Analysis of multi-country users in mobile games using network log

Abstract

Monitoring deviant users in online mobile games is a critical task in order to safeguard the health of in-game ecosystem and the livelihood of user gaming experience. Tracking down such users is a costly effort, mandating human intervention. Thus narrowing down the candidate list of deviant users is important in service management. Given mobile game logs collected at user devices, we have identified a group of unusual users who played a game from multiple countries. More than a half of those users moved suddenly from one country to another, within a very short span of time. Such movements suggest discrepancy between reality and online presence. In this thesis, we introduce a detection methodology for deviant users based on their access history and geolocation. We analyze network event logs from a set of mobile game applications by a major game publisher in South Korea and identify those users logged in from multiple countries. The key insight into the detection methodology is sudden moves of them, that we define teleport. Among plausible scenarios behind teleport, our data analysis points at the use of VPN as the most likely method. We have identified 2.01% of users to have employed VPN in their access to the mobile games. The narrowed-down watch list of deviant users will improve the efficiency of service management.