You Are Not My Teammate: Behavioral Fingerprint-based Detection of Suspicious Account Misuse

This paper proposes a behavioral fingerprint-based detection method for identifying suspicious account misuse, such as account sharing and boosting, in competitive Multiplayer Online Battle Arena (MOBA) games like League of Legends. The authors note that "in competitive MOBA games such as League of Legends, match outcomes and rankings are the primary objectives, where individual performance is more critical than in-game economic factors. Accordingly, account misuse such as account sharing and boosting has emerged as a major threat to fair competition. The proposed approach analyzes and quantifies changes between a player’s historical and recent in-game behaviors, enabling robust identification of suspicious account sharing and boosting, even in label-scarce environments."

The method uses only server-side match logs collected via the Riot Games API from the Korean server, with 100 accounts having at least 35 matches each. The authors designed 12 derived features organized into five categories: champion selection pattern, position distribution, farming behavior, vision score, and combat participation behavior. For features varying significantly across positions, they applied role-based Z-score normalization to reduce structural bias. Behavioral fingerprints are constructed using a sliding-window framework, with a baseline window (20 matches) representing stable long-term behavior and a recent window (5 matches) capturing short-term shifts. The baseline window size was selected using TOPSIS, with the 20-match window achieving the highest closeness coefficient (C = 0.558).

Anomaly scores are computed as the Euclidean distance between their feature vectors of baseline and recent windows, after applying StandardScaler. The Kneedle algorithm applied to the empirical CDF of anomaly scores determined a data-driven threshold at score 4.62, corresponding to the top 15% of accounts. Validity verification confirmed that even the largest intra-account distance (3.293 for 5 vs. 35) remained substantially below the smallest inter-account distance (4.489 for 30 vs. 30), confirming a clear separation between the two distributions.

Results showed that among 100 accounts, 15 were classified as suspicious. For validation, 10 controlled behavioral-change accounts were introduced, where original owners intentionally altered gameplay style; 8 of the 10 controlled accounts (80%) exceeded the threshold. Feature-level analysis revealed that CS role z std and position distribution consistently exhibited the largest variation, emerging as primary indicators of a gameplay style shift.

The authors acknowledge limitations: experiments on 100 accounts may not ensure generalizability; the controlled setting may not fully capture real misuse; and the baseline window defined as the 20 matches immediately preceding the recent window may dilute detection for long-term persistent misuse. The approach is designed as a rapid triage tool where accounts exceeding the threshold are treated as suspicious candidates for further analysis, not as confirmed misuse cases.

Improvements to AI Systems:

1. Adaptive Behavioral Baseline Drift Detection: Enhance the AI to dynamically adjust the baseline window size (currently fixed at 20 matches) based on the player’s match history length and variance. Instead of a static TOPSIS-selected window, implement a meta-learning layer that selects the optimal baseline length per account, using the Kneedle-derived threshold as a prior. This improves detection of long-term persistent misuse (e.g., gradual boosting) that the current sliding window dilutes.

2. Role-Aware Multi-Modal Feature Fusion: Extend the 12 derived features by adding temporal sequence encodings (e.g., LSTM or Transformer over match sequences) for each of the five categories (champion selection, position, farming, vision, combat). The improved AI can learn non-linear interactions between features (e.g., how farming behavior shifts correlate with champion pool changes) beyond Euclidean distance, enabling detection of subtle, coordinated gameplay changes that linear distance misses.

3. Uncertainty-Aware Anomaly Scoring: Replace the single Euclidean distance threshold with a probabilistic model (e.g., Gaussian Process or Bayesian neural network) that outputs a confidence interval for each account’s anomaly score. The improved system can flag accounts with high score and high uncertainty as “needs manual review,” while accounts with high score and low uncertainty are auto-flagged as “likely misuse.” This reduces false positives from noisy short-term variance.

4. Cross-Account Transfer Learning for Label-Scarce Environments: Use the 15 suspicious and 10 controlled accounts as a small labeled set to fine-tune a pre-trained behavioral encoder (e.g., trained on all 100 accounts’ raw match logs). The improved AI can generalize to new servers or games (e.g., Dota 2) with minimal labeled data, by learning a shared representation of “gameplay style shift” that transfers across MOBA titles.

5. Temporal Decay and Recency Weighting: Modify the recent window (currently 5 matches) to apply exponential time-decay weights, giving more influence to the most recent matches. The improved system can detect rapid, short-term misuse (e.g., a booster playing 3 matches in one hour) while ignoring natural day-to-day variance, by combining the Kneedle threshold with a time-aware anomaly score.

6. Counterfactual Explanation Generation: Integrate a post-hoc explainability module (e.g., SHAP or LIME) that, for each flagged account, identifies which specific feature (e.g., CS role z std or position distribution) drove the anomaly. The improved AI can output human-readable reasons like “This account’s farming pattern deviated 2.3 standard deviations from its baseline, and champion pool shifted from mid-lane to jungle,” enabling faster human triage and reducing investigation time.

7. Adaptive Threshold via Online Learning: Replace the static Kneedle threshold (4.62) with a continuously updating threshold based on streaming account scores. The improved system can adjust to evolving game meta (e.g., new patches changing typical CS values) by re-running Kneedle on a rolling window of recent accounts, preventing drift in false-positive rates over time.

What the Improved AI System Can Do:

• Detect both abrupt and gradual account misuse (sharing, boosting) with higher recall, especially for long-term persistent cases missed by the original 20-match baseline.

• Provide calibrated confidence scores, allowing operators to prioritize high-certainty cases and avoid wasting resources on ambiguous ones.

• Transfer its learned behavioral fingerprints to new games or servers with only a handful of labeled examples, reducing deployment cost.

• Generate actionable, feature-level explanations for each flagged account, cutting manual review time from hours to minutes.

• Maintain stable detection accuracy across game patches and meta shifts by self-adjusting its threshold and baseline logic.