Methods and systems for detecting disparate incidents in processed data using a plurality of machine learning models. For example, the system may receive native asset data. The system may extract telemetry data from the native asset data. The system may input the first feature input into a first machine learning model, wherein the first machine learning model is trained to detect known incidents of a first type in a first set of labeled telemetry data. The system may then detect a first incident based on a first output from the first machine learning model, wherein the first incident is a first event in an asset related to the user's behavior.

Embodiments of the present disclosure provide systems, methods, and computer storage media directed to anti-cheat detection in online multiplayer video games. An anti-cheat kernel driver adapted to validate and secure a system state of a gaming device is loaded during a booting process of the gaming device. The loaded anti-cheat kernel driver ensures that the system state cannot be tampered with from the time of boot through the duration of gameplay. The loaded anti-cheat kernel driver can also receive anti-cheat modules communicated to the gaming device from an anti-cheat server, so that anti-cheat modules are received and executed on an ad hoc basis dictated by the anti-cheat server. The anti-cheat server can autonomously manage the anti-cheat operations performed on a kernel layer or application layer of the gaming device, and conduct anti-cheat mitigation operations if necessary.

A system and method are provided for updating game participants. In some embodiments, the participants receive game control information via a one-way broadcast. The method selects a set of sampling participants from the set of all participants of a game. In some embodiments, the selection occurs prior to the start of the game. The method of some embodiments establishes a two-way connection between a server and each of the sampling participants. For some embodiments, the two-way connection is realtime. The method continuously maintains the two-way connection throughout the game. During each discrete game period, the method receives from a sampling participant, data for the sampling participant's game period performance. Based on the received data, the method determines the performance for the game period and broadcasts this information to a non-sampling participant. A non-sampling participant is a participant who was not selected for the set of sampling participants. In some embodiments, the non-sampling participant determines a standing relative to the other participants in the game event. Some embodiments provide a method and system for detecting unusual performance in a game. The game has a participant. The method calculates for the participant an average performance level. Based on the average performance level, the method tracks for the participant a participant improvement factor and stores the participant improvement factor. The method compares the participant improvement factor to a threshold value.

Systems and methods of virtual world interaction, operation, implementation, instantiation, creation, and other functions related to virtual worlds (note that where the term virtual world is used herein, it is to be understood as referring to virtual world systems, virtual environments reflecting real, simulated, fantasy, or other structures, and includes information systems that utilize interaction within a 30 environment). Various embodiments facilitate interoperation between and within virtual worlds, and may provide consistent structures for operating virtual worlds. The disclosed embodiments may further enable individuals to build new virtual worlds within a framework, and allow third party users to better interact with those worlds.

Systems and methods for detecting and preventing cheating in a location-based game are provided. In particular, a server-side statistical cheat detection algorithm can be implemented upon receiving a player request to perform a game action. A given dataset describing the respective times and locations of previous game events performed by the player can be analyzed to determine a probability that such game events represent legitimate gameplay. The determined probability can affect whether the player-requested game action is effectuated or can influence a number of points awarded for completion of the game action. An example system includes a host server and a client device in communication over a network.

A processing system including at least one processor may obtain controller device output data from a user device and may obtain a data feed of a region of a virtual environment associated with a virtual representation of a user of the user device within the virtual environment, the data feed including data identifying at least one action within the virtual environment of the virtual representation of the user. The processing system may then detect a deviation of the at least one action from the controller device output data, wherein the detecting is via at least one machine learning module and generate an alert in response to the detecting of the deviation.

Methods, systems, and computer products for identifying improper online player accounts are provided. Aspects include receiving, by a processor, online gaming data associated with a user account of an online gaming environment, accessing a player profile associated with the user account, wherein the player profile includes historical online gaming data of a user, analyzing the historical online gaming data of the user to determine a historical play style of the user account, analyzing the online gaming data to determine a current play style of the user account, and comparing the historical play style of the user to the current play style of the user account to determine one or more deviations between the current play style and the historical play style of the user account.

A server apparatus includes a communication interface, a memory, and a processor configured to execute an instruction command stored in the memory to identify other players located within a predetermined range of a distance from a first terminal device, when the communication interface receives position information detected by the first terminal device held by a first player from the first terminal device, to determine whether a non-player character appears in a virtual space of a game application in response to a number of the identified other players, and to transmit non-player information about a non-player character to the first terminal device when the processor determined that the non-player character appears in the virtual space.

A system and method are provided for updating game participants. In some embodiments, the participants receive game control information via a one-way broadcast. The method selects a set of sampling participants from the set of all participants of a game. In some embodiments, the selection occurs prior to the start of the game. The method of some embodiments establishes a two-way connection between a server and each of the sampling participants. For some embodiments, the two-way connection is realtime. The method continuously maintains the two-way connection throughout the game. During each discrete game period, the method receives from a sampling participant, data for the sampling participant's game period performance. Based on the received data, the method determines the performance for the game period and broadcasts this information to a non-sampling participant. A non-sampling participant is a participant who was not selected for the set of sampling participants. In some embodiments, the non-sampling participant determines a standing relative to the other participants in the game event. Some embodiments provide a method and system for detecting unusual performance in a game. The game has a participant. The method calculates for the participant an average performance level. Based on the average performance level, the method tracks for the participant a participant improvement factor and stores the participant improvement factor. The method compares the participant improvement factor to a threshold value.

Some embodiments of the invention provide a method and system for detecting unusual performance in a game. The game has a participant. The method calculates for the participant, a performance metric. The method compares the performance metric to a threshold value. Based on the comparison, the method optionally connects to a server. In some embodiments, the connection is for uploading a set of data from the participant to the server. The server, of some embodiments, broadcasts to the participant. The broadcast is a one-way transmission. In some embodiments, the broadcast includes a distribution based on a set of sample participants. In these embodiments, the set of sample participants comprises a representative sample of all the participants in the game. The threshold value, of some embodiments, is based on the broadcast and in some embodiments, the broadcast includes a histogram. The connecting occurs, in some embodiments, when the performance metric exceeds the threshold value. The connection, for some embodiments, includes a two-way connection. In some embodiments, the method also tracks for the participant, a participant improvement factor. The participant improvement factor is based on an average performance level for the participant. The method stores the participant improvement factor. The threshold value, in some of these embodiments, is based on the participant improvement factor. The method of some embodiments tracks for the game, a game improvement factor. The game improvement factor is based on an average performance level for several participants in the game. The method stores the game improvement factor. The threshold value, in some of these embodiments, is based on the game improvement factor. In some embodiments, the method examines the uploaded data for particular characteristics. In some embodiments, the particular characteristics indicate the likelihood of cheating activity.