More Related Content Similar to 一位程式人 PI 在中研院 (16) 一位程式人 PI 在中研院22. 使用者的就讀學校推測結果 ( 上圖 ) 及平均推測範圍 ( 邊數 ) 使用者的年齡推測結果 ( 上圖 ) 及平均推測範圍 ( 邊數 ) 40. Our Solution I: Traffic Analysis Game client Game server Traffic stream Q: Whether a bot is controlling a game client given the traffic stream it generates? A: Yes or No 42. DreamRO -- A screen shot World Map View scope Character Status 43. Trace Collection 207 hours, 3.8 million packets were traced in total Heterogeneity in player skills and network conditions Category Tr# ID Avg. Period Avg. Pkt rate Network Human players 8 A, B, C, D 2.6 hr 1.0 / 3.2 pkt/s ADSL, Cable Modem, Campus Network Bots 11 K (Kore) R (DreamRO) 17 hr 1.0 / 2.2 pkt/s Category participants Client pkt rate Avg. RTT Avg. Loss rate Human players 2 rookies 2 experts 0.8 ~ 1.2 pkt/s 45 ~ 192 ms 0.01% ~ 1.73% Bots 2 bots 0.5 ~ 1.7 pkt/s 33 ~ 97 ms 0.004% ~ 0.2% 45. CDF of Client Response Times Kore: Zigzag pattern (multiples of a certain value) DreamRO: > 50% response times are very small 50. Avg. packet rate vs. round trip times Median RTT Downward trend for human players; upward trend for bots 52. An Integrated Classifier Conservative approach (10000 packets): false positive rate ≈ 0% and 90% correct rate Progressive approach (2000 packets): false negative rate < 1% and 95% correct rate 54. The IDC of the original packet arrival process and that of intentionally-delayed versions 57. Bot Detection: A Decision Problem Q: Whether a bot is controlling a game client given the movement trajectory of the avatar? A: Yes / No? 67. Five Methods for Comparison Method Data Input kNN Original 200-dimension Pace Vectors Linear SVM Nonlinear SVM Isomap + kNN Isomap-reduced Pace Vectors Isomap + Nonlinear SVM 77. 福克斯大神之謎?? (1) ref. http:// forum.gamebase.com.tw/content.jsp?no =4715&cno=47150002&sno=75201947 ref. http://www.wings-of-narnia.com/viewtopic.php?t =3012 網友 A :不知道在聖光之願部落的玩家有沒有發現到,在新手村薩滿訓練師的後面,永遠都會站著一個叫「福克斯大神」的獵人玩家!在半年前我到聖光定居時我在新手村見到他,到現在他仍然還是留守在那個地方……不會暫離、而且可以觀察他 = =" 這種事該回報給 GM 嗎?創新手看到他的時候都覺得好恐佈啊囧 網友 B : me too 看到的一瞬間 突然起雞皮疙瘩 ..... 網友 C : " 已離去 " 玩家的怨念 ( 怨魂 @@) 嗎 ? 還是在悲傷愛情故事裡 , 癡等所愛的另一人 ? ^^^^^^^^QQ 網友 D :哈 線在好多人在看噢 旁邊為了一大群人 @@ 觀光景點呀 XD 78. 福克斯大神之謎?? (2) 網友 E :我剛剛也有去看了一下 開了一個 ID 叫做“聽說有鬼”的獸人戰士 坐在他面前的桶子一直望著他 ~ 忽然 ! < 暫離 > 福克斯大神 他蹲下了 ... 隔一分鐘 .. 消失 =ˇ=" .. .. 現在我心裡也是毛毛的 .. 網友 F :好猛鬼啊 !!!!!! 大神的力量好可怕啊 , 一堆信眾死在他之前!!!!!! 網友 G :我上次有開過去看,還遇到了兩位同好,看的時候真的蠻不可思議的 ... 可以列入魔獸 10 大世界奇觀吧 ! 91. A Typical HTTP Transaction 1. HTTP Request 2. Response Content Client Server 3. Received 1 2 3 92. An HTTP Transaction via a Fast-Flux Bot Long response time! FF Bot 1. HTTP Request 3. Response Content Client Mothership 5. Received 1 2 3 2. Get Redirected 4. Response Content 4 5 93. A Comparison Long document fetch delay Small BW and variable network delay Long processing delay Dedicated Servers TraditionalBots Fast-Flux Bots Request delegation ✘ ✘ ✔ Consumer-level hardware ✘ ✔ ✔ Uncontrollable foreground tasks ✘ ✔ ✔ 99. Data Sources Alexa Atlas DNSBL Phishtank Malware URL Dshield Benign Fast-Flux Malicious 102. Benign Domain ASN Country IP AS Name 15169 United States 74.125.45.100 GOOGLE- Google Inc. 74.125.67.100 74.125.127.100 104. Top 5 # of IP Addresses per Botnet Gang in Our Trace 105. Top 5 # of Domain Names Used by Botnet Gang in Our Trace 121. Comparison of photo-based storytelling media 方式 製作成本 閱讀需求 閱讀控制 表現力 攜帶性 Photo browsing 低 低 高 低 不可 Slideshow 中 低 低 中 不可 Text 高 高 高 高 高 Comic 高 低 高 高 高 Editor's Notes 人工檢查,抽樣 1000 ,準確率 74% (738) , error 大部分也為暱稱。 78% 再 74% = 58% ( 超過一半 ) 72% 再 74% = 53% ( 超過一半 ) 30% 再 74% = 22% (5 分之一 ) 人工檢查,抽樣 1000 ,準確率 74% (738) , error 大部分也為暱稱。 78% 再 74% = 58% ( 超過一半 ) 72% 再 74% = 53% ( 超過一半 ) 30% 再 74% = 22% (5 分之一 )