Jiyoung Woo

Online game bot detection based on party-play log analysis

Abstract As online games become popular and the boundary between virtual and real economies blurs, cheating in games has proliferated in volume and method. In this paper, we propose a framework for user behavior analysis for bot detection in online games. Specifically, we focus on party play which reflects the social activities among gamers: in a Massively Multi-user Online Role Playing Game (MMORPG), party play is a major activity that game bots exploit to keep their characters safe and facilitate the acquisition of cyber assets in a fashion very different from that of normal humans. Through a comprehensive statistical analysis of user behaviors in game activity logs, we establish threshold levels for the activities that allow us to identify game bots. Based on this, we also build a knowledge base of detection rules, which are generic. We apply our rule reasoner to AION, a popular online game serviced by NCsoft, Inc., a leading online game company based in Korea.

Chatting Pattern Based Game BOT Detection: Do They Talk Like Us?

Localization of sensor nodes is a key technology in Wireless Sensor Networks(WSNs). Trilateration is an important position determination strategy. To further improve the localization accuracy, a novel Trilateration based on Point In Triangle testing Localization (TPITL)algorithm is proposed in the paper. Unlike the traditional trilateration localization algorithm which randomly selects three neighbor anchors, the proposed TPITL algorithm selects three special neighbor anchors of the unknown node for trilateration. The three anchors construct the smallest anchor triangle which encloses the unknown node. To choose the optimized anchors, we propose Point In Triangle testing based on Distance(PITD) method, which applies the estimated distances for trilateration to reduce the PIT testing errors. Simulation results show that the PIT testing errors of PITD are much lower than Approximation PIT(APIT) method and the proposed TPITL algorithm significantly improves the localization accuracy.

Andro-profiler: anti-malware system based on behavior profiling of mobile malware

ABSTRACT In this paper, we propose a novel anti-malware system based on behavior profiling, called Andro-profiler. Andro-profiler consists of mobile devices and a remote server, and is implemented in Droidbox. Our aim is to detect and classify malware using an automatic classifier based on behavior profiling. Firs t, we propose the representative behavior profiling for each malware family represented by system calls coupled with Droidbox system logs. This is done by executing the malicious application on an emulator and extracting integrated system log s. By comparing the behavior profiling of malicious application s with representative behavior profiling for each malware family, we can detect and classify them into malware families. Andro-profiler shows over 99% of classification accuracy in cla ssifying malware families.Keywords: Behavior profiling, Malicious behavior, Similarity, System ca ll, Integrated system log, Android platform, Malware접수일(2013년 10월 28일), 수정일(2013년 12월 26일), 게재확정일(2013년 12월 26일)* 본 연구는 미래창조과학부 및 정보통신산업진흥원의 IT융합 고급인력과정 지원사업의 연구결과로 수행되었음 (NIPA-2013-H0301-13-3007)†주저자, yjs8888@korea.ac.kr‡교신저자, cenda@korea.ac.kr(Corresponding author)

An SIR model for violent topic diffusion in social media

Social media is being increasingly used as a political communication channel. The web makes it easy to spread extreme opinions or ideologies that were once restricted to small groups. Terrorists and extremists use the web to deliver their extreme ideology to people and encourage them to get involved in fanatic behaviors. In this research, we aim to understand the mechanisms and properties of the exposure process to extreme opinions through these new publication methods, especially web forums. We propose the topic diffusion model for web forums, based on the SIR (Susceptible, Infective, and Recovered) model frequently used in previous research to analyze disease outbreaks and knowledge diffusion. The logistic growth of possible authors, the interaction between possible authors and current authors, and the influence decay of past authors are incorporated in a novel topic-based SIR model. From the proposed model we can estimate the maximum number of authors on a topic, the degree of infectiousness of a topic, and the rate describing how fast past authors lose influence over others. We apply the proposed model to a major international Jihadi forum where extreme ideology is expounded and evaluate the model on the diffusion of major violent topics. The fitting results show that it is plausible to describe the mechanism of violent topic diffusion in web forums with the SIR epidemic model.

Epidemic model for information diffusion in web forums: experiments in marketing exchange and political dialog.

As social media has become more prevalent, its influence on business, politics, and society has become significant. Due to easy access and interaction between large numbers of users, information diffuses in an epidemic style on the web. Understanding the mechanisms of information diffusion through these new publication methods is important for political and marketing purposes. Among social media, web forums, where people in online communities disseminate and receive information, provide a good environment for examining information diffusion. In this paper, we model topic diffusion in web forums using the epidemiology model, the susceptible-infected-recovered (SIR) model, frequently used in previous research to analyze both disease outbreaks and knowledge diffusion. The model was evaluated on a large longitudinal dataset from the web forum of a major retail company and from a general political discussion forum. The fitting results showed that the SIR model is a plausible model to describe the diffusion process of a topic. This research shows that epidemic models can expand their application areas to topic discussion on the web, particularly social media such as web forums.

Andro-Dumpsys

Our system (Andro-Dumpsys) leverages volatile memory acquisition.Andro-Dumpsys leverages malware creator information and malware information.Andro-Dumpsys is anti-malware system based on similarity matching of footprints.Andro-Dumpsys is capable of detecting zero-day threats. With the fast growth in mobile technologies and the accompanied rise of the integration of such technologies into our everyday life, mobile security is viewed as one of the most prominent areas and is being addressed accordingly. For that, and especially to address the threat associated with malware, various malware-centric analysis methods are developed in the literature to identify, classify, and defend against mobile threats and malicious actors. However, along with this development, anti-malware analysis techniques, such as packing, dynamic loading, and dex encryption, have seen wide adoption, making existing malware-centric analysis methods less effective. In this paper, we propose a feature-rich hybrid anti-malware system, called Andro-Dumpsys, which leverages volatile memory acquisition for accurate malware detection and classification. Andro-Dumpsys is based on similarity matching of malware creator-centric and malware-centric information. Using Andro-Dumpsys, we detect and classify malware samples into similar behavior groups by exploiting their footprints, which are equivalent to unique behavior characteristics. Our experimental results demonstrate that Andro-Dumpsys is scalable, and performs well in detecting malware and classifying malware families with low false positives and false negatives, and is capable of responding zero-day threats.

The contagion of malicious behaviors in online games

This article investigates whether individual users are more likely to display malicious behavior after receiving social reinforcement from friends in their online social networks. We analyze the dynamics of game bot diffusion on the basis of real data supplied by a major massively multiplayer online role-playing game company. We find that the social reinforcement, measured by the ratio of bot friends over total friends, affects the likelihood of game bot adoption and the commitment in terms of usage time.

Survey and research direction on online game security

Online game security is a newly emerging research area that is attracting considerable attention with the growth of the online game industry. There is an increasing need for online game service providers to detect and prevent the various threats associated with game bots and gold farmers. These illegal activities have become quite severe, and many online game service providers have fallen prey to them. These threats exist in popular multiplayer games where cyber assets can be monetized. In this study, we survey academic research efforts and industry practices related to these threats. In addition, we examine the actual illegal activities and look at countermeasures being adopted in the field.

Crime Scene Reconstruction: Online Gold Farming Network Analysis

Many online games have their own ecosystems, where players can purchase in-game assets using game money. Players can obtain game money through active participation or “real money trading” through official channels: converting real money into game money. The unofficial market for real money trading gave rise to gold farming groups (GFGs), a phenomenon with serious impact in the cyber and real worlds. GFGs in massively multiplayer online role-playing games (MMORPGs) are some of the most interesting underground cyber economies because of the massive nature of the game. To detect GFGs, there have been various studies using behavioral traits. However, they can only detect gold farmers, not entire GFGs with internal hierarchies. Even worse, GFGs continuously develop techniques to hide, such as forming front organizations, concealing cyber-money, and changing trade patterns when online game service providers ban GFGs. In this paper, we analyze the characteristics of the ecosystem of a large-scale MMORPG, and devise a method for detecting GFGs. We build a graph that characterizes virtual economy transactions, and trace abnormal trades and activities. We derive features from the trading graph and physical networks used by GFGs to identify them in their entirety. Using their structure, we provide recommendations to defend effectively against GFGs while not affecting the existing virtual ecosystem.

Modeling of bot usage diffusion across social networks in MMORPGs

User interactions in massively multiplayer online role-playing games (MMORPGs) generate social networks and diffuse user behavior throughout the network. We test the diffusion model in the adoption of a game bot among players connected via goal-oriented communities using real data provided by a major MMORPG company. In the model based on a probabilistic diffusion process, we used expectation maximization to infer the diffusion probability of game bot usage. The experimental results showed that the diffusion model can explain the spread of malicious behavior.