The popularity of computer games has grown exponentially in the last few years. In some games, players can choose to play with different characters from a pre-defined list, exercising distinct roles in each match. Although such games were created to promote competition and promote self-improvement, there are several recurrent issues. One that has received the least amount of attention is the problem of ”account sharing” so far is when a player pays more experienced players to progressing in the game. The companies running those games tend to punish this behaviour, but this specific case is hard to identify. The aim of this study is to use a database of mouse and keystroke dynamics biometric data of League of Legends players as a case study to understand the specific characteristics a player will keep (or not) when playing different roles and distinct characters.
Online games have become very popular and diverse since their beginning in the 80’s, and each device gives us several biometric modalities to be exploited, such as gait, keystroke dynamics, mouse dynamics, touch-screen dynamics, etc. The diversity of input data is endless and it makes the game an unique experience for the player.
Even though all the previously listed biometrics are used for the same purpose
in the gaming universe, they are fundamentally very different when analysed in the
traditional security and authentication applications. Thus, if we intend to investigate the
identity predictability of game users using these modalities, it is important to understand
its differences from the traditional approaches[
As a very simple example of how different the security application is from a traditional authentication task to a game authentication using biometric data, take it the keystroke dynamics modality in a continuous verification scenario: • In a traditional verification problem, the user’s behaviour is expected to suffer very little variation while typing an e-mail. • On the other hand, in a game verification problem, the user’s behaviour is expected to change and that change will be based on the configurations of the game he/she is using, e.g. the role in the game, the abilities it chose to use, the character he/she is playing with and so on.
The second case can not be considered the same as the first, because, despite the fact they are both verification problems and are using the same base data, the user’s behaviour is different which makes the security system to model it in a different way. To the best of our knowledge, no other work has tried to investigate this specific problem.
Thus, this paper aims to investigate what are the real differences (or if there really are any) in biometric behaviour when the security problem changes from the traditional systems to the gaming universe. We have chosen to investigate some users in the online game League of Legends with the idea of analysing keystroke dynamics and mouse dynamics data from the same users playing with different characters and roles in the game.
The market of egames is huge and, with the recent advancement of virtual reality, the
range of consoles (the hardware you need to play games) has increased greatly. The
kinds of devices used to play go from simple keyboard and mouse to very expensive
virtual reality glasses. However, the most popular is still the computer-based one for it is
indisputable the cheapest [
In a security point of view, each different kind of console will have different vulnerabilities, but the ”black-box” type, the ones you buy and does not need to install any software are, until certain extent, more secure. When we are talking about private computer-based games, we have a limitation in devices that we can use to play, but the possibility of a user to play with another user’s account is more evident.
Considering that we are using League of Legends as our case study, the modalities chosen to investigate are mouse and keystroke dynamics, because both peripherals are mandatory used together during the matches.
Keystroke dynamics is the unique timing patterns embedded in an individual’s
typing and is most often developed in a personal way, hence the use of keyboard dynamics
as a biometrics-based identification modality. Processing of such data includes extracting
keystroke timing features such as the duration of a key press and the time elapsed between
successive key presses [
Mouse dynamics is the unique speed movements and frequency of clicks
generated by a user using the mouse. The move speed is how fast the user moves the mouse in
the 8 possible mapped directions and frequency of clicks is the amount of clicks the users
performs in a time interval [
Since we are using League of Legends as our case study, it is important to understand how keystroke and mouse dynamics are used in the context of the game. The next subsection will introduce the basics of the game, as well as how our modalities can be used in context, followed by subsections enumerating the related work to mouse and keystroke dynamics.
League of Legends is a Multiplayer Online Battle Arena (MOBA) game. The game is based around matches with two teams of (normally) five players each, where each team tries to destroy the main base of the other. Before each match starts, each player chooses a champion to play, which is an avatar that already exists in the game, with predetermined statistics (stats) and skills. Two players of the same team cannot choose the same champion.
Each champion has four unique skills, where three are common skills and the last is a ultimate skill. Skills can grant passive or active abilities, where each skill is activated by the keys ’Q’, ’W’, ’E’ and ’R’, the last one used to activate the ultimate ability.
Each team member follows one of the defined roles during a match: • Top Laner: know as ”top”, this player starts at the top of the map, and usually is a melee attacker; • Jungler: This player spends most of his time defeating jungle’s monsters in order to gain bonus statistics to the team. Champions with high mobility usually take this role; • Mid Laner: Also known as mid, this player starts in the middle of the map, and uses his skill set to create combos to deal damage. Champions with synergic skill set usually take the role; • Carry: also known as ADC (attack damage carry) is responsible take down buildings and clear minions waves. Ranged champions with high damage usually take the role. • Support: Starts in the bottom lane and is responsible to support the ADC ans later the whole team. Champions with good supporting abilities or tanks usually take the role;
The main features used in League of Legends selected for the analysis of this paper from both keyboard and mouse dynamics can be described as follows: • Keystroke dynamics: ’Q’, ’W’, E’, ’R’ (for the unique skills) and ’SPACE’ (used to make the camera follow the player’s champion); • Mouse dynamics: Move the character (point and click in a empty space using the right mouse button), basic attacks (clicking in a enemy using the right mouse button) and target skills (using the left mouse button);
As already said previously, to the best of our knowledge, there is no other work which has investigates the individual variations of keystroke dynamics and mouse dynamics (biometrics) in the context of online games. Section 2.2 will present the main works that can be found using mouse and keystroke dynamics.
Keystroke dynamics is a much older biometrics modality than the mouse dynamics, thus the number of databases available is larger. This is expected because the use of ”mouse” is very much associated with the personal computer whereas the keystroke exists since the use of Morse code.
In [
In [
In [
A login method for accessing computer systems using mouse dynamics was
described by [
Pattern-growth-based mining was used to extract frequent behavior segments in
obtaining stable mouse characteristics in [
The literature does not have a large amount of multimodal systems using mouse and keystroke biometric data. Additionally, work related to online games are very limited.
An approach using game-play activities was proposed in [
According to [
For this work we have used the biometrics database collected in
[
The goal in [
Each sample collected in these works have data of 33 different features: • 13 keystroke features: – Three combination of keys, using the distance between keys, C1 (Q W, W
E, E R), C2(Q E, W R) and C3(Q R) , also called combos; – Frequency (per minute of match) for each key pressed (FQ, FW, FE, FR and FSPACE); – Latency for each key pressed (Q, W, E, R and SPACE). • 20 mouse features: – Move speed of the 8 directions - ’Down’, ’Down + Left’, ’Left’, ’Up + Left’, ’Up’, ’Up + Right’, ’Right’ and ’Down + Right - represented by D1, D2, D3, D4, D5, D6, D7 and D8, respectively; – The acceleration for each direction, represented by AD1, AD2, AD3, AD4,
AD5, AD6, AD7 and AD8, respectively; – Frequency and Latency for right and left clicks, represented as CFR, CFL (for frequency) and CTR and CTL (for latency).
Numerous online games are marketed around the idea of ”different characters for different people”, and these games lead the players to do one of these things: • Always pick the same character for every match, or; • Pick a different character for each match.
The first point may imply that using the same character for every match leads the
players to stay in the same role, but that not always true. A similar assumption could
be made about the second point, inferring that changing a character always changes the
players’ role is not correct. For both cases, this can lead us to the idea that characters
defines how the player behave, but this idea may not be true when we are dealing with
biometrics. As suggested in [
Table 1 shows the 18 users who played more than one match in our database, the champions they used and the roles they played. Users 20 and 48 are the most representative, because they played with at least four of the five roles and played every match with a different character. The other users in this group also have a good value because some of then changed roles between matches, while the others remained in the same role, even when they changed characters. User 55, for example, played both matches in the top lane, first using a melee tank champion (Gnar) and then using a ranged mask-man (Kennen), while user 16 also played his first match using a melee tank (Darius) and then a ranged mask-man (Lucian), but played in different roles.
In order to examine whether a sample x is similar to another sample y statistically,
we used the Mann-Whitney test, which tests the null hypothesis that data in x and y are
samples from continuous distributions with equal medians, against the alternative that
they are not. The test assumes that the two samples are independent, and x and y can have
different lengths [
For our experiments, we will use the Mann-Whitney test to observe if the data from attribute i collected from a user A is similar to i from user B. Ideally, if A = B the User user3 user6 user10 user14 user16 user20 user23 user24 user36 user42 user43 user45 user48 user49 user51 user52 user53 user55 test will always accept the null hypothesis, however, this will not be possible for every case, because different characters can play differently, even when both characters have the same role.
All the possible pairs [α, β] of the samples will be tested with selected users, where α is a sample from user A and β is a sample from user B, for all 33 attributes in the database. As each sample can have different sizes and are independent (each sample is from a different match), Mann-Whitney test fits perfectly to conduct our analysis. All tests were conducted with a 5% significance level, using the two most representative users (user20 and user48).
For this experiment, each sample α from user20 was compared to his 9 other samples, and then the amount of times the null hypothesis H was denied (H = 1) when comparing α to the others was counted, for every feature. After comparing all the samples, themedian and average mean of the amount of times where H = 1 for user 20 was measured.
Figure 1 A) shows us the results of comparing user 20 with himself. The vertical bars represent the number of times the null hypothesis was denied for a certain feature, in other words, the smaller the bar, the better the results.
We can see that the null hypothesis was accepted on average at least half the times for almost all the characteristics, with a ”high” standard deviation caused when two very different characters were compared (for example, a melee jungler with high mobility and a ranged ADC with low mobility). The median shows us a more reliable result, because half of the time the Mann-Whitney test accepted the null hypothesis for all but two features. These two features - CTR and FW - can be explained by the player’s role in a match. Players taking roles like support and jungler need to be constantly moving all over the map, while the other roles usually stay in their positions for longer periods, with junglers and supports always changing their paths to fit the match, whether by attacking enemies in different lanes or conquering neutral objectives, like map visibility, thus, affecting the mouse usage. ’FW’ high disparity is explained by the difference between characters. The ’W’ key is often associated with passive skills that does not require the constant pressing of a button to be activated, or with an ability that does not fit every situation, explaining why the null hypothesis was not accepted.
Figure 1 B) shows the results of comparing user 48 with himself. Much like the previous experiment, each sample β from user 48 was compared with his other 8 samples at a level of significance of 5%.
Resembling the previous comparisons, the medians in Figure 1 shows that the null hypothesis was accepted at least half of the times for almost every feature tested, with some features being more accurate within user 48 samples, like C2 and CFR, and other being more divergent, like Q, FQ and SPACE.
From Figure 1 A) and B), we can see that user 20 has a better accuracy related to SPACE when compared to user 48, implying that user 20 uses the ’SPACE’ key more consistently. It would be hard to infer some information about the other features without proper tests because they are strongly related to roles and characters. The next session presents tests between users, where more information can be gathered.
In order to make these tests, each sample α from user 20 was tested against all samples β from user 48 using the Mann-Whitney test, with a level of significance of 5%, then, the opposite tests were made, putting user 48 against user 20.
Figure 1 C) and D) shows samples from an user against the other. We can see that the median here is greater than half of the maximum H for more than two features, unlike the the previous experiment. This indicates that these features with a bigger H sum have a greater impact comparing user 20 and user 48. We can also see the ’SPACE’ features with a high value, reinforcing the affirmative that both players use the key distinctly, no matter the match.
The opposite comparison, putting user 48 opposed to user 20 gives us similar results. The set of characteristics with a median H greater than half of the the maximum H is almost the same as the previous comparison, reinforcing the value of these features when comparing these two users. One could argument that other features have H results similar to those shown previously, however, the set of characteristics with a high discrepancy have more value, due to exposing the differences between the behaviour of the users, increasing their biometric value.
This first analysis putting users against each others exposed what may be a pattern for every two distinct players, pointing that some characteristics have a high variability between them, exposing what are the most significant features of an individual. It is imperative to note that comparing every sample from a user α with a user β to calculate the median and average mean is not commutative, but a simple comparison between two given samples is. For example, both medians of ’Q’ are high in Figure 1 C) and D), but the results of comparing a sample of user 48 with all the other samples of user 20 tend to negate the null hypothesis of the Mann-Whitney test more times than the opposite, indicating that user 20 ’Q’ feature is closer to user 48 than user 48 is closer to user 20. If the general comparison were commutative this would not be the case.
The results of this work showed us that distinct users can be statistically compared by using the Mann-Whitney test to verify if their characteristics resemble one another, or even if the same player using different characters in different roles resemble himself. The comparisons made here demonstrate how to identify distinctions between users, revealing the value of their behaviour through comparisons. The case study using user20 and user 48 can be expanded to other users, identifying what features have more biometric value to a given user. With a bigger number of samples from other users, this study could be expanded to have a better understanding of how these important features can be identified.
This work point us in a direction where players can be identified no matter what characters or roles they played, dismissing the idea that a player is only defined by the characters they play, thus, reinforcing the idea that biometrics can be used to combat the problem of ”account sharing”.