: 463/29
• CPC Class Codes: A63F 13/12 involving interaction between a plurality of game devices, e.g. transmisison or distribution systems protocols for networked virtual reality, networked games H04L29/06034
• CPC Class Codes: A63F 13/30 Interconnection arrangements between game servers and game devices; Interconnection arrangements between game devices; Interconnection arrangements between game servers
• CPC Class Codes: A63F 13/75 Enforcing rules, e.g. detecting foul play or generating lists of cheating players
• CPC Class Codes: A63F 13/77 involving data related to game devices or game servers, e.g. configuration data, software version or amount of memory
• CPC Class Codes: A63F 2300/552 for downloading to client devices, e.g. using OS version, hardware or software profile of the client device
• CPC Class Codes: A63F 2300/5586 for enforcing rights or rules, e.g. to prevent foul play
• CPC Class Codes: A63F 2300/6027 using adaptive systems learning from user actions, e.g. for skill level adjustment
• CPC Class Codes: G07F 17/3241 Security aspects of a gaming system, e.g. detecting cheating, device integrity, surveillance computer security G06F21/00
• CPC Class Codes: G07F 17/3276 wherein the players compete, e.g. tournament

Abstract

A method for preventing cheating by users of client computers running a network game program includes installing a monitoring program, independent of the network game program, on a group of the client computers so as to detect, using the monitoring program, an anomalous use of an asset of at least one of the client computers that is indicative of an attempt to cheat in the game program. A message is conveyed over a network to a server from each of at least some of the client computers in the group. The message from each such client computer indicates that the monitoring program has been actuated on the client computer. Responsively to the message, the client computers receive a message from the server at the client computer indicating which ones of the client computers have actuated the monitoring program.

Claims

1. A method for preventing cheating by users of client computers running a network game program, the method comprising:

installing a monitoring program, independent of the network game program, on a group of the client computers so as to detect, using the monitoring program, an anomalous use of an asset of at least one of the client computers that is indicative of an attempt to cheat in the game program;

conveying over a network to a server a message from each of at least some of the client computers in the group, the message from each such client computer indicating that the monitoring program has been actuated on the client computer; and

responsively to the message, receiving from the server at the client computer a communication indicating which ones of the client computers have actuated the monitoring program.

2. The method according to claim 1, and comprising displaying on the client computer a list of the client computers have actuated the monitoring program, and receiving from a user of the client computer a selection, based on the list, of participants with whom to join in playing the game program.

3. The method according to claim 1, wherein the monitoring program is configured so as to permit a user of the client computer to deactuate the monitoring program with respect to the game program, and wherein conveying the message comprises informing the server when the monitoring program is deactuated.

4. The method according to claim 1, and comprising running the monitoring program while playing the game program on the client computer so as to detect an anomalous pattern of utilization of assets on the client computer, which is indicative of a threat of cheating in the network game program, and notifying a user of the client computer of the threat.

5. The method according to claim 4, and comprising sending a notification of the threat over the network to at least one of the server and others of the client computers.

6. The method according to claim 4, wherein running the monitoring program comprises running the network game program on the client computer while detecting use of assets using the monitoring program so as to learn a pattern of normal utilization of the assets, and then detecting the anomalous pattern as a deviation from the normal utilization.

7. A method for preventing cheating by users of computers running a network game program, the method comprising:

installing a monitoring program, independent of the network game program, on the computer;

running the network game program on the computer while detecting use of assets using the monitoring program so as to learn a pattern of normal utilization of the assets;

during a session of the network game program, detecting an anomalous utilization pattern of the assets, which is indicative of a threat of cheating in the network game program; and

outputting a notification of the threat to a user of the computer.

8. The method according to claim 7, wherein detecting the use of the assets comprises learning the pattern during at least one of installation of the game program and playing of the game program by the user.

9. The method according to claim 7, wherein detecting the use of the assets comprises applying a threat map based on the use of the assets, and wherein detecting the anomalous utilization pattern comprises receiving an event associated with one of the assets, and associating the event with the threat map with a likelihood that is greater than a predetermined threshold.

10. The method according to claim 9, wherein the threat map relates to a first event, and wherein associating the event with the threat map comprises receiving a second event that is not in the first threat map, and associating the second event with the threat map by a process of semantic inquiry.

11. The method according to claim 10, and comprising updating the threat map responsively to the semantic inquiry.

12. The method according to claim 11, wherein updating the threat map comprises identifying a plurality of candidate threat maps, computing a respective hypothetical likelihood that the second event is associated with each of the candidate threat maps, and selecting one of the candidate threat maps for update based on the hypothetical likelihood.

13. The method according to claim 7, wherein running the network game program comprises learning the pattern of the normal utilization using the monitoring program autonomously, independently of any identification of the assets by the user.

14. The method according to claim 7, wherein detecting the anomalous utilization pattern comprises receiving an event indicative of a deviation from the pattern of normal utilization in the use of at least one asset selected from a group of the assets consisting of CPU utilization, network utilization, files and directories.

15. The method according to claim 7, wherein running the network game program comprises calculating a normal centralism of an executable file during the normal utilization of the assets, and wherein detecting the anomalous utilization pattern comprises detecting a deviation from the normal centralism.

16. A computer software product for preventing cheating by users of client computers running a network game program, the product comprising a computer-readable medium in which program instructions are stored, the instructions comprising a monitoring program for installation on a group of the client computers independently of the network game program, wherein the instructions cause the client computers to detect, using the monitoring program, an anomalous use of an asset of at least one of the client computers that is indicative of an attempt to cheat in the game program, and

wherein the instructions cause the client computers to convey over a network to a server a message from each of at least some of the client computers in the group, the message from each such client computer indicating that the monitoring program has been actuated on the client computer, and responsively to the message, to receive from the server at the client computers a communication indicating which ones of the client computers have actuated the monitoring program.

17. A computer software product for preventing cheating by users of computers running a network game program, the product comprising a computer-readable medium in which program instructions are stored, the instructions comprising a monitoring program for installation on a computer independently of the network game program, wherein the instructions cause the computer, while running the network game program, to detect use of assets using the monitoring program so as to learn a pattern of normal utilization of the assets, and to detect, during a session of the network game program, an anomalous utilization pattern of the assets, which is indicative of a threat of cheating in the network game program, and to output a notification of the threat to a user of the computer.

18. Computing apparatus, comprising:

an output device; and

a processor, which is configured to run a network game program, and to receive installation of a monitoring program independently of the network game program, wherein the monitoring program causes the processor to detect an anomalous use of an asset of the computing apparatus that is indicative of an attempt to cheat in the game program, and further causes the processor to convey over a network to a server a message indicating that the monitoring program has been actuated on the computing apparatus, and responsively to the message, to receive from the server a communication identifying other computers that have actuated the monitoring program, and to provide to a user of the computing apparatus, via the output device, list of users of the other computers identified by the communication.

19. Computing apparatus, comprising:

an output device; and

a processor, which is configured to run a network game program, and to receive installation of a monitoring program independently of the network game program, wherein the monitoring program causes the processor, while running the network game program, to detect use of assets using the monitoring program so as to learn a pattern of normal utilization of the assets, and to detect, during a session of the network game program, an anomalous utilization pattern of the assets, which is indicative of a threat of cheating in the network game program, and to output a notification of the threat via the output device to a user of the computing apparatus.