ANOMALY DETECTION FOR RULES-BASED SYSTEM

• US 20150238866A1
• Filed: 02/26/2015
• Published: 08/27/2015
• Est. Priority Date: 02/27/2014
• Status: Active Grant

• Current Assignee: Mohammad Iman Khabazian
• Original Assignee: Mohammad Iman Khabazian
• Inventors: Khabazian, Mohammad Iman
• Granted Patent: US 9,694,286 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: A63F 13/75 Enforcing rules, e.g. detecting foul play or generating lists of cheating players

Abstract

For cheat likelihood calculation, a method records client activity for a client. The client activity includes components of a game economy including burns calculated as a function of measurable client sacrifices to a game and earns calculated as a function of measurable game rewards from the game. The method calculates the cheat likelihood from the probability of the client activity being anomalous.

Claims

1. A method comprising:

recording, by use of a processor, client activity for a client, wherein the client activity comprises components of a game economy comprising burns calculated as a function of measurable client sacrifices to a game and earns calculated as a function of measurable game rewards from the game; and

calculating a cheat likelihood from a probability of the client activity being anomalous.

2. The method of claim 1, wherein the probability of the client activity is calculated by:

calculating activity weights from client activity recorded for the client;

calculating a total burn and a total earn from the activity weights for the client activity.

3. The method of claim 2, wherein the activity weights are calculated by minimizing an activity function COST that is based on the client activity, the activity weights comprising burn weights and earn weights.

4. The method of claim 3, wherein the activity weights are calculated by minimizing an activity function COST, COST is calculated as COST=Σ

_i=1ⁿθ

_iw_i, and wherein each ith activity weight θ

_i is calculated as θ

_i=θ

_i−

(λ

*h*x_i) for a given ith client activity a_i, λ

is a learning rate, x_i is an earn, h is a hypothesis for calculating the activity weight θ

_i given the earned and the predecessor activity weights, and w_i is a watched scalar for the activity weight.

5. The method of claim 3, wherein the activity function COST is calculated as COST=Σ

_a=0^m((burn_a−

earn_a)² where m is a number of a plurality of client activities, a is a given client activity of the plurality of client activities, burn_a is a burn value for the given client activity calculated as burn_a=Σ

_i=0^bθ

_bai*burn_ia where θ

_bai is a burn weight for an ith activity a, earn_a is an earn value for the given client activity calculated as earn_a=Σ

_i=0^eθ

_eai*earn_ia where θ

_eai is an weight for an ith client activity a.

6. The method of claim 3, wherein the activity function COST is calculated as COST=Σ

_a=0^m((burn_a−

earn_a)²+SCΣ

_i=0ⁿ(θ

_i−

Θ

_i)²) where m is a number of a plurality of activities, Θ

_i is a last learned activity weight, a is a given activity of the plurality of activities, burn_a is a burn value for the given activity calculated as burn_a=Σ

_i=0^bθ

_bai*burn_ia where θ

_bai is a burn weight for an ith activity a, earn_a is an earn value for the given activity calculated as earn_a=Σ

_i=0^eθ

_eai* earnia where θ

_eai is an weight for an ith activity a, S is a number of cumulative samples, and C is an economy change value.

7. The method of claim 5, wherein the economy change value is a value between 0 and 1, with 0 represented maximum change and 1 representing no change.

8. The method of claim 5, wherein the learning rate is initially calculated as a specified value yielding a minimum activity COST function.

9. The method of claim 5, wherein the learning rate is selected by calculating the minimum activity COST function for at least three learning rates, each learning rate with at least an order of magnitude separation from each other learning rate, and selecting the learning rate that yields the lowest activity COST function.

10. The method of claim 9, the method further comprising iteratively selecting at least three next learning rates based on a selected learning rate and selecting the activity weights and the learning rate that yields the lowest activity COST function for all learning rates.

11. The method of claim 1, the method further comprising organizing the burns in discrete bands with corresponding earns.

12. The method of claim 11, wherein a probability of a corresponding total earn is calculated from each band.

13. The method of claim 11, wherein each band is divided in response to a statistical model for the band exceeding a maximum variance.

14. An apparatus comprising:

a server comprising;

a processor;

a memory that stores code executable by the processor, the code comprising;

code that records client activity for a client, wherein the client activity comprises components of a game economy comprising burns calculated as a function of measurable client sacrifices to a game and earns calculated as a function of measurable game rewards from the game; and

code that calculates a cheat likelihood from a probability of the client activity being anomalous.

15. The apparatus of claim 14, wherein the probability of the client activity is calculated by:

calculating activity weights from client activity recorded for the client;

calculating a total burn and a total earn from the activity weights for the client activity.

16. The apparatus of claim 15, wherein the activity weights are calculated by minimizing an activity function COST that is based on the client activity, the activity weights comprising burn weights and earn weights.

17. A program product comprising a computer readable storage medium that stores code executable by a processor, the executable code comprising code to perform:

recording client activity for a client, wherein the client activity comprises components of a game economy comprising burns calculated as a function of measurable client sacrifices to a game and earns calculated as a function of measurable game rewards from the game; and

calculating a cheat likelihood from a probability of the client activity being anomalous.

18. The program product of claim 17, wherein the probability of the client activity is calculated by:

calculating activity weights from client activity recorded for the client;

calculating a total burn and a total earn from the activity weights for the client activity.

19. The program product of claim 18, wherein the activity weights are calculated by minimizing an activity function COST that is based on the client activity, the activity weights comprising burn weights and earn weights.

20. The program product of claim 19, wherein the activity weights are calculated by minimizing an activity function COST, COST is calculated as COST=Σ

_i=1ⁿθ

_iw_i, and wherein each ith activity weight θ

_i is calculated as θ

_i=θ

_i−

(λ

*h*xⁱ) for a given ith client activity a_i, λ

is a learning rate, x_i is an earn, h is a hypothesis for calculating the activity weight θ

_i given the earned and the predecessor activity weights, and w_i is a watched scalar for the activity weight.