KR101201495B1 - method for blocking auto-input in computer system - Google Patents

Abstract

The present invention relates to an apparatus and method for detecting and blocking automatic input by an automatic input device such as an auto mouse or an auto keyboard in a computer system.
In the computer system according to the present invention, the automatic input blocking device includes an event monitoring unit for detecting the event in the automatic input blocking device in the computer system for transmitting an event corresponding to a signal input from the automatic input device to the game process. ; An event information storage unit for analyzing the event to store an event structure including an occurrence time and event occurrence position information of the event, and generating and storing an event structure array with a plurality of sequentially input event structures; A pattern analyzer to determine whether an automatic input is performed by analyzing a pattern using occurrence time and event occurrence position information of event structures constituting one event structure array stored in the event information storage unit; And an automatic input disabling unit configured to disable input from the automatic input device when the pattern analysis unit determines that the automatic input is performed.

Description

Automatic input blocking device and method in computer system {method for blocking auto-input in computer system}

The present invention relates to an automatic input blocking device and method in a computer system, and more particularly, to an apparatus and method for detecting and blocking automatic input by an automatic input device such as an auto mouse or an auto keyboard in a computer system.

The widespread use of high-speed Internet has led to the rapid growth of the online game population and the development of numerous online games. However, the concept and concept of game security is still very weak. Illegal programs in computers are called hacks or hacking programs, and hacks or hacking programs in games are called game hacks. These game hacks refer to programs that manipulate files, memory, etc. of a particular game process.

Game hacks allow game users to easily win games by manipulating the game's memory to change certain data, such as stats and stamina, increasing the speed or number of blows in martial arts games, or granting macro functions. . Because of this, gamers like to install game hacks for online games. However, the use of game nuclei in online games can cause problems such as balance among players, heavy loads on game servers, and the like. In other words, if some of the gamers in the online game to play the game in an abnormal way, the balance with other gamers are broken, and in serious cases, the overall balance of the online game is broken and the game server is overloaded.

Among various online games, a game called massively multiplayer online role playing game (MMORPG) is a game in which a large number of users simultaneously access a game server and play their role in a fantasy or mystery world set by the game. Gamers in MMORPG games can train their characters through hunting or combat to level up, form relationships with other gamers to form guilds, form teams to battle in groups, or trade You can also buy items. In most MMORPG games, in order to increase your character's level or experience, you have to repeat missions such as hunting monsters, fighting enemies, visiting specific areas, and so on. These repetitive missions can be performed through constant and regular mouse movements, repetitive clicks, repetitive and regular inputs to specific keys on the keyboard, and the like.

Some gamers have installed auto-input devices on their computer systems, such as auto mice or auto keyboards, that automatically perform these repetitive missions, so they don't need to type in a mouse or keyboard. The keyboard can automatically generate events to perform the mission automatically to quickly increase the player's character level or experience. Such character control by automatic input not only destroys the game balance by destroying fair and fair game progress, but also causes serious social problems by being used by organizations that illegally sell game items offline.

A method of detecting automatic input of an automatic input device such as a conventional auto mouse or an auto keyboard, and hooks an API (Application Programming Interface) function that is used to generate a mouse or keyboard event in an automatic input program, and the corresponding event is input to a game. If so, there is a way to make the event fail. For example, the SendInput API provides the ability to programmatically generate mouse or keyboard events. If an automatic input program uses the SendInput API to deceive as if a mouse or keyboard event occurred, then the SendInput API can be hooked and automatically entered. You can block the execution of automatic input programs by preventing programs from calling the SendInput API.

However, the automatic input blocking technology using the API hooking method can block automatic input by a software method, but there is a problem that automatic input by a hardware method cannot be blocked.

SUMMARY OF THE INVENTION An object of the present invention is to provide a device and method for detecting and blocking automatic input by a hardware type automatic input device by analyzing a pattern of a mouse event in a computer system. will be.

In the computer system according to the present invention for achieving the above object, the automatic input blocking device, the automatic input blocking device in the computer system for transmitting an event corresponding to the signal input from the automatic input device to the game process, the event Event monitoring unit for detecting; An event information storage unit for analyzing the event to store an event structure including an occurrence time and event occurrence position information of the event, and generating and storing an event structure array with a plurality of sequentially input event structures; A pattern analyzer to determine whether an automatic input is performed by analyzing a pattern using occurrence time and event occurrence position information of event structures constituting one event structure array stored in the event information storage unit; And an automatic input disabling unit for disabling the input from the automatic input device when the pattern analysis unit determines the automatic input.

In addition, the automatic input blocking method in the computer system according to the present invention, in the automatic input blocking method in the computer system for transmitting the event corresponding to the signal input from the automatic input device to the game process, the event detection for detecting the event Steps; An event information storing step of analyzing the event to store an event structure including an occurrence time and event occurrence position information of the event, and generating and storing an event structure array with a plurality of sequentially input event structures; A pattern analysis step of determining whether or not to automatically input a pattern by analyzing a pattern using event time and event occurrence location information of event structures constituting one event structure array stored in the event information storage step; If it is determined that the automatic input in the pattern analysis step, characterized in that it comprises an automatic input disablement step of disabling the input from the automatic input device.

As described above, according to the present invention, since automatic input by a hardware type automatic input device can be detected and blocked, it is possible to protect in good faith gamers in online games.

1 is a functional block diagram showing an automatic input blocking device in a computer system according to the present invention.
2 is a flowchart illustrating an automatic input blocking method in a computer system according to the present invention.

Hereinafter, with reference to the accompanying drawings will be described in more detail the automatic input blocking device and method in a computer system according to an embodiment of the present invention.

1 is a functional block diagram showing an automatic input blocking device in a computer system according to the present invention.

The automatic input device 110 is connected to the computer system 120 and inputs a mouse signal or a keyboard signal to an application process, that is, a game process of the computer system 120. In this embodiment, the case where the automatic input device 110 is an auto mouse will be described as an example.

The computer system 120 typically generates a device driver 121 for processing a signal input from the automatic input device 110 and an event corresponding to a signal input from the automatic input device 110 to generate a game process 123. Event processing unit 122 to deliver to. In this case, the device driver 121 processes both the input signal of the normal mouse device and the input signal of the automatic input device (auto mouse), and the event processor 122 processes the event and the automatic input device (auto) for the input of the normal mouse device. Raises all events for input). This event occurs when the x and / or y coordinates of the mouse change, the left button clicks (down and up), the right button clicks (down and up), or the center wheel is down or up. That is, the present invention analyzes a pattern of events input from an unknown mouse device (not known as a normal mouse device or an auto mouse), and determines whether the unknown mouse device is a normal mouse device or an auto mouse, If it disables its input.

Automatic input blocking device 130 according to the present invention is implemented as a security process running in the computer operating system of the computer system 120.

The automatic input blocking device 130 according to the present invention includes an event monitoring unit 131 for monitoring an event transmitted from the event processing unit 122 to the game process 123, and storing the event information as a structure by analyzing the event. The event information storage unit 132, the pattern analysis unit 133 for determining whether to automatically input by analyzing the pattern of the event structure stored in the event information storage unit 132, and the pattern analysis unit 133 to the automatic input The automatic input disablement unit 134 disables the input from the automatic input device 110 when it is determined.

The event monitoring unit 131 hooks and monitors an event delivered by the event processing unit 122 to the game process 123.

The event information storage unit 132 stores an event structure for each event. The event structure includes an event occurrence time, a location where an event occurred (for example, x and y coordinates indicating a mouse position), and operation of a button or a key. Status (down or up) (e.g. left button down, left button up, center wheel down, center wheel up, right button down, right button up) ) Information is included. In addition, the event information storage unit 132 bundles a predetermined number n of event structures sequentially input and stores them in one event structure array. That is, when n is 10, whenever an event occurs, an event structure including the above information is stored, and one event structure array is generated by grouping 10 event structures sequentially input. That is, the first event structure array is created from the first 10 event structures, and the second event structure array is created from the next 10 event structures. Also, if the number of event structure arrays is larger than the threshold, the oldest event structure array is deleted.

The pattern analyzer 133 analyzes a pattern between two arbitrary event structures in one event structure array, and also analyzes a pattern between two arbitrary event structure arrays to determine whether to automatically input the pattern. This will be described in detail.

Methods for analyzing a pattern between two arbitrary event structures in one event structure array include the following methods, and the pattern analysis unit 133 according to the present invention applies automatic pattern input by applying at least one of the pattern analysis methods. Judge.

Pattern analysis method 1 (automatic input or not is determined by using movement direction information of event occurrence position information of two adjacent event structures): x coordinates and y coordinates of two adjacent event structures are compared, and among the x coordinates and y coordinates, If one remains unchanged and only the other changes, the auto-put suspicion count is increased by one. That is, if the mouse position moves only on the x-axis or only on the y-axis, the suspicion count for automatic input is increased by one.

Pattern analysis method 2 (automatic input is judged using distance information between event occurrence positions of two adjacent event structures): The distance between two points defined as x and y coordinates of two adjacent event structures is discontinuous above a threshold. , Increases the auto-input suspicion count by one.

Pattern Analysis Method 3 (Determination of automatic input using distance information between event occurrence positions of two event structures at predetermined time intervals): Two defined by x and y coordinates of two arbitrary event structures for a predetermined time. If the distance between the points is greater than or equal to the threshold, increase the auto-input suspicion count by one.

Pattern analysis method 4 (determining whether or not to automatically input using the event number information generated between the two event structure compared to the distance between the event occurrence position of any two event structure): x coordinate and y coordinate of any two event structure If the number of events generated between the two event structures is small compared to the distance between two points defined by, the automatic input suspicion count is increased by one. That is, if the minimum number of event events to the movement distance is defined in advance, and the number of event structures between the two event structures is less than the minimum number of events by using the movement distance of any two event structures and the number of event structures between the two event structures. Increases the auto-input suspicion count by 1.

Pattern Analysis Method 5 (Judges whether or not to automatically input using the button state information of the event structure): If the left button or the right button is continuously down or up, the suspicious count of the automatic input is increased by one. In other words, in the case of a normal mouse device, it should be up after the left button or the right button is down and down after it is up. However, the auto mouse can skip the up event and repeat only the down event, which increases the auto-input suspicion count by one.

The pattern analyzing unit 133 analyzes the pattern between the arrays of the event structures, and counts the number of event structures that match each other among the event structures constituting any two event structure arrays, and the number of matching event structures is equal to a threshold value. If it is abnormal, the automatic input suspicion count is increased by one. This method compares and analyzes how much the coordinates of each button value in the generated event structure array match. When a gamer manipulates a normal mouse device, even if the mouse device is repeatedly moved in a narrow area, the same movement cannot be made. Therefore, when the motions between the arrangement of different event structures coincide by the threshold value, it is determined as a mechanical repetitive motion.

When the pattern analysis unit 133 of the present invention analyzes the above-described pattern analysis methods and determines that the automatic input suspicion count is greater than or equal to a threshold value, the pattern analysis unit 133 determines the automatic input. The automatic input suspicion count by pattern analysis between the structure arrays may be accumulated and summed, or may be determined separately.

When the automatic input disabling unit 134 determines that the automatic input suspicion count is greater than or equal to a threshold value, the automatic input disabling unit 134 stops the input of the automatic input device 110 from being transmitted to the game process 123 or terminates the game process 123. Disable the automatic input using a method such as.

2 is a flowchart illustrating an automatic input blocking method according to an embodiment of the present invention.

First, the variables i and k are initialized (S201). If an event transmitted from the event processor 122 to the game process is detected (S202), the i-th event structure is stored for the event detected in step S202 and i is increased by 1 (S203). If i does not exceed the first threshold value n (S204), the process returns to step S202.

If i exceeds the first threshold value n, in step S204, steps S202 to S203 are repeatedly performed to generate and store the k-th event structure array with the first to n-th event structures stored therein, and i to be stored. Initialize (S205).

Next, by analyzing a pattern between two arbitrary event structures in the k-th event structure array to count an automatic input suspicion count (S206), the pattern analysis method between the two event structures is the above-described pattern analysis method 1 to pattern analysis method 5 Apply at least one method.

Next, by analyzing the pattern between the k-th event structure array and the previously stored event structure array to count the suspicious count of automatic input (S207), the pattern analysis method between the two event structure array is the same of the event structure constituting the two event structure array The number of event structures is counted to determine whether the input is automatic.

Steps S206 and S207 may be selectively performed, and thus only step S206 may be performed or only step S207 may be performed.

If the automatic input suspicion count is less than the second threshold (S208), k is increased by 1 (S209). If k does not exceed the third threshold value m after performing step S209 (S210), the process returns to step S202 immediately, and if k exceeds the third threshold value m after performing step S209 (S210), The (km) event structure array, that is, the oldest event structure array among the previously stored event structure arrays is deleted (S211).

If the suspected automatic input count is greater than or equal to the second threshold in step S208, it is determined as an automatic input and the automatic input is disabled (S212).

The present invention can be applied to auto keyboard detection as well as auto mouse, and when the keyboard input event is stored as a structure and the keyboard event occurrence interval is short or is input at the same occurrence interval (the gamers normally click the keyboard key, Cannot be regular up to milliseconds), can be detected by the auto keyboard.

110: automatic input device 120: computer system
121: device driver 122: event processing unit
123: application process (game process) 130: automatic input blocking device
131: event monitoring unit 132: event information storage unit
133: pattern analysis unit 134: automatic input neutralization unit

Claims (18)

delete In the automatic input blocking device in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring unit detecting the event;
An event information storage unit for analyzing the events detected by the event monitoring unit, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analyzer to determine whether an automatic input is performed by analyzing a pattern by using event occurrence location information of event structures constituting an arbitrary event structure array stored in the event information storage unit;
If it is determined that the automatic input from the pattern analysis unit includes an automatic input disablement unit for disabling the input from the auto mouse,
And the pattern analyzer determines automatic input by using movement direction information of event occurrence position information of two adjacent event structures. In the automatic input blocking device in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring unit detecting the event;
An event information storage unit for analyzing the events detected by the event monitoring unit, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analyzer to determine whether an automatic input is performed by analyzing a pattern by using event occurrence location information of event structures constituting an arbitrary event structure array stored in the event information storage unit;
If it is determined that the automatic input from the pattern analysis unit includes an automatic input disablement unit for disabling the input from the auto mouse,
The pattern analysis unit automatic input blocking device in the computer system, characterized in that for determining whether the automatic input using the distance information between the event occurrence position of the two adjacent event structure. In the automatic input blocking device in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring unit detecting the event;
An event information storage unit for analyzing the events detected by the event monitoring unit, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analyzer to determine whether an automatic input is performed by analyzing a pattern using event occurrence time and event occurrence position information of event structures constituting an arbitrary event structure array stored in the event information storage unit;
If it is determined that the automatic input from the pattern analysis unit includes an automatic input disablement unit for disabling the input from the auto mouse,
The pattern analysis unit automatic input blocking device in the computer system, characterized in that for determining whether the automatic input using the distance information between the event occurrence position of the two event structure of the predetermined time interval. In the automatic input blocking device in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring unit detecting the event;
An event information storage unit for analyzing the events detected by the event monitoring unit, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analyzer to determine whether an automatic input is performed by analyzing a pattern using event occurrence time and event occurrence position information of event structures constituting an arbitrary event structure array stored in the event information storage unit;
If it is determined that the automatic input from the pattern analysis unit includes an automatic input disablement unit for disabling the input from the auto mouse,
And the pattern analyzer determines whether to automatically input the event using information on the number of events generated between the two event structures compared to the distance between the event occurrence positions of two event structures. In the automatic input blocking device in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring unit detecting the event;
An event for analyzing the events detected by the event monitoring unit and storing an event structure including event occurrence time, event occurrence position information and button state information, and generating and storing an event structure array with a plurality of sequentially input event structures An information storage unit;
A pattern analysis unit determining whether or not to automatically input a pattern by analyzing button state information of event structures constituting an arbitrary event structure array stored in the event information storage unit;
If it is determined that the automatic input from the pattern analysis unit includes an automatic input disablement unit for disabling the input from the auto mouse,
And the button state information is one of a right button down, a right button up, a left button down, and a left button up. The apparatus of claim 6, wherein the pattern analyzer determines automatic input when a specific button is continuously up or down using the button state information of the event structure. In the automatic input blocking device in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring unit detecting the event;
An event information storage unit for analyzing the events detected by the event monitoring unit, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analyzer to determine whether an automatic input is performed by analyzing a pattern using event occurrence time and event occurrence position information of event structures constituting an arbitrary event structure array stored in the event information storage unit;
If it is determined that the automatic input from the pattern analysis unit includes an automatic input disablement unit for disabling the input from the auto mouse,
The pattern analysis unit automatic input blocking device in the computer system, characterized in that it determines whether the automatic input by counting the number of the same event structure of the event structure constituting any two event structure array. 9. The method according to any one of claims 2 to 8,
And the event information storage unit deletes the oldest event structure array if the number of event structure arrays is greater than or equal to a threshold. delete In the automatic input blocking method in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring step of detecting the event;
An event information storing step of analyzing the events detected in the event monitoring step, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analysis step of determining whether or not an automatic input is performed by analyzing a pattern using event occurrence location information of event structures constituting an arbitrary event structure array stored in the event information storage step;
And an automatic input disablement step of disabling the input from the auto mouse when it is determined that the automatic input is performed in the pattern analysis step.
The pattern analysis step of the automatic input blocking method of the computer system, characterized in that it is determined whether the automatic input using the movement direction information of the event occurrence position information of two adjacent event structures. In the automatic input blocking method in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring step of detecting the event;
An event information storing step of analyzing the events detected in the event monitoring step, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analysis step of determining whether or not an automatic input is performed by analyzing a pattern using event occurrence location information of event structures constituting an arbitrary event structure array stored in the event information storage step;
And an automatic input disablement step of disabling the input from the auto mouse when it is determined that the automatic input is performed in the pattern analysis step.
The pattern analysis step of the automatic input blocking method in the computer system, characterized in that for determining whether the automatic input using the distance information between the event occurrence position of two adjacent event structure. In the automatic input blocking method in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring step of detecting the event;
An event information storing step of analyzing the events detected in the event monitoring step, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analysis step of determining whether an automatic input is performed by analyzing a pattern using event occurrence time and event occurrence position information of event structures constituting an arbitrary event structure array stored in the event information storage step;
And an automatic input disablement step of disabling the input from the auto mouse when it is determined that the automatic input is performed in the pattern analysis step.
The pattern analysis step is automatic input blocking method in a computer system, characterized in that for determining whether the automatic input using the distance information between the event occurrence position of the two event structure of the predetermined time interval. In the automatic input blocking method in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring step of detecting the event;
An event information storing step of analyzing the events detected in the event monitoring step, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analysis step of determining whether an automatic input is performed by analyzing a pattern using event occurrence time and event occurrence position information of event structures constituting an arbitrary event structure array stored in the event information storage step;
And an automatic input disablement step of disabling the input from the auto mouse when it is determined that the automatic input is performed in the pattern analysis step.
The pattern analysis step of the automatic input blocking method in the computer system, characterized in that it is determined whether the automatic input using the number of events generated between the two event structure compared to the distance between the event occurrence position of the two event structure. In the automatic input blocking method in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring step of detecting the event;
Analyzing the events detected in the event monitoring step, and stores an event structure including the event occurrence time, event occurrence location information and button state information, and generates and stores an event structure array with a plurality of sequentially input event structure An information storage step;
A pattern analysis step of determining whether or not to automatically input a pattern by analyzing button state information of event structures constituting an arbitrary event structure array stored in the event information storage step;
And an automatic input disablement step of disabling the input from the auto mouse when it is determined that the automatic input is performed in the pattern analysis step.
And the button state information is one of right button down, right button up, left button down, and left button up. 16. The method of claim 15, wherein the pattern analysis step determines the automatic input when a specific button is continuously up or down using the button state information of the event structure. In the automatic input blocking method in the computer system for transmitting the event corresponding to the signal input from the auto mouse to the game process,
An event monitoring step of detecting the event;
An event information storing step of analyzing the events detected in the event monitoring step, storing an event structure including event occurrence time and event occurrence location information, and generating and storing an event structure array with a plurality of sequentially input event structures; ;
A pattern analysis step of determining whether an automatic input is performed by analyzing a pattern using event occurrence time and event occurrence position information of event structures constituting an arbitrary event structure array stored in the event information storage step;
And an automatic input disablement step of disabling the input from the auto mouse when it is determined that the automatic input is performed in the pattern analysis step.
The pattern analysis step of the automatic input blocking method in a computer system, characterized in that whether the automatic input by determining the number of the same event structure of the event structure constituting the arbitrary two event structure array. 18. The method according to any one of claims 11 to 17,
And the event information storing step deletes the oldest event structure array if the number of event structure arrays is greater than or equal to a threshold.

Images