Exploiting MMORPG Log Data
toward Efficient RMT Player Detection
Hiroshi Itsuki† , Asuka Takeuchi† , Atsushi Fujita† , Hitoshi Matsubara††Future University Hakodate, 116-2, Kameda-nakano-cho, Hakodate, 041-8655, Japan{g3106001,p4410001,fujita,matsubar}@fun.ac.jp

ABSTRACTTo detect players who are engaged in real-money trading (RMT)
in massively multi-player online role-playing games (MMORPGs),
behavior of players was analyzed using log data of a commercial MMORPG. A closed test evaluated the effectiveness of several
player-wise statistics derived from the log data in detecting RMTplayers.

Categories and Subject Descriptors
J.4 [Social and Behavioral Sciences]: Economics; K.4.2 [Computers and Society]: Social Issues; I.5.2 [Pattern Recognition]:
Design Methodology

General Terms
Experimentation, Management

Keywords
RMT, MMORPG, online game, log data

1. INTRODUCTION
Real-money trading (RMT) is an economic activity in whichpeople exchange property in a virtual world, such as currency, items,
and even characters, for real currency. RMT occurs in various online services including online games, social network services, andauction networks [1, 3].
There are two opposing attitudes of online game operators toward RMT. One regards RMT as a natural act of players and seeks
ways of bringing out the merit of it, such as accelerating personaltrades between users and cutting down costs for setting up a physical store. In contrast, the other sees RMT as the cause of problems
and prohibits it in their games. The attitude is based on the type anddesign of each game. Most of the massively multi-player online
role-playing games (MMORPGs) in Japan prohibit RMT, because
it causes several problems. The most critical influence is on economic balance. Dealing with huge amounts of currency for RMTcauses inflation in the virtual world and harms the ability of general

Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies are
not made or distributed for profit or commercial advantage and that copies
bear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.
ACE ’10, 17-NOV-2010, Taipei, Taiwan
Copyright 2010 ACM 978-1-60558-863-6/10/11 ...$10.00.

players to purchase commodities. RMT players often directly harm
other general players by, for example, occupying specific locations
for obtaining currency and items, killing other general players tosteal their property, and even plundering their characters. RMTplayers also tend to do dishonest actions, such as cheating the gameand using bots. These problems discourage general players, whomay end up quiting the game. They also prevent new players fromjoining the game.
To keep the virtual world sound and fun, MMORPG operators
have been taking strong actions against RMT players. First, theyexplore the players whose actions suggest RMT activity (henceforth, RMT suspects) using decoy characters and/or referring to reports from general players. Then, they investigate whether each
RMT suspect is an RMT player by analyzing his or her past actions
recorded in the log data. Once a player is determined to be an RMTplayer, the account is banned.
Most players act honestly in the virtual world. Thus, to avoid
false accusation, manual investigation of RMT players by MMORPG
operators is indispensable. However, the whole procedure is quite
time-consuming. To support them in dealing with RMT, we havebeen addressing the task of extracting RMT suspects. In this paper, we propose several statistics derived from real log data of an
MMORPG that are useful for differentiating RMT players fromgeneral players.

2.

RELATED WORK

Several studies have utilized the real log data for digital gameresearch. In [4], players were classified on the basis of action sequences, while statistics derived from certain volume of log data
were used for the similar task in [5]. Some studies made an attempt
to detect bots using the frequency of actions [6] and the magnitudeof traffic burstiness [2].
The task of detecting RMT players can be regarded as a subtype of player classification. To our best knowledge, however, thestatistical characteristics of RMT players have not been explored.

3.

DETECTION OF RMT SUSPECTS

The number of RMT players is not given in advance. We therefore extract RMT suspects from all the players as follows.
Step 1: Sort all players using a certain statistics
Step 2: Extract the most suspicious N players.
The goal of this task is to minimize the number of extracted RMTsuspects, i.e., N , retaining all RMT players inside of the extracts.
Practically, the value for N is gradually incremented according tothe human-labor available for succeeding manual investigation.

Table 1: Mean Values of Statistics
TypeSeller
Collector
EarnerOthersn10415971TAC
254.4
745.5
106,137.8
75,008.8

AT
55.8
138.3
16,772.5
3,718.0

TCC
1.3
46.8
11.0
951.0

Table 2: The Number of Extracted RMT Suspects
TCH
12,209.2
23,247.0
13,438.7
3,111.0

Statistics
nTCH
TAC
TCC
AT
TCH/TAC
TCH/TCC
TCH/AT

3.1 Data
In this study, we use the commercial MMORPG “Uncharted Waters Online” as a sample game. Real log data of the game and a listof RMT players were provided by the MMORPG operator. The listof RMT players contains the following three types of players.
Sellers (10 players): sell virtual property to other players for realcurrency.
Earners (15 players): acquire virtual property by effectively repeating specific actions in the virtual world.
Collectors (4 players): convey virtual property from earners to sellers.
These RMT players were identified by the operators througha manual analysis of the log data from August 30 to September
13, 2009. The identical log data was provided. It comprises 330
million action records and 8.8 million utterance records of 16,054
players.

3.2 Statistical Characteristics of Each Player
To characterize each player, we derived the following four typesof statistics from both types of data.
Total action count (TAC): The total number of action records.
Activity time (AT): The amount of minutes in which at least one
action is taken.
Total chat count (TCC): The total number of utterances recorded.
Total currency handled (TCH): The amount of virtual currency
handled in the period, calculated by summing the absolutevalues of currency increase and decrease.
RMT players are assumed to handle huge amounts of currency.
In fact, all of the 29 identified RMT players were ranked in the top
1,000 for TCH. We therefore chose this statistics as the primary element for narrowing down RMT suspects. Table 1 shows the meanvalues of the above statistics for each type of player. From the table,
we made the following findings.

Seller
10639
998
1,000
990
72
226
81

Collector
4452
889
1,000891
133
347
123

Earner
15
80
360
1,000
48
419
349
643

All
29
639
998
1,000990
419
349
643

experiment, we manually determined N so that all of the 29 known
RMT players were thoroughly classified as RMT suspects, leaving its estimation to our future work. Thus, the smaller the N is,the better the statistics is. Table 2 shows the values of N for eachstatistics. The table indicates that different statistics achieved thebest results for each type of RMT player. When targeting sellers
and collectors, TCH/TAC and TCH/AT that reflect the earning efficiency identified a relatively small number of players. In contrast,
AT performed the best for detecting earners.

4.

CONCLUSION AND FUTURE WORK

To reduce the human labor required to investigate RMT players, we explored the statistics that minimize the number of RMTsuspects. This paper described the statistics derived from log data
and reported on several behavior of RMT players. The evaluation showed that using the appropriate statistics or combination ofstatistics for each type of RMT player achieved the best results.
Our future work includes three avenues. Even the best statistics
we proposed output a number of players. Therefore, a more effective statistics should be explored. The robustness of the statistics isalso considered, as RMT players may fool operators by changing
their characters frequently. Once an effective statistics is extracted
from short-term log data, it should be great help in identifying RMTsuspects. We also plan to apply the statistics to other game titles.

5.

ACKNOWLEDGMENTS

We are deeply grateful to TECMO KOEI GAMES Co., Ltd., whoprovided real log data and operating knowledge on MMORPG.

6.

REFERENCES[1] E. Castronova. Synthetic Worlds: The Business and Culture ofOnline Games. The University of Chicago Press, 2005.
[2] K.-T. Chen, J.-W. Jiang, P. Huang, H.-H. Chu, C.-L. Lei, andW.-C. Chen. Identifying MMORPG bots: A traffic analysis
approach. EURASIP Journal on Advances in Signal• RMT players deal with a huge volume of virtual currency (TCH)
Processing, 2009:1–22, 2009.
• Most of the RMT players are silent (TCC)[3] V. Lehdonvirta. Virtual item sales as a revenue model:
Identifying attributes that drive purchase decisions. Electronic• Sellers and collectors take actions less frequently (TAC)
Commerce Research, 9(1-2):97–113, 2009.
• While earners spend five times more than general players,[4]Y.
Matsumoto and R. Thawonmas. MMOG player
the frequency of their actions is low (TAC, AT)classification using hidden Markov models. In Proceedings ofthe 3rd International Conference on Entertainment
3.3 Extracting RMT Suspects
Computing (ICEC), pages 429–434, 2004.
We then evaluated the effectiveness of the proposed statistics in[5] S. Soeda and H. Matsubara. Tools to support management of
extracting RMT suspects. In addition to the four types of statistics,
online games. Journal of the Japanese Society for ArtificialTCH/TAC, TCH/AT, and TCH/TCC were also examined. Note thatIntelligence, 23(1):68–73, 2008. (in Japanese).
this evaluation is a closed test as the data is referred to for identify[6] R. Thawonmas, Y. Kashifuji, and K.-T. Chen. Detection ofing the statistics.
MMORPG bots based on behavior analysis. In Proceedings ofFor each of the seven types of statistics, 1,000 players were firstthe 2008 International Conference on Advances in Computer
sorted in descending order on the basis of the statistics. Then, RMTEntertainment Technology (ACE), pages 91–94, 2008.
suspects were extracted by taking the top N of the players. In this