< AIIDE 2011, Oct. 14th, 2011 >Detecting Real Money Traders in MMORPGby Using Trading NetworkAtsushi FUJITA Hiroshi ITSUKI Hitoshi MATSUBARA
Future University Hakodate, JAPANfujita@fun.ac.jp

 Focusing on Massively Multiplayer Online RPG

Thousands of players co-exist in one virtual “world”


cf. millions of registered players

2 To facilitate further growth

Effect of featuresExtended game fields, one-shot events

Influential players
Mentoring, intermediation, trades To maintain the order of the virtual world
 Harassments between players
Player killing, occupation of specific locations

Causes that lead unfairness and crisis of virtual economy
Real Money Trading, use of bots, cheat3 Real money

Virtual properties

Currency, items, status, functions, avatars, etc.
 Observed in other online services, e.g., SNS, auction Two opposing attitudes (sometimes ambivalent) Positive: Means of augmenting the real world

e.g., Second Life

Negative: Source of serious problems


e.g., Most MMORPGs in Japan4

 Automatic detection of RMTers

Actual log data is available
Now with TECMO KOEI GAMES CO., LTD.
 Prefer title independent features

Operators want no arms raceDesire un-cheatable features

Operators’ verification is indispensable
To avoid ruling out honest players
 The amount of human resource depends on situation


Title (scale, seriousness) and budget for operation
 Prefer unsupervised or semi-supervised methods5Outline
1.
2.
3.
4.
5.

Introduction
Approach
Procedure
Experiment
Conclusion Classify each character into RMTer or non-RMTerSupervised machine learning [Ahmad+, 09]Naïve Bayes, k-NN, AdaBoost, etc.
 Various features (incl. those specific to the title)

Not flexible: Too much/less positive class
PositiveNegative7 Sort characters according to their suspiciousnessUsing cumulative features [Itsuki+, 10]
dealing with enormous virtual currency

Handled currency
 Volume of actions
 Activity hours


working hard to earn virtual currency

Not thoroughly studied
Ranking

1st

2nd

3rd

4th

5th

6th

7th

8

Ranking

1st

2nd

3rd

4th

5th

6th

7th

 Connection between pairs of charactersExtremely low exchange rate, e.g., full of wallet =Division of RMT labor & frequent trade

Infrastructure for trading  log data are available Volume of individual trade9 RMTers and their trading partners in one timeframeDivision of labor of RMTersTypical rolesSeller
 Earner Collector

Tight connection

10

Possibility ofwholesale arrest

11Outline
1.
2.
3.
4.
5.

Introduction
Approach
Procedure
Experiment
Conclusion

Raw log data

Step 1.
Extracting communities
from trading network

Step 2.
Ranking characters

1st2nd

3rd

4th

5th

6th

7th

8th13 Graph partitioning / graph clustering

Node: Character Edge: Trade between two characters
14

15

 Modularity [Newman+, 04]

Many edges in eachcommunity  Large QExpected value of link ratio:
to avoid a trivial solution

E: Set of all edges in the network
Ei: Set of edges within ith community
Ai: Set of edges connecting to a node in ith community16 Finding a partitioning that maximizes Q: NP-hard A bottom-up greedy algorithm [Clauset+, 04] 1. Regard each node as a communityand calculate ΔQ for each connected community pair 2. Merge two communities whose ΔQ is largest (and >0) 3. Update ΔQ for the merged communities
 4. Repeat steps 2 & 3 while Q gains

17 Frequent and/or large-scale trades  RMT

1. Ranking communities


1stIn-community trades

1st

2. Ranking charactersin each communityTrades ofindividual character

2nd
1st

2nd

4th
2nd

3rd

3rd

4th

1st

2nd

3rd

4th

5th

6th

7th

8th
18

Outline
1.
2.
3.
4.
5.

Introduction
Approach
Procedure
Experiment
Conclusion “Uncharted Waters Online”

Exploration, naval battle andtrading in mid-ages
 RMT is prevalent(C) 2005-2011 TECMO KOEI GAMES CO., LTD.
All rights reserved.

 4 timeframes (15〜23 days, no overlap)
 RMTers are identified (& banned) manually

29〜130 (<1%) within 15,249〜18,745 characters

Actual action log data in the same period

300〜480 million records
20

20000# of characters

16000

Non traders
Traders w/o currency
Currency traders
45%

12000

47%

8000
23%
4000

45%

43%

24%

21%

24%
(1)

30%
(29)

33%
(52)

34%
(106)

30%
(129)

Period A

Period B

Period CPeriod D0

Obs.
Half of all characters traded something
 1/3 of all characters traded virtual currency
 Most of RMTers traded virtual currencyOnly 1 exception in period D21

# of extracted communities

1200

8152 4624

9440 5423

10265 6317

9358 5174

400

4 1 5 2 3

3 3 4 2 4

6 3 4 3 5

5 6 7 6 8200

tb tt cb ct cv

tb tt cb ct cv

tb tt cb ct cv

tb tt cb ct cv(*) (*) (*)

Period A

Period B

Period C

Period D

1000
8006000

Target characters and weight of tradetb: binary
All traders Currency traders cb: binary
tt: # of times
ct: # of times

cv: volumeObs.
Weights of trades / focusing on currency  fine-grained RMTers  only a few communities (1-8)
22 Available human resource is unknown
It varies depending on the situation

 Two measures

Balance between Recall and Precision
Recall (R): how exhaustively RMTers are identified
 Precision (P): how correctly system identifies RMTers
Avg. Precision at various recall1 RMTer is found
2 RMTers are found
3 RMTers are found...
All RMTers are found23

 Representation of trading network

All traders
tb: binary Currency traders cb: binary
tt: # of times
ct: # of times

cv: volume

 Measure for in-community trades tt: # of trade transactions
 ct: # of currency transactions
 cv: Total volume of traded currency
 Measure for trades of individual character tt: # of trade transactions
 ct: # of currency transactions
 cv: Total volume of traded currency24

 45 combinations  10Representation of trading network (5)Measure for in-community trades (3  1)

Different network achieved the best result in different period
Volume of traded currency (cv) > # of transactions (tt, ct)

Measure for trades of individual character (3  2)Traded currency (ct, cv) > All trade (tt)

 Implications


Large amount of currency is exchanged for RMT

RMTers dealt with more than 1/3 of total currency trades

Virtual currency is popular in RMTBuyers want virtual currency25 Sort characters based on handled currency (cv)
 Two supervised methods (w/o constants) Naïve Bayeswith multinomial distribution [McCallum+, 98]

Support Vector Machines [Vapnik, 99]with linear kernel (SVMlight is used){+1: RMTer, -1: non-RMTer}Feature: all of 338 types of actions


trade, attack to other player, find an item, invest for a ship 26

 Several versions beat all the baselines
But nothing significantly wins in all periods

27

10.8

0.8
Precision

Precision

10.6

Period A0.4

WinLoseBest Proposed (.764)
Best BL (.356)

0.2
000.20.40.6

WinLoseBest Proposed (.900)
Best BL (.567)

00.8010.20.40.60.8

10.8128

Recall

10.8Precision

0.8Precision

Period B

0.40.2

Recall10.6

0.6

Period C

0.4

WinLoseBest Proposed (.524)
Best BL (.484)

0.2
000.20.4
Recall0.60.6

Period D

0.4

WinLoseBest Proposed (.648)
Best BL (.599)

0.2
00.8

100.20.4
Recall

0.6

10.80.8
Precision

Precision

10.6

Period A0.4WinLose
Best Proposed (.764)
Best BL (.356)

0.2
000.2

0.4

0.6

0.6

Period B

0.4WinLose
Best Proposed (.900)
Best BL (.567)

0.2
00.8

10Recall

0.2

0.4

0.6

0.8

1Recall Significant improvement

Both on R-P curves and Avg. Prec.
 Most RMTers  a single, small, and top-rank communityPeriod A: 29 RMTers  28 + 1
 Period B: 52 RMTers  50 + 1 + 1
Some are still difficult to detect29

 Weak for plural RMTer communities

Period C: 106 RMTers  53 + 33 + 19 + 1
 Period D: 130 RMTers  80 + 32 + 14 + 2 + 1 + 1 Need a more intelligent ranking
 e.g., Combination of ranks (community, character) e.g., Re-ranking based on operators’ judge
11st(107)

(175)

0.6

Period C

0.4

WinLoseBest Proposed (.524)
Best BL (.484)

0.2
000.2

0.4
Recall0.6

1st(180)0.8
Precision

Precision

2nd 3rd(207)0.81Period D

0.4

WinLoseBest Proposed (.648)
Best BL (.599)

01(67) (85)

0.6

0.2

0.8

2nd 3rd00.20.4
Recall0.60.8130

 Detection of RMTers in MMORPGAs a ranking problem
 Wholesale arrest thru capturing communities

Low exchange rate  division of labor & frequent trade

Evaluation using actual log data
Better performance than separately assessing each char.
 w/ a room of further improvement
Ranking

1st

2nd

3rd

4th

5th

6th

7th31

 Technical aspectFurther investigation into trading network
Mixture models [Newman+, 07]
 Augmentation with other components [Ahmad+, 11]Apply state-of-the-art machine learning techniques

 Evaluation
Is arms race really overcome?


e.g., Robustness against disposal use of characters

Application to other MMORPGs

32