Methods, systems, and computer programs are provided for identifying an abusive player in a game. One method includes receiving gameplay data for a player during gameplay of the game. The method includes processing a plurality of game mechanics of the game as the player provides input for one or more of said plurality of game mechanics. The method includes processing abusive action scores for each of the plurality of game mechanics. The abusive action scores have a number of tagged actions that are inconsistent with predefined use of said plurality of game mechanics based a game context of the gameplay of the game. The method includes qualifying the player as abusive in regard to one or more of the plurality of game mechanics based on one or more of the abusive actions scores exceeding a threshold during a session of the gameplay of the game.

Embodiments of an automated fraud detection system are disclosed that can detect user accounts that are engaging in unauthorized activities within a game application. The fraud detection system can provide an automated system that identifies parasitic accounts. The fraud detection system may identify patterns using machine learning based on characteristics, such as gameplay and transaction characteristics, associated with the parasitic user accounts. The fraud detection system may generate a model that can be applied to existing accounts within the game in order to automatically identify users that are engaging in unauthorized activities. The fraud detection system may automatically identify these parasitic accounts and implement appropriate actions to prevent the accounts from impacting legitimate users within the game application.

There is provided a method and a system for preventing wall-hacking by using server side ray tracing to filter data packets to be provided to user devices during a multiplayer video gaming session. Map information and player updates indicative of player actions are received, and an acceleration structure is generated. Primary rays from the virtual frustum associated with players are generated and intersections between rays and players geometries on the map are determined based on the acceleration structure. The visibility matrix is generated based on the determined intersections. The visibility matrix includes pair wise visibility information between each player. Data packets provided to each user device are then filtered based on the visibility matrix.

Systems and methods for a computer-based process that detects improper behavior of avatars in a computer-generated environment, and marks these avatars accordingly, so that other users may perceive marked avatars as bad actors. Systems of embodiments of the disclosure may monitor avatar speech, text, and actions. If the system detects behavior it deems undesirable, such as behavior against any laws or rules of the environment, abusive or obscene language, and the like, avatars committing or associated with this behavior are marked in some manner that is visually apparent to other users. In this manner, improperly-behaving avatars may be more easily recognized and avoided, thus improving the experience of other users.

Embodiments of the present disclosure provide systems, methods, and computer storage media directed to anti-cheat detection in online multiplayer video games. An anti-cheat kernel driver adapted to validate and secure a system state of a gaming device is loaded during a booting process of the gaming device. The loaded anti-cheat kernel driver ensures that the system state cannot be tampered with from the time of boot through the duration of gameplay. The loaded anti-cheat kernel driver can also receive anti-cheat modules communicated to the gaming device from an anti-cheat server, so that anti-cheat modules are received and executed on an ad hoc basis dictated by the anti-cheat server. The anti-cheat server can autonomously manage the anti-cheat operations performed on a kernel layer or application layer of the gaming device, and conduct anti-cheat mitigation operations if necessary.

Systems and methods for a computer-based process that detects improper behavior of avatars in a computer-generated environment, and marks these avatars accordingly, so that other users may perceive marked avatars as bad actors. Systems of embodiments of the disclosure may monitor avatar speech, text, and actions. If the system detects behavior it deems undesirable, such as behavior against any laws or rules of the environment, abusive or obscene language, and the like, avatars committing or associated with this behavior are marked in some manner that is visually apparent to other users. In this manner, improperly-behaving avatars may be more easily recognized and avoided, thus improving the experience of other users.

An electronic device and a method for detecting abnormal device operation are provided. The method includes: obtaining multiple action events of a movable input device, and each action event including a relative coordinate and a time stamp of the movable input device; generating multiple absolute coordinates based on the relative coordinate of each action event; estimating multiple speed vectors based on the absolute coordinates and the time stamp of each action event; estimating multiple acceleration vectors based on the speed vectors and the time stamp of each action event; and estimating a probability of abnormal operation based on the speed vectors and the acceleration vectors.

Examples herein include systems for detecting cheating and changes in mental performance in card games, including bridge. The system can acquire board data for multiple events, the events including bridge games. For each event, determining performance values for a player based on the board and play data, wherein the performance values may additionally be based in part on timing data. The system can detect a deviation of by comparing the performance values against a threshold, wherein the threshold is based on past performance of known cheating players or the individual player. Then the system can alert a user when the likelihood of cheating or other changes exceeds a threshold.

Some embodiments of the invention provide a method and system for detecting unusual performance in a game. The game has a participant. The method calculates for the participant, a performance metric. The method compares the performance metric to a threshold value. Based on the comparison, the method optionally connects to a server. In some embodiments, the connection is for uploading a set of data from the participant to the server. The server, of some embodiments, broadcasts to the participant. The broadcast is a one-way transmission. In some embodiments, the broadcast includes a distribution based on a set of sample participants. In these embodiments, the set of sample participants comprises a representative sample of all the participants in the game. The threshold value, of some embodiments, is based on the broadcast and in some embodiments, the broadcast includes a histogram. The connecting occurs, in some embodiments, when the performance metric exceeds the threshold value. The connection, for some embodiments, includes a two-way connection. In some embodiments, the method also tracks for the participant, a participant improvement factor. The participant improvement factor is based on an average performance level for the participant. The method stores the participant improvement factor. The threshold value, in some of these embodiments, is based on the participant improvement factor. The method of some embodiments tracks for the game, a game improvement factor. The game improvement factor is based on an average performance level for several participants in the game. The method stores the game improvement factor. The threshold value, in some of these embodiments, is based on the game improvement factor. In some embodiments, the method examines the uploaded data for particular characteristics. In some embodiments, the particular characteristics indicate the likelihood of cheating activity.

A method performed by at least one server computer is provided, including: during interactive gameplay of a multi-player video game, processing game state data to identify gameplay activity of a player as being abusive; responsive to the identifying the gameplay activity as being abusive, then applying a corrective action to the player during the interactive gameplay, the corrective action providing an indication to the player of the gameplay activity that was identified as being abusive; after applying the corrective action, further processing the game state data to identify additional gameplay activity of the player as being abusive; responsive to the identifying the additional gameplay activity as being abusive, then applying a penalty to the player.