An analysis of players and bots behaviors in
MMORPG
Yutaro Mishima

Kensuke Fukuda

Hiroshi Esaki

The University of Tokyo
Tokyo, Japan
Email: kohaku@hongo.wide.ad.jp

National Institute of Informatics
Tokyo, Japan
Email: kensuke@nii.ac.jp

The University of Tokyo
Tokyo, Japan
Email: hiroshi@wide.ad.jp

Abstract—“Bot”, automatic robot software, has been one ofmost serious problems in Massively Multiplayer Online Role
Playing Game (MMORPG). Bots earn much more money in a
virtual world than human players, and finally collapse balance
and fairness of the MMORPG. At present, many techniques
have been applied to detect and exterminate bots. However, they
have a common problem that the technique effective in a certain
MMORPG is not equally effective in other MMORPGs, thus nogeneral method to detect bots has been established. Toward establishing such general technique, we analyze behavioral patternsof human players and bots in server-side game log data with two
commonly available features characterizing users (human players
and bots): location-based information (i.e., speed of players)
and action frequency information (i.e., action count per fixed
time slot). The main findings of our analysis are as follows:(1) The variation of the speed of bots is smaller than that ofhumans (i.e, the movement of bots is more efficient). However,the discriminative power of this location-based feature is not sosignificant in MMORPG, while it showed good performance inFirst Person Shooting (FPS) game. (2) Action count and battle
count indicate more discriminative power than the speed feature.
In particular, the action count is more robust than battle countagainst the size of the time slot.
Index Terms—MMORPG, Bot detection, Data mining

I. I NTRODUCTION
A large number of Massively Multiplayer Online Role
Playing Games (MMORPGs) have been more popular all over
the world. “World of Warcraft”, for example, is one of themost popular MMORPGs with over 12 million active users[1]. However, several serious problems have been pointed
out in MMORPG, such as bots, Real Money Trading (RMT)[2], and cheating. Bots are specialized software that playgame automatically, continuously, and simultaneously without
human. They can earn much more money or valuable items, bybattling against monsters repeatedly, than humans. This leads
a collapse of fairness in the game and finally the game getstotally unexciting for most human players. For this reason,
how to cope with bots is a serious challenge in MMORPG.
Many companies operating MMORPGs cope with bots bypatrolling their game field with some scripts for detecting
bots. Moreover, many methods are proposed to detect bots
automatically with log data or game traffic data [3]–[10].
Nevertheless, there is no general method to exterminate bots
because patrolling is too costly tasks and the methods effective
to one MMORPG cannot be directly applicable to other

MMORPGs because of the diversity of game system, program,and communications protocol among MMORPGs.
In this paper, toward establishing more general bot detection, we first carefully focus on behavioral patterns of humanplayers and bots with two common features characterizing
humans and bots: location-based information and action frequency information. The former is based on the assumptionthat bots move efficiently than human players in the game fieldin microscopic level, and the assumption of the latter is thatthe number of battles by bots per a time interval is optimal andits variation is small in macroscopic level. We apply the two
features to game logs collected at one MMORPG in Japan inorder to investigate the discriminative power of these features
for bot detection. Our results show that some of the commonlyused behavioral patterns appeared in humans and bots aregood metrics to distinguish them. The main findings of ouranalysis are as follows: (1) The variation of the speed of bots issmaller than that of humans (i.e, the movement of bots is more
efficient) in terms of the location-based information. However,the discriminative power of this location-based feature is not sosignificant in MMORPG, while it showed good performancein First Person Shooting (FPS) game. (2) Action count andbattle count indicate more discriminative power than the speed
feature. The mean of the frequency for bots is larger than thatfor most human players, and in particular, the variation of thefrequency for bots is small. Furthermore, the action count ismore robust than battle count against the size of the time slot.
The rest of the paper is organized as follows. In Section 2,
we present some research related to the paper and determine
what feature values we use. In Section 3, we describe someconditions in analyzing log data. In Section 4, results andfindings of our analyze are presented. In Section 5, we discuss
the results and findings. And finally, Section 6 concludes thepaper and states our future works.
II. R ELATED WORKSIn this section we present some related work in the characterization of behavior of humans and bots. The recent literatureis broadly catergorized into four approaches: action-based,location-based, input-based, and traffic-based one.
Suznjevic et al. [3] focused on actions taken by humanplayers in a MMORPG. They categorized players’ actions in a
MMORPG into several types and analyzed frequency of eachaction type for each human player. They pointed out that theroutine of human players is similar and they prefer to playwith other human players rather than play alone. Thawonmas
et al. [4] also categorized the actions in another MMORPG
and analyzed how many action types each human player andeach bot takes. They pointed out that bots tend to take someactions more intensively than human players.
Chen et al. [5] focused on location information of users.
They analyzed moving distance of users per unit time in a
First Person Shooting(FPS) game field and pointed out thatthe distribution of the moving distance of bots is different
from that of human players in the game field, meaning thatthe movement of bots is more regular than that of human.
Gianvecchio et al. [6] focused on input pattern of a mouseor a keyboard by users and analyzed various feature values
related to the input. Although humans and bots are distinguishable with the input-related feature values successfully,
the method requires detailed movement data of users thus thesize of log data could be huge.
Chen et al. [7] analyzed some feature values in traffic data
clients transmit to a game server, e.g. packet rate and RTT.
Similar to the input-based method, this method is not directly
applicable to other MMORPGs because the method needs ahuge volumes of raw level packet data.
Clearly, the bot detection methods have a trade-off between
the richness of behavioral features and the difficulty of collecting and maintaining log data. In this sense, the first two
approaches focus on more commonly available features thanthe latter two approaches. However, the first two approaches
have been independently investigated and have been applied
to one or two MMORPGs. In the following sections, we focus
on the usefulness and generality of location-based and actionbased approaches.

Fig. 1.

CDF of players’ playing time in a server

B. Dataset
We analyze a 24-hours log data recorded on Jan. 2012at one of the game servers. This log data includes bothhuman players and bot data. Administrators of the MMORPG
manually detected and actually banned 13 players as bots inthe log data. The average playing time of these bots was 23.4
hours, thus, they worked without rest in the day. Fig.1 shows
the cumulative distribution function (CDF) of player’s playing
time in the game server. X-axis represents playing time inthe day and y-axis represents its cumulative distribution. This
figure illustrates that a small number of players play for along time, while the median playing time after removing nonactive users was about 2 hours. Considering the playing timeof bots, we sampled top 270 players in playing time as humanplayers. Therefore, we analyze 270 human player’s log data
and 13 bot’s log data.
C. Feature selection and Methods

III. DATASET AND F EATURES
In our analysis, we used a set of game log data recorded ata game server of a popular 3D action MMORPG consistingof over 100000 active players in Japan 1 .
A. Log format
The server log file is composed of tuples (<timestamp>,<action-type>,<player’s
information>,<location
information>) triggered by a player’s action.
• Action-type: The actions, e.g. login, logout, battle withothers, trading items, changing location, are classified
into 310 categories.
• Time stamp: the current time in the real world is recorded
in millisecond-order for each action.
• Player’s information: Nickname, player ID, account ID,
level, class, race (species).
• Location information: Location on the 3D coordinates in
the game field, ID of map and server ID in which theplayer plays.
1 We cannot disclose the title of the MMORPG due to the contract with thecompany operating this MMORPG.

Here, we explain the feature extraction from the log data
and the analysis method in order to distinguish behavior ofbots from that of all human players.
1) Location-based information: We first focus on alocation-related feature value on the 3D coordinates in thegame field. Moving distance per unit time is known to be good
features for bot detection in FPS game [5]. The assumption
based on this feature is that the movement of bots is optimal
but that of humans has more variation due to randomnessof physical actions of humans. We normalize this feature as“speed”, as follows:
distance,(1)
time
where the distance is the one between two consecutive actionsof a player and the time is the difference of the two timestamps in the log. The bot is programmed optimally, so we
expect that the variation of the speed feature in bot is smaller
than that in human.
For analysis, we first draw histograms of the speed featurefor each human and bot, then observe the difference between
them. After we compare the mean and the variance of the
Speed =

speed for humans and those for bots, we calculate the coefficient of variation (CV) of the speed for each human andbot. CV is a normalization of the variance, and is used forcomparing variation of samples with different means. The
definition of CV is given as:
standard deviation
CV =
.
(2)
mean
A smaller CV corresponds to a smaller variation of a given
dataset, vice versa. As the final step, we evaluate the discriminative power of the speed feature with several performance indices. We draw a commonly used Receiver Operating
Characteristic (ROC) curve for varying a threshold value ofCV, which is a plot of False Positive Rate (FPR) and True
Positive Rate (TPR). ROC curve is an indicator for measuringperformance of classification algorithm. In this analyze, we
define bot as positive and human as negative because ourgoal is to detect bots. One performance index with ROC
curve is the minimum Euclid distance from the coordinate
corresponding to the best performance in ROC curve: FPR = 0
and TPR = 1. A smaller distance indicates better performanceof classification. Finally, we calculate some other indices,
Accuracy, Precision, Recall and F-measure, for evaluation of
the discriminative power of this feature value:
TP + TN,(3)
TP + FP + FN + TNTP
P recision =,(4)
TP + FPTP
Recall =,(5)
TP + FN
2 ∗ Recall ∗ P recision,(6)
F − measure =Recall + P recision
where TP, TN, FP and FN are True Positive count, True
Negative count, False Positive count and False Negative count,respectively. These indices vary in the range [0,1], and a higher
value indicates better performance.

mean and variance of bots and those of humans, we investigate
CV of speed for each human and bot. As the final step, we
evaluate the discriminative power of action count and battle
count by the performance indices.
IV. R ESULTS
A. Location-based information
We first discuss the discriminative power of a location-based
feature (i.e., “speed”) for bot detection. Fig.2 demonstrates anexample of the estimated probability density function (PDF)of speed of two players: human (red) and bot (blue). The
x-axis represents the speed between two consecutive actions
and the y-axis represents its estimated density by a kernel
density estimation (KDE) with a standard Gaussian kernel. We
visually confirm that the shape of the two plots is stretched
and resembles each other, suggesting that the discrimination
power of this feature is expected to be low.

Accuracy =2) Action frequency information: Another feature we focus
on is the number of actions per fixed time slot. The backgroundof this feature is based on two related works [3], [4] focusing
on player’s action and the assumption that bots play inthe game world optimally (i.e., they battle against monsters
without rest) while human players cannot work optimally for along time. Thus, the variation of the number of battle actions inbots is expected to smaller than that in humans. Furthermore,
the variation of the number of all actions in bots is expected tosmaller than that in humans, considering the fact that most ofactions by bots are battle. Therefore, we calculate the numberof all actions per time slot as “action count”, and the number ofbattle actions per time slot as “battle count” for every humanand bot.
We draw histograms of action count and battle count foreach human and bot, then check whether there is difference
between them. Next, we calculate the mean and the varianceof action count and battle count for each human and bot, as
we do in Section IV-A. After analyzing the difference between

Fig. 2. An example of estimated PDFs of speed feature for two players (ahuman player and a bot)

Next, Fig.3 displays a scatter plot of the mean (x-axis) andthe variance (y-axis) of speed for each player; Red and blue
dots represent humans and bots, respectively. The mean of
the human players are widely spread while that of the bots is
relatively small. Moreover, the bots are distributed in the lower
variance area while many human players are also overlappedin the same area. Thus, this result suggests that the movementof the bots has less variation.
To confirm this findings, we calculated the CV of the speed
feature for each human and bot. A smaller CV indicates asmaller variation of a given dataset, as explained above. Fig.4
shows PDFs of CV of the speed feature for all humans (red)and all bots (blue). We could distinguish two curves; a sharp
peak for bots and a broader peak for humans. However, twoplots are highly overlapped, expecting a poor discriminative
power of bots.
Finally, we investigate the discriminative power of the CV ofthe speed feature with some indices: The best f-measure value
was 0.222 for different thresholds of the CV, and other indicesfor the best f-measure are listed in Table II. Also, a ROC curve

Fig. 3.

Scatter plot of speed feature: mean and variance

Fig. 4.

Estimated PDF of CV of speed featureof the CV of the speed feature is presented in Fig.5. The xaxis and the y-axis represent FPR and TPR, respectively. The
minimum Euclid distance from the best coordinate (0, 1) was
0.327, and FPR and TPR for this point are 0.289 and 0.846,
respectively.
The results demonstrated that the speed feature indicates low
discriminative power to distinguish bots from human players inthis MMORPG. A plausible reason of this low discriminative
power is that this speed feature is originally developed for a
FPS game, not for MMORPG. We conclude that humans andbots in MMORPG are less different in terms of speed thanthose in FPS game.
B. Action frequency information
TABLE IB REAKDOWN OF ACTION TYPES FOR HUMAN PLAYERS AND BOTS

Action type
Humans
Bots

Battle
52.5%
69.0%

Item
25.7%
17.2%

Interact
1.27%
0.14%

Other
20.5%
13.7%

Fig. 5.

ROC curve of CV of speed feature

We first examine the breakdown of the action types forhuman players and bots. Table I lists the frequency of eachaction type, battle, using item, interact with other players (e.g.
trading, composing a group) and other actions, for human players and bots. As expected, the ratio of battle for bots is 30%
higher than that for humans, meaning that bots concentrates onbattle to earn more money while human players take 50% of
non-battle actions. Our preliminary analysis, however, showedthat the ratio of battle and that of item were not significant
features for bot detection due to large overlaps.
Next, we investigate the discriminative power of the frequency of actions and battles. We first calculate the distributionof action count and battle count per a fixed time slot (e.g.
300[sec]), for every human player and bot. Fig.6 demonstrates
an example of the estimated PDF of action count and battle
count per 300[sec]. The x-axis represents action (or battle)
count and y-axis represents its estimated density. Red and blue
plots represent PDFs of human and that of bot, respectively,
and solid and dashed lines show the difference between theaction count and battle count. We find that mean of action
count and battle count of bots are greater than those of humans.
This means that the bots worked efficiently as expected though
they still have some non-active time near 0. In contrast, theshape of action count and battle count of bots is narrower
than that of humans. This fact indicates that bots always takeactions more frequently and optimally than humans because
humans get tired, chat with others and get away from keyboard
for some tasks.
We also find the difference of the mean and the varianceof action count and battle count between bots and humans in
Fig.7 and Fig.8. In the both scatter plots, the x-axis represents
the mean of the counts and the y-axis represents the varianceof the counts for humans (red) and bots (blue). Almost all ofbots are distributed at the lower right area where the varianceis small and stable even for large means. On the other hand, thedistribution of the human players indicate a positive correlation
between the mean and the variance. Some human players are
distributed on the right side, indicating that they take as many

Fig. 6. An example of estimated PDFs of action and battle counts (time slot:
300[sec])

Fig. 8.

Scatter plot of battle count: mean and variance (time slot: 300[sec])

actions or battle actions as bots take; They are likely expert
human players. However, in most of them, the variance ofaction count and battle count are larger than those of bots.
Therefore, we expect to distinguish bots from humans withthe mean and the variance of these two feature values.

Fig. 9. Estimated PDF of CV of action and battle counts (time slot: 300[sec])

Fig. 7. Scatter plot of action count: mean and variance (time slot: 300[sec])

Next, Fig.9 shows the estimated PDFs of the CV of action
count and battle count for humans (red) and bots (blue) per
300[sec]. The x-axis represents the value of the CV and yaxis represents its estimated density. Solid and dashed lines
represent PDFs of action count and that of battle count. We
confirm that bots and humans are differently distributed, thus
bots are distinguishable from humans with these two feature
values, action count or battle count. Moreover, we can observethat the PDFs of action and battle counts of bots resemble eachother because the major action of bots is battle. In contrast, the
PDF of action count of humans is more shifted to larger CV
than that of battle count showing that the action events except
for battle in humans indicate more variation (i.e, randomness).
In order to examine the dependency of the size of the timeslot on the discriminative power of the features, we analyze
CVs of action and battle counts for varying the size of the timeslots from 50[sec] to 3600[sec]. Fig.10 shows the maximum
value of the f-measure for different size of time slot. The x-axis
represents the size of the time slot (in log scale) and the y-axis
represents the maximum value of f-measure for the time slot.
Brown and purple lines represent f-measure values of action
count and battle count, respectively. The figure demonstrates
that the f-measure value of action count is higher than thatof battle count in most time slots. Thus, we can detect bots
more accurately by analyzing action count than battle count.
In action count, the maximum value of the f-measure is 0.867
for time slots from 50[sec] to 210[sec], and 230[sec], while
the maximum value of the f-measure is 0.846 at 350[sec] inbattle count. This result indicates the robustness of the action
count against the size of the time slot. Considering the cost of
calculation of CVs, we choose longer time slot (i.e., 230[sec])
for the next analysis.
Finally, we plot a ROC curve for the best time slot
(230[sec]) in Fig.11. The plot sharply increases near FPR

V. D ISCUSSION

Fig. 10.

Variation of f-measure value for different size of time slot

≈ 0.0, thus the feature achieves a higher TPR with a lower
FPR. The minimum Euclid distance from the coordinate (0,1) is 0.0148 which is much smaller than that of speed feature(0.327).

We analyzed two types of features to distinguish bots fromhuman players. As shown in Table II, the best performance of
the action count and battle count is superior to that of the
speed feature. The location based feature assumes that the
microscopic movement of the bots is optimal while that of
the human players has some randomness depending on their
physical restriction or the input user interface. On the other
hand, the action frequency based features (i.e. action countand battle count) assume that bots are optimal for obtaining
money while the concentration of human players to the gamedoes not last so long (e.g., they get tired or they are bored to dobattle). In this sense, the action frequency based features are
based on more macroscopic and generic behavior of humans
and bots, thus we believe that they are also useful in detecting
bots in other games.
The size of the time slot and the detectability are a clear
tradeoff for real deployment; a shorter time slot requires more
processing time but obtains better performance, vice versa. The
best performance of the two proposed features is the almost
same, however the robustness against the size of the time slot
in action count is better than that in battle action as shownin Fig.10. Considering the stability of the size of the timeslot, the time slot should be set to less than 250 sec in action
count. On the other hand, a smaller time slot works betterfor faster detection because the method needs a statisticallyenough number of samples to calculate the mean and variance.
Finding the optimal number of samples will be one of our
future work.
VI. C ONCLUSION

Fig. 11.

ROC curve of CV of action count (time slot: 230[sec])

We summarize the results of our performance evaluation
for the best f-measure value (230[sec]) in Table II. From thisresult, we conclude that the action frequency information (i.e.,
action count and battle count) has better discriminative power
to distinguish bots from human players in MMORPG than thelocation-based information (i.e., speed feature).
TABLE II
S UMMARY OF PERFORMANCE INDICES

IndicesAccuracy
Precision
RecallF-measure

Speed
0.777
0.132
0.692
0.222

Action count
0.986
0.765
1.000
0.867

Battle count
0.986
0.846
0.846
0.846

In this paper, we introduced location-based information (i.e.,
speed feature) and action frequency information (action countand battle count) of human players and bots to characterize
their behaviors in MMORPG. The former is based on theassumption that the microscopic movement of bots has lessvariation than that of human players, and the assumption of
the latter is that the macroscopic action frequency of bots ismore stable than that of human players.
We evaluated the discriminative power of these featureswith a 24-hours log data collected at a major MMORPG in
Japan. Regarding the location-based information, we foundthat human players and bots are not effectively distinguishable
by the speed feature in MMORPG. Thus, there are lessdifference between humans and bots in terms of speed in
MMORPGs than those in FPS games. On the other hand, we
pointed out that human players and bots are distinguishable inboth of action count and battle count, and they are superior to
the speed feature.
One of the future work is to apply the proposed features toother MMORPGs in order to verify the discriminative powerof the features for bot detection. Another direction of the work
will be to develop an online bot detection algorithm based on
the proposed features, while we used the offline log taken at
the server in the current analysis.

ACKNOWLEDGMENT
The authors would like to thank Mangi Leem, Masahito
Kikuchi, and Hiroyuki Yanagida for providing us the log dataof the MMORPG and helpful discussion. We also thank Koichi
Ise for coordinating this collaboration work.
R EFERENCES[1] GAMASUTRA.COM, “World Of Warcraft Reaches 12 Million
Subscribers Worldwide”, http://www.gamasutra.com/view/news/
30845/World Of Warcraft Reaches 12 Million Subscribers
Worldwide.php#.UFPdIciZaJ4.
[2] Hiroshi Itsuki, Asuka Takeuchi, Atsushi Fujita, Hitoshi Matsubara:“Exploiting MMORPG log data toward efficient RMT player
detection”, ACE ’10, pp.118-119(2010)[3] Mirko Suznjevic, Ognjen Dobrijevic, Maja Matijasevic, “Hack,slash, and chat: a study of players’ behavior and communicationin MMORPGs?”, NetGames ’09, p.6, (2009).
[4] Ruck Thawonmas, Yoshitaka Kashifuji, Kuan-Ta Chen, “Detection of MMORPG Bots Based on Behavior Analysis?”, ACE’08, pp.91-94, (2008).
[5] Kuan-Ta Chen, Hsing-Kuo Kenneth Pao, Hong-Chung Chang,“Game Bot Identification Based on Manifold Learning”,
NetGames ’08, pp.21-26, (2008).
[6] Steven Gianvecchio, Zhenyu Wu, Mengjun Xie, and Haining
Wang, “Battle of Botcraft: Fighting Bots in Online Games with
Human Observational Proofs?”, CCS ’09, pp.256-268 (2009).
[7] Kuan-Ta Chen, Jhih-Wei Jiang, Polly Huang, Hao-Hua Chu,
Chin-Laung Lei, Wen-Chin Chen, “Identifying MMORPG bots:a traffic analysis approach”, ACE ’06, p.9, (2006).
[8] Stefan Mitterhofer, Christopher Kruegel, Engin Kirda, ChristianPlatzer, “Server-Side Bot Detection in Massively Multiplayer
Online Game”, IEEE Security and Privacy, pp.29-36, (2009).
[9] Ibrahim Cevizci, Melike Erol, Sema F. Oktug, “Analysis ofmulti-player online game traffic based on self-similarity?”,
NetGames ’06, p.9, (2006).
[10] Kuan-Ta Chen, Polly Huang, Chun-Ying Huang, Chin-Laung
Lei, “Game traffic analysis: an MMORPG perspective”, NOSSDAV ’05, pp.19-24, (2005).