Detecting lag switch cheating in game

• US 9,636,589 B2
• Filed: 11/02/2010
• Issued: 05/02/2017
• Est. Priority Date: 11/02/2010
• Status: Active Grant

• Current Assignee: Sony Interactive Entertainment LLC (Sony Group Corp.)
• Original Assignee: Sony Interactive Entertainment America LLC (Sony Group Corp.)
• Inventors: Tandon, Vinod, Devore, Jake
• Primary Examiner(s): GALKA, LAWRENCE STEFAN
• Application Number:
  US12/917,642
• Publication Number:
  US 20120108327A1
• Time in Patent Office: 2,373 Days
• Field of Search: 463 29, 463 42
• CPC Class Codes: A63F 13/34 using peer-to-peer connections
• CPC Class Codes: A63F 13/35 Details of game servers
• CPC Class Codes: A63F 13/71 using secure communication between game devices and game servers, e.g. by encrypting game data or authenticating players
• CPC Class Codes: A63F 13/75 Enforcing rules, e.g. detecting foul play or generating lists of cheating players
• CPC Class Codes: A63F 13/79 involving player-related data, e.g. identities, accounts, preferences or play histories
• CPC Class Codes: A63F 2300/534 for network load management, e.g. bandwidth optimization, latency reduction
• CPC Class Codes: A63F 2300/535 for monitoring, e.g. of user parameters, terminal parameters, application parameters, network parameters
• CPC Class Codes: A63F 2300/552 for downloading to client devices, e.g. using OS version, hardware or software profile of the client device
• CPC Class Codes: A63F 2300/5586 for enforcing rights or rules, e.g. to prevent foul play
• CPC Class Codes: A63F 3/00643 Electric board games; Electric features of board games electric word or number games A63F3/0421; computer chess G06F; electric raffle games A63F3/081
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 67/125 involving control of end-device applications over a network
• CPC Class Codes: H04L 67/131 Protocols for games, networked simulations or virtual reality
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols

Abstract

Detecting lag switch cheating in a gaming network is disclosed. Data packets are received from a client. The data packets have tracking data including at least one of a sequence number and a time stamp. The tracking data is monitored to determine that a cheat-detection event has occurred.

Claims

1. A method for detecting cheating in a gaming network, the method comprising:

generating a first set of rules, wherein the first set of rules define acceptable user activity in a gaming network, and wherein the generated rules are defined based on observations of a performance of the gaming network;

receiving data packets from a client in the gaming network, wherein the data packets are received at a network interface communicatively coupled to the gaming network and have tracking data that includes at least one of a sequence number or a time stamp indicating the progression of a game character through a game environment in the gaming network, and wherein the received data packets correspond to user activity for the client in the gaming network;

monitoring the user activity for clients that may violate the generated first set of rules, wherein the user activity is monitored in response to execution of a monitoring module by a processor, and wherein the monitoring module is stored in memory; and

determining that a client violated the generated first set of rules thereby identifying the client as a deviant client, wherein the determination that the client violated the generated first set of rules includes;

identifying one or more pre-defined thresholds corresponding to indicia for changes in deltas between tracking data of data packets associated with the client and tracking data of data packets associated with different clients;

determining that there are changes in deltas between tracking data of data packets associated with the client and tracking data of data packets associated with different clients;

detecting that the determined delta changes between the different clients in view of the delta changes with the client exceeds one or more of the pre-defined thresholds used to identify cheating; and

identifying that the detected delta changes between the different clients and the gaming network indicate cheating based on the one or more identified pre-defined thresholds, wherein the evaluation and the pre-defined thresholds are based on parameters associated with the performance of the gaming network identified as acceptable user activity.

2. The method of claim 1, further comprising identifying at least one user associated with the client sending the monitored data packets that include indicia exceeding the predefined threshold.

3. The method of claim 2, further comprising sending information over the gaming network indicating that the client sending the monitored data packets is suspected of cheating, the information sent by way of a network interface communicatively coupled to the gaming network.

4. The method of claim 1, further comprising penalizing the at least one user associated with the client sending the monitored data packets that include indicia exceeding the predefined threshold.

5. The method of claim 1, wherein the sequence number is encrypted.

6. The method of claim 1, wherein the change in deltas of the sequence number of the client is indicative of the existence of packet loss.

7. The method of claim 1, wherein the time stamp is encrypted.

8. The method of claim 1, wherein the change in deltas of the time stamps of the client is indicative of the existence of a change in latency.

9. The method of claim 1, wherein the monitoring is performed at a host server in the gaming network.

10. The method of claim 1, wherein the monitoring is performed at a peer client in the gaming network.

11. A system for detecting cheating in a gaming network, the system comprising:

a rules library that includes a generated first set of rules defining acceptable user activity in a gaming network, wherein the generated first set of rules are defined based on observations of a performance of the gaming network;

a network interface that receives data packets from a client in the gaming network, wherein the data packets have tracking data that includes at least one of a sequence number or a time stamp indicating the progression of a game character through a game environment in the gaming network, and wherein the received data packets correspond to user activity for the client in the gaming network;

a monitoring module stored in memory and executable by a processor to monitor the user activity for clients that may violate the generated first set of rules; and

an analysis engine stored in memory and executable by a processor to determine that a client violated the generated first set of rules thereby identifying the client as a deviant client, wherein the determination that the client violated the generated first set of rules includes;

identifying one or more pre-defined thresholds corresponding to indicia for changes in deltas between tracking data of data packets associated with the client and tracking data of data packets associated with different clients;

determining that there are changes in deltas between tracking data of data packets associated with the client and tracking data of data packets associated with different clients,

detecting that the determined delta changes between the different clients in view of the delta changes with the client exceeds one or more of the pre-defined thresholds used to identify cheating, and

identifying that the detected delta changes between the different clients and the gaming network indicate cheating based on the one or more identified pre-defined thresholds, wherein the evaluation and the pre-defined thresholds are based on parameters associated with the performance of the gaming network identified as acceptable user activity.

12. The system of claim 11, wherein execution of the analysis engine by the processor further identifies at least one user suspected of cheating.

13. The system of claim 12, wherein the network interface also sends information over the gaming network indicating that the at least one user is suspected of cheating.

14. The system of claim 11, further comprising penalizing the at least one user associated with the client sending the monitored data packets that include indicia exceeding the predefined threshold.

15. The system of claim 11, wherein the sequence number is encrypted.

16. The system of claim 11, wherein the change in deltas of the sequence number of the client is indicative of packet loss.

17. The system of claim 11, wherein the time stamp is encrypted.

18. The system of claim 11, wherein the change in deltas of the time stamps of the client is indicative of the existence of a change in latency.

19. The system of claim 11, wherein the monitoring module is located at a host server in the gaming network.

20. The system of claim 11, wherein the monitoring module is located at a peer client in the gaming network.

21. A non-transitory computer-readable storage medium having embodied thereon a program, the program being executable by a processor to perform a method for detecting cheating in a gaming network, the method comprising:

generating a first set of rules, wherein the first set of rules define acceptable user activity in a gaming network, and wherein the generated rules are defined based on observations of a performance of the gaming network;

receiving data packets from a client in the gaming network, wherein the data packets have having tracking data that includes at least one of a sequence number or a time stamp indicating the progression of a game character through a game environment in the gaming network, and wherein the received data packets correspond to user activity for the client in the gaming network;

monitoring the user activity for clients that may violate the generated first set of rules, wherein the user activity is monitored in response to execution of a monitoring module by a processor, and wherein the monitoring module is stored in memory; and

determining that a client violated the generated first set of rules thereby identifying the client as a deviant client, wherein the determination that the client violated the generated first set of rules includes;

identifying one or more pre-defined thresholds corresponding to indicia for changes in deltas between tracking data of data packets associated with the client and tracking data of data packets associated with different clients;

determining that there are changes in deltas between tracking data of data packets associated with the client and tracking data of data packets associated with different clients;

detecting that the determined delta changes between the different clients in view of the delta changes with the client exceeds one or more of the pre-defined thresholds used to identify cheating; and

identifying that the detected delta changes between the different clients and the gaming network indicate cheating based on the one or more identified pre-defined thresholds, wherein the evaluation and the pre-defined thresholds are based on parameters associated with the performance of the gaming network identified as acceptable user activity.