Detection of Auto Programs for MMORPGs*

Hyungil Kim, Sungwoo Hong, and Juntae Kim**

Department of Computer Engineering, Dongguk University,
26, 3 Pil-dong, Chung-gu, Seoul, Korea
{hikim, swhong, jkim}@dongguk.edu

Abstract. Auto-playing programs are often used on behalf of human players in

a MMORPG(Massively Multi-player Online Role Playing Game). By playing
automatically and continuously, it helps to speed up the game characters levelup process. However, the auto-playing programs, either software or hardware,
do harm to games servers in various ways including abuse of resources. In this
paper, we propose a way of detecting the auto programs by analyzing the
window event sequences produced by the game players. In our proposed
method, the event sequences are transformed into a set of attributes, and various
learning algorithms are applied to classify the data represented by the set of
attribute values into human or auto player. The results from experiments with
several MMORPGs show that the Decision Tree learning with proposed method
can identify the auto-playing programs with high accuracy.
Keywords: Data Mining, Entertainment and AI, Machine Learning, Intelligent
Data Analysis.

1 Introduction
The users of the MMORPG(Massively Multi-player Online Role Playing Game) are
rapidly increasing. MMORPGs are on-line games in which players use characters
with specific roles to interact between game players (communicate, cooperate, or
compete) and performs adventure, hunting, etc. [1][2][3].
Auto-playing programs are software or hardware that are used to take the place of
human players in a MMORPG. Auto-playing programs automatically produce
keyboard or mouse events that control game characters, and continuously perform
specific tasks on behalf of human users. Since the auto-playing programs do harm to
games servers in various ways including abuse of resources, game service companies
have made constant efforts to exterminate the auto programs. However, many kinds
of auto programs are still used for various games. Especially the hardware type auto
programs that operate between the OS and I/O devices such as mouse, keyboard,
joystick, and monitor, can not be easily detected by the server.
In this paper, we propose a way of identifying the auto programs by analyzing the
window event sequences produced by the game players. Generally, the auto-playing
programs have several goals such as collecting certain objects, and repeatedly
* This work has been supported by Dongguk University research fund.
** Corresponding author.
S. Zhang and R. Jarvis (Eds.): AI 2005, LNAI 3809, pp. 1281 1284, 2005.
Springer-Verlag Berlin Heidelberg 2005

1282

H. Kim, S. Hong, and J. Kim

perform specific tasks. Also, the event sequences produced by auto programs have
characteristics that are statistically distinguishable from that of human players due to
many reasons. In our proposed method, the event sequences produced by human and
auto players are transformed into a set of attributes, and various learning algorithms
including Decision Tree induction are applied to classify the data represented by the
set of attribute values into human or auto player.
The proposed method is applied to the detection of auto programs for various online games including Mu (www.muonline.co.kr), Archlord (archlord.naver.com),
GoonZu (www.goonzu.com), and Maple Story (maplestory.nexon.com). The results
from experiments with several MMORPGs show that the proposed method can
identify the auto-playing programs with high accuracy.

2 Event Sequence Analysis

In this section, we present the method of identifying auto programs in detail by
analyzing window event sequences produced by game players. We extract various
attributes form the event sequences produced by human and auto players, and a set of
those attribute values are used as a training example.
The window events that are produced during game playing include specific key
strokes, mouse button clicks, mouse movements, etc. Table 1 shows an example event
sequence produced during game playing by an auto program in the hunting scene in
Mu game. The messages represent window messages for keyboard and mouse events.
The parameters for keyboard messages are values specifying each key, and the
parameters for mouse messages represent the x-y coordinate values.
Table 1. Example event sequence

Message
WM_KEYDOWN
WM_KEYUP
WM_KEYDOWN
WM_KEYUP
WM_LBUTTONDOWN
WM_LBUTTONUP
:

Parameter H
57
57
57
57
322
322
:

Parameter L
14624
14624
14624
14624
503
503
:

Time
1540664
1540782
1541076
1541186
1541546
1541716
:

Direct comparison between the event sequences is very difficult. To compare the
sequences we extract various attributes that possibly characterize the sequence and
might be useful to distinguish auto players from human players. The attributes include
the total number of events in a given time interval (total_events), ratio of certain
events (key_event_ratio, autokey_ratio), average time between mouse and
keyboard events (m_stroke_ave, k_stroke_ave), standard deviation of time
between mouse and keyboard up and down (m_stroke_dev, k_stroke_dev), average
of time interval between specific mouse and keyboard events (ml_kind_ave,
mr_kind_ave, sp_kind_ave, etc), average of time interval between specific

Detection of Auto Programs for MMORPGs

1283

consecutive mouse and keyboard events (ml_cont_ave, mr_cont_ave,

sp_cont_ave, etc.), standard deviation of time between specific consecutive mouse
and keyboard events (ml_cont_dev, mr_cont_dev, sp_cont_dev, etc.), existence of
specific time series patterns (ml_pattern, mr_pattern, etc.). Total 26 attributes are
used.
105, 0.41, 0.08, 0.02, 0.50, 0.28, 0.02, ... ,

5.01, 3.99, 0, 0, 0, 0, A

Fig. 1. A sample event sequence data represented in an attribute vector

The example event sequences obtained from human players and auto players are
converted into 26 dimensional vectors by using these attributes. Figure 1 shows an
example attribute vector generated from an event sequence produced by auto program
while playing the Mu game for 1 minute. The first attribute is total_events, the
second is key_event_ratio, the third is autokey_ratio, and so on. The attribute
vectors like Figure 1 are generated from multiple sample event sequences produced
by human players and auto programs, and the set of those attribute vectors are used as
a training set for learning. According to the characteristics of various games and the
auto play rules specified in auto programs, some of the attributes (or combination of
them) can provide clues to distinguish the auto program from human players.

3 Experiments
The experiments of proposed method are performed on 4 different on-line games
Mu, Archlord, GoonZu, and Maple Story. For Mu and Maple Story, a hardware type
auto program is used for test, and for Archlord and GoonZu, a software type auto
program is used. We use the WEKA machine learning tool, which is a Java
implementation of various machine learning algorithms, to classify a game playing
event sequence into a human play or auto program play. For classification
experiment, sample event sequences are produced from game playing of human
players and auto programs.
For each game, 3 human players played the game for 30 minutes and produced 90
example sequences of 1 minute length. The auto programs also played for 90 minutes
in the same situation and produced 90 example sequences of 1 minute each. Among
the events, simple mouse movements are excluded. Also, for Maple Story, only
keyboard events are used because the game is played mainly by keyboard. Those
sequences are converted into attribute vectors, and so the total number of training data
for classification is 180 for each game. 10-fold cross validation is used for accuracy
measurements.
Generally, the auto program produces more events than human players because 1)
they are faster than average skilled human players, 2) they are unable to recognized
game situations in many cases and produce multiple events to achieve same task. The
skilled human players may produce more events because they are faster, but the
standard deviation of time between events is generally larger than that of auto
programs. According to the information gain analysis, mr_cont_ave in Mu,

1284

H. Kim, S. Hong, and J. Kim

autokey_kind_dev in Maple Story, sp_kind_ave in Archlord, and ml_cont_ave in

GoonZu were the most informative attributes respectively.
Table 2 shows the classification accuracies achieved by using several machine
learning methods. For the Mu and the Maple Story, the Decision Tree shows highest
accuracy. For the Archlord, the Backpropagation learning with Multilayer Perceptron
shows most accurate result, and for the GoonZu, the k-Nearest Neighbor method
shows most accurate result. The average accuracies are similar for all cases, but we
believe that the Decision Tree learning is a good choice because it can provide the
classification rules for detection of the auto players. In all cases, the classification
accuracies were above 90%.
Table 2. The classification accuracies of various machine learning methods

Classifier
Decision Tree
Multilayer Perceptron
k-Nearest Neighbor
Nave Bayesian

HW auto program
Mu
Maple
99.4%
95.1%
96.1%
91.2%
97.2%
90.2%
95.0%
93.1%

SW auto program
Archlord
GoonZu
93.9%
95.9%
97.5%
98.0%
95.9%
97.5%
96.6%
91.9%

Average
96.1%
95.7%
95.2%
94.2%

4 Conclusion
In this paper, we presented a way of detecting auto programs by analyzing the
window event sequences produced by the game players and applying machine
learning algorithms to the attributes generated from the sequences. We first collected
the keyboard and mouse event sequences produced by the human players and auto
programs. Then various attributes such as the average time and standard deviation of
time between specific events are extracted. By using those attributes the event
sequences are represented as vectors and used as training data for learning.
It is found that, generally the auto program produces more events, and the time
interval between the same kinds of event and the standard deviation of consecutive
same events is smaller than that of human players. The result of experiments with 4
different on-line games shows that the proposed method can be used to detect auto
programs with high accuracy.

References
1. N. Ducheneaut and R. J. Moore, The social side of gaming: a study of interaction patterns
in a massively multiplayer online game, In Proceedings of the ACM conference on
Computer-Supported Cooperative Work, 2004.
2. G. Robert, Pierre Portier, and Agnes Guillot, "Classifier systems as 'Animat' architectures
for action selection in MMORPG," The Third International Conference on Intelligent
Games and Simulation, 2002
3. S. L. Whang and G. Y. Chang, Lifestyles of Virtual World Residents, Living in the on-line
game, "Lineage", International Conference on CYBERWORLDS, 2003.