Is a bot at the controls?: Detecting input data attacks

ABSTRACT

The use of programmatically generated input data in place of human-generated input data poses problems for many computer applications in use today. Mouse clicks and keyboard strokes can automatically be generated to cheat in online games, or to perpetrate click fraud. The ability to discern whether input data was computationally generated instead of created by a human input device is therefore of paramount importance to these types of applications. This paper describes a method for detecting input data that was computationally modified or fabricated. This includes detecting data that was not directly generated by a physical human input device such as a keyboard or mouse. A prototype of this system was built on existing hardware and was shown to be effective at detecting attacks on a real application. This detection method is capable of addressing the majority of input-based attacks currently in use. When used in conjunction with a trusted peripheral, it offers a robust mechanism for ensuring a computer is not at the controls.

REFERENCES

• 1: L. von Ahn, M. Blum, N. J. Hopper, J. Langford. "CAPTCHA: Telling humans and computers apart." Advances in Cryptology, Eurocrypt '03, volume 2656 of Lecture Notes in Computer Science, 2003, 294--311.
• 2: N. Baughman, and B. Levine. "Cheat-proof Playout for Centralized and Distributed Online Games", IEEE INFOCOMM, 2001.
• 3: L. Catuogno, I. Visconti. A Format-Independent Architecture for Run-Time Integrity Checking of Executable Code. Proceedings of the Third International Conference on Security in Communications Networks, 2002.
• 4: Chris Chambers , Wu-chang Feng , Wu-chi Feng , Debanjan Saha, Mitigating information exposure to cheaters in real-time strategy games, Proceedings of the international workshop on Network and operating systems support for digital audio and video, June 13-14, 2005, Stevenson, Washington, USA [doi>10.1145/1065983.1065986]
• 5: Bei Di Chen , Muthucumaru Maheswaran, A cheat controlled protocol for centralized online multiplayer games, Proceedings of 3rd ACM SIGCOMM workshop on Network and system support for games, August 30-30, 2004, Portland, Oregon, USA [doi>10.1145/1016540.1016554]
• 6: M. Chew, J. D. Tygar. Image Recognition CAPTCHAs. Proceedings of the 7^th International Information Security Conference, September 2004.
• 7: Click Quality Team. "How Fictitious Clicks Occur in Third-Party Click Fraud Audit Reports" Google, Inc. August 8, 2006. http://www.google.com/adwords/ReportonThird-PartyClickFraudAuditing.pdf
• 8: E. Cronin, B. Filstrup, S. Jamin. "Cheat-Proofing Dead Reckoned Multiplayer Games (Extended Abstract)", Proceedings of ADCOG, January 2003.
• 9: T. Dierks, E. Rescorla, The TLS Protocol Version 1.2. RFC 4346, October 2006.
• 10: Fish-bot for World of Warcraft. http://www.fish-bot.com/
• 11: E. Feldblum, "Stopping Click Fraud: From One Victim To Another", Pay Per Click Universe, (no date). http://www.payperclickuniverse.com/pay-per-click-search-engines-articles.php?article_id=43
• 12: T. Garfinkel and M. Rosenblum. A Virtual Machine Introspection based Method for Intrusion Detection. Network and Distributed Systems Security Symposium Conference Proceedings, 2003.
• 13: B. Grow, B. Elgin, M. Herbst. "Click Fraud: The dark side of online advertising." Business Week Online, October 2, 2006. http://www.businessweek.com/magazine/content/06_40/b400 3001.htm
• 14: G. Hoglund, J. Butler. Rootkits, 2006.
• 15: Galen Hunt , Doug Brubacher, Detours: binary interception of Win32 functions, Proceedings of the 3rd conference on USENIX Windows NT Symposium, p.14-14, July 12-15, 1999, Seattle, Washington
• 16: Intel® Active Management Technology. http://www.intel.com/technology/manage/iamt
• 17: May, M. "Inaccessibility of CAPTCHA: Alternatives to Visual Turing Tests on the Web." W3C Working Group Note 23 November 2005. http://www.w3.org/TR/2005/NOTE-turingtest-20051123/
• 18: MCK-142 Programmable Keyboard. http://www.monucad.com/keyboard.htm
• 19: Nostromo#8482; SpeedPad N52. A human input device designed for gaming applications. http://catalog.belkin.com/IWCatProductPage.process?Produc t_Id=157024
• 20: Nick L. Petroni, Jr. , Timothy Fraser , Jesus Molina , William A. Arbaugh, Copilot - a coprocessor-based kernel runtime integrity monitor, Proceedings of the 13th conference on USENIX Security Symposium, p.13-13, August 09-13, 2004, San Diego, CA
• 21: Punkbuster Online Countermeasures -- a software based anticheat solution. http://www.evenbalance.com
• 22: Rescorla, E., Datagram Transport Layer Security. RFC 4347, April 2006.
• 23: T. Schluessler, et. al., "Runtime Integrity and Presence Verification for Software Agents", Technology@Intel Magazine, December 2005.
• 24: TCG TPM Specification version 1.2 Revision 94, 2006.
• 25: Tuzhilin, Alexander. "The Lane's Gift v. Google Report." http://googleblog.blogspot.com/pdf/TuzhilinReport.pdf
• 26: Virtual Economy Research Network: News, research and discussion on real-money trade of virtual property globally. http://virtual-economy.org/
• 27: Glider - http://www.wowglider.com/FAQ.aspx

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.3 SPECIAL-PURPOSE AND APPLICATION-BASED SYSTEMS

General Terms:
Security

Keywords:
cheat detection, cheating, online games, security