CAPTCHA Challenges for Massively Multiplayer Online Games

1. CAPTCHA Challenges for Massively Multiplayer Online Games 2010 International Conference on Cyberworlds Authors: Yang-Wai Chow, Willy Susilo, Hua-Yu Zhou Presented by Chien-Erh Huang 2011/01/06

2. 1 2 3 4 Introduction Background Implementation Conclusions and Futurework Outline

3. Introduction • The rapid growth in the online gaming market world wide has seen the development of MMOGs evolving into a multi-billion dollar industry. • The use of automated programs to play these games, known as botting, has long been a problem that has plagued online games. • This destroys the fun for honest players who expect the game to be played on a level playing field.

4. Introduction • Botting game exploits are not only problematic for the players, but game developers potentially stand to loose thousands of dollars in lost revenues from disillusioned players who stop subscribing to play their game. [1] • The concept of CAPTCHAs (Completely AutomatedPublic Turing test to tell Computers and Humans Apart) wasintroduced as a way of distinguishing between humans andcomputer programs.[2] [1] R.V. Yampolskiy and V. Govindaraju, “Embedded Noninteractive Continous Bot Detection,” ACM Computers in Entertainment, vol. 5, no. 4, March 2008, Article 7. [2]L. von Ahn, M. Blum, N.J. Hopper and J. Langford, “CAPTCHA: Using Hard AI Problems for Security,” Advances in Cryptology – Eurocrypt 2003, Lecture Notes in Computer Science, vol. 2656, pp. 294-311, 2003.

5. Introduction • Periodic tests using traditional text-based CAPTCHAs in the context of online games are intrusive, they interfere with the flow of the game and they destroy the player’s sense of immersion in the game. • This gives rise to the question of how to seamlessly incorporate CAPTCHA mechanisms into games without adversely affecting a player’s fun or enjoyment of the game.

6. Background • A. Bot Countermeasures • Game masters can approach these characters and try to start conversations with them in order to determine whether a human is actually playing the game. [3] • Some developers attempt to incorporate process monitoring to check for known bot programs running on the player’s system. [4] [3] S. Mitterhofer, C. Kruegel, E. Kirda and C. Platzer, “Server-Side Bot Detection in Massively Multiplayer Online Games,” IEEE Security and Privacy, vol. 7, no. 3, May/June 2009, pp. 29-36. [4] G. Hoglund and G. McGraw, Exploiting Online Games: Cheating Massively Distributed Systems. New Jersey: Addison-Wesley, 2007.

7. Background • B. Related Work (Monitoring Techniques) • Chen et al. propose a technique of monitoring network traffic and identifying discrepancies in the traffic patterns. [5] • M. van Kesteren et al. perform a simple test to classify bots based on variations in the frequency of different movement angles between bots and humans. [6] • S. Gianvecchio et al. performed a series of experiments by collecting user input for a number of user input actions. [7] [5] K.T. Chen et al, “Identifying MMORPG Bots: A Traffic Analysis Approach,” ACM SIGCHI International Conference on Advances in Computer Entertainment Technology, 2006, article 4. [6] M. van Kesteren et al, “A Step in the Right Direction: Botdetection in MMORPGs using Movement Analysis,” Proc. of the 21st Belgian-Dutch Conference on Artificial Intelligence, 2009. [7] S. Gianvecchio et al, “Battle of Botcraft: Fighting Bots in Online Games with Human Observational Proofs,” ACM Computer and Communications Security Conference, 2009.

8. Background • B. Related Work (CAPTCHAs) • The use of CAPTCHA tests has also been proposed for preventing bots in online games. • An advantage of this approach is that it requires less computational resources. • In the attempt to make CAPTCHAs secure against automated machine attacks, a variety of techniques have been proposed to make CAPTCHAs harder to break. [8] • CAPTCHA tests to players during the actual gameplay is both distracting and disruptive to the flow of the game. [8] J. Yan and A.S.E. Ahmad, “Usability of CAPTCHAs – Or Usability Issues in CAPTCHA Design,” Proc. of the Symposium on Usable Privacy and Security (SOUPS), 2008, pp. 44-52.

9. Implementation • There is a random chance of good drops, developers can implement CAPTCHA challenges as mini-games. • Once players become accustomed to these mini-games, they will not directly break the flow of the game as it will be seen as a regular part of the gameplay. • In addition, there is that excitement and anticipation in the reward that the player expects to receive upon successfully solving the CAPTCHA.

10. Implementation • If a particular player consistently fails the CAPTCHA challenge. When that happens, other measures can be taken to investigate this further. • CAPTCHA challenges should only be presented during these slow paced periods.

11. Implementation

12. Implementation • Analysis • Limitation

13. Conclusions and Futurework • This paper presents an approach of integrating CAPTCHA challenges seamless into MMOGs in a way that does not completely destroy the sense of fun in the game. • The authors are currently working on an animated CAPTCHA approach which uses 3D models in 3D scene. By using motion parallax, where objects at different distances in a 3D scene appear to move by different rates, users can distinguish the important content from the rest of the scene as the camera viewport moves around in the scene. This 3D CAPTCHA approach can easily blend in with the environment of a 3D game world.

14. Thank You !