WO2006036100A1

WO2006036100A1 - Evaluation of possible fraud behavior in online games

Info

Publication number: WO2006036100A1
Application number: PCT/SE2005/001351
Authority: WO
Inventors: Björn Sperber; Christian Erlandsson
Original assignee: Bwin Games Ab
Priority date: 2004-09-29
Filing date: 2005-09-16
Publication date: 2006-04-06
Also published as: ES2341445T3; CY1110654T1; EP1642626A1; EP1642626B1; ATE457794T1; DE602004025574D1

Abstract

The present invention relates to a system and a method for evaluation of possible frau . behavior in online games, such as internet poker games, between at least two parties wit bets including valuables. A polling means fetches a plurality of input attributes for a specifi state in a game between at least two players, wherein the state demands a decision fro the players. The attributes and decisions taken are stored in a play array for each player. predetermined agent array is provided with attributes closest to represent the specific stat for each player and a conventional decision taken for the specific state for each player. map array is provided with a set of possible agent arrays for specific state arrays a attributes, subdividing the set in at least two subsets. Each subset determines a class for th play arrays and at least one subset classifies a play array as conventional behavior and least one subset classifies a play array as fraud behavior. A difference is determine between the play array and the agent array for each player through a comparator, and th difference is mapped on the map array positioned within one subset. Each player decision i classified in a subset during play, determining an individual player pattern over said subset ' The pattern comprises every decision taken by said individual player and determines said player as fraud if the corresponding pattern fits to a predetermined pattern of fraud behavior within said map array.

Description

Evaluation of possible fraud behavior in online games

Technical field

The present invention perπins to a system and method for evaluation of fraud behaviour in games with bets including valuables online between at least two parties through comparing player actions during a game state with the corresponding actions of a norm player agent for said state said agent being trained in norm playing tactics for a specific game type by analyzing earlier stored games of said type through at least one neural network

Background art The tradition of gambling goes way back in history In parts of central Europe North

America and Asia the casino culture has now grown to involve whole cities for this purpose only People are drawn to these havens of gambling both for the prospect of making fast and 'easy" money and for ihe sake of experiencing the unique settings and culture brought with them However, time, mobility and money are often required in order to get access to such gambling places For people coming from far away, a journey to, for instance Las Vegas could be quite an expensive affair As a fact, few gambling enthusiasts have the possibility to practice their hobby as often as they would wish

These drawbacks associated with casino gambling have probably been a major factor for the growing popularity of different online Internet casinos that has been popping up at an increasing rate during the last decade With the help of an Internet connected computer, enthusiasts can now gamble directly from within the confinement of their homes In this way expenses are cut, the gambling mainly incorporating gambling losses and possible casino charges, and the loss of time and money due to travel and planning activities are completely eliminated Most gambling on Internet casinos are performed man against the casino for example as with gambling on digital slot machines, digital roulette black jack etc and thus involve only one party having limited means of cheating the digital machine Other games involving gambling and betting between two or more parties online, such as card games e g poker, are much more susceptible to cheat and fraud behaviour The possibility of cheating at poker is different if the game is performed around a physical table or virtually online At Internet poker, it is for example almost impossible to predict or influence the cards to be dealt, which is possible in real casinos through the use of marked decks of cards, bribes and spying Internet poker on the other hand enables entirely new ways of cheating, since neither casino nor opponents have direct insight in the activities of the player It is also, for example, almost impossible to determine a conspiracy in a card game between physically remote participants Online poker on Internet casinos are currently frequently used for dubious activities such as money laundry, which of course is neither in the interest of the casino administrators not wanting to sanction criminal behaviour nor in the interest of honest gamblers suffering perhaps both from the pleasure of gambling being spoilt and monetary from this phenomenon. Furthermore, since Internet casinos manage peoples money on local accounts they assume the role as credit institution. This involves being liable to repay should it be found that deposited money was stolen. Hence such misdirected use of online poker could eventually, if allowed to continue unchallenged, provide an end to Internet card gambling as such. Dumping, for example, is a kind of money laundry where stolen money is gambled away through online poker and "laundered" earnings from poker wins are collected. In principle the fraud involves that stolen money, e.g. from credit cards, are transferred to an account on an Internet casino. The thief or dumper then deliberately looses to another account. This receiver account is owned and played by the thief himself or by a partner in crime, the so-called receiver. A special kind of dumping incorporating avoiding the loss from table fees takes on a very characteristic pattern, where the first betting round consists of one or more bets/raises followed by all participants except the receiver folding.

Dumping in Internet poker is also sometimes used by a . player as a method for managing multiple own accounts and it can also be utilized as a tool for settling debts between associates.

Collusion is another type of fraudulent behaviour and involves that gamblers use the greater opportunities for undetected co-operation, which is enabled through Internet casinos in comparison to real casinos. Two or more players at a poker table are able to exchange information about their hands of cards without their honest opponents being aware of this. Such information could be used for determining the worth of a hand of cards and to help raising the bets to high levels.

Both types of fraud mentioned above ruins honest players' fair chances of winning and their enjoyment of the game, and furthermore, as mentioned above, they involve a monetary risk for the casinos. Known systems for detection of fraud behaviour have been founded on analysing player data required for internet casino gambling, such as personal and contact data, which after being registered by the player is checked for validity by the casino. The correctness of this data together with the credit and transaction history of a player has then been weighed together with the average of win/loss per hand to form a partly functional model for the fraud character.

A problem with this system is that it is built on observations on a number of fraudster attributes, which in their design are both partial and static. A system built on a momentary image of the dumping character involves the risk that future fraudsters will act different to a degree not fitting within the profile of the system.

Therefore a more objective and time independent solution for detecting fraudsters is required, where more emphasis is put on analyzing players decisions and tactics during a game whilst the surrounding player data is of lesser importance in the analysis.

Summary of the disclosed invention

The present invention relates to a system and a method for evaluation of fraud behaviour in games with bets including valuables between at least two parties online an Internet casino. A virtual norm player model or agent is established for a certain type of game by analyzing the actions or moves performed by players at given game states in a multitude of previously played games of the same type, and Jhe agent is utilized in the system for comparing player actions at given states during a game with the corresponding actions according to the norm player agent as derived empirically for these states. The resulting difference for each action is added and normalised over all actions in the game to form a basis for evaluating and classifying the behaviour of the players graphically as normal or conventional or fraudulent depending on the degree of divergence from preset threshold values for norm piay according to the agent, after the game has been completed.

One object of the invention is to provide such a system and method, enabling an automatic evaluation and visualization of fraud behaviour in online gambling including bets, which is easily comprehensible by an observer.

To achieve aims and objectives the present invention provides a system for evaluation of possible fraud behavior in games with bets including valuables. The system comprises: a polling means, for fetching a plurality of input attributes for a specific state in a game between at least two players, the state demanding a decision from the players, and storing the attributes and decisions taken in a play array for each player; a predetermined agent array having attributes closest to represent the specific state for each player and a conventional decision taken for the specific state for each player; a map array, the map array having a set of possible agent arrays for specific state arrays as attributes, subdividing the set in at least two subsets; each subset determining a class for the play arrays at least one subset classifying a play array as conventional behavior and at least one subset classifying a play array as fraud behavior; a comparator, for determining a difference between the play array and the agent array for each player, the difference being mapped on the map array and being , positioned within one subset; and each player decision being classified in a subset during play, determining an individual player pattern over said subsets, said pattern comprising every decision taken by said individual player, and determining said player as fraud if the corresponding pattern fits to a predetermined pattern of fraud behavior within said map array.

In one embodiment of the present invention, the game is an online poker card game. Another embodiment of the invention defines that the input attributes comprise at least one of card data, betting round, position from dealer and earlier player moves.

Yet another embodiment of the invention defines that the map array is a^~pre-trained SOFM (Self Organized Feature Map) prepared with regions for classifying the behavior of said player, wherein at least one region corresponds to said agent array. In a further embodiment of the invention, the agent array is periodically updated, through the polling means, with the most recently finished games fitting within, the frame of normal behavior for an iterative training of the agent array in norm playing tactics.

A further embodiment of the invention defines that the map array is displayed on a digital screen with said regions visualized discrete. In an alternative embodiment of the invention, the agent array comprises at least one neural network trained on multiple previously played games through error back propagation.

An additional embodiment of the invention defines that a first, a second and a third mutually separate and structurally identical neural network of the kind fully connected, feed forward, multilayer perceptron is used for said agent array, each outputting a respective signal response corresponding to a degree of probability for fold, check/call and bet/raise respectively for a given state in the game, wherein the strongest signal of the three determines the move of the array for said state.

In yet a further embodiment of the invention, the difference for each game action is added and normalised over all actions in the game to form a basis for evaluating and classifying the behaviour of the players as normal or fraudulent depending on the degree of divergence from preset threshold values for norm play according to said agent array.

A still further embodiment of the invention defines that at least one of a number of further game attributes including at least economic net, number of played hands and number of highly divergent hands are considered in the evaluation.

Furthermore the present invention sets forth a method for evaluation of possible fraud behavior in network games with bets including valuables. It comprises the steps of: fetching a plurality of input attributes for a specific state in a game between at least two players, said state demanding a decision from said players, and storing said attributes and decisions taken in a play array for each player; providing a predetermined agent array having attributes closest to represent said specific state for each player and a conventional decision taken for said specific state for each player; providing a map array, said map array having a set of possible agent arrays for specific state arrays as attributes, subdividing said set in at least to subsets; each subset determining a class for said play arrays at least one subset classifying a play array as conventional behavior and at least one subset classifying a play array as fraud behavior; determining a difference between said play array and said agent array for each player, the difference being mapped on the map array and being positioned within one subset; and each player decision being classified in a subset during play, determining an

^'.individual player pattern over said subsets, said pattern comprising every decision taken by said individual player, and determining said player as fraud if the corresponding pattern fits to a predetermined pattern of fraud behavior within said map array.

The method of the present invention is able to perform method steps of the above network embodiments in accordance with attached method sub-claims.

Brief description of the drawings

Henceforth reference is had to the attached figures for a better understanding of the present invention and its examples and embodiments, wherein: Fig. 1 schematically depicts the distribution and names of the cards in a game of

Texas Hold'em between two players;

Fig. 2 schematically illustrates a player agent or model with separated state information, according to a preferred embodiment of the present invention.

Fig. 3 schematically illustrates a player agent or model with amalgamated state information.

Fig. 4 schematically illustrates a Self Organized Feature Map (SOFM) having predefined regions corresponding to normal and abnormal behaviour for player hands in a game of poker;

Fig. 5, according to one embodiment of the invention, illustrates a deployment of a system for evaluation of fraud behaviour in online games with bets between at least two parties. Fig. 6 depicts a flowchart of system events for evaluation of fraud behaviour in online games with bets between at least two parties, according to one embodiment of the invention.

Wordlist

A neura! network is a modeling technique based on the observed behavior of biological neurons and is used to mimic the performance of a system. In the context of this application it consists of a set of neurons, whose weights start out initialized with random values, and which, based upon operational feedback, are iteratively adjusted towards the values required to generate the required results. Multi Layer Perceptrons and Self Organizing Feature Maps are two different types of neural networks used in the present invention.

SOFM (Self Organized Feature Map) is a kind of neural network capable of grouping and visualizing large quantities of data covering 3 or more dimensions simultaneously over a 2D surface. A SOFM is usually utilized for dividing a set of data into .separate classes and to describe how these classes relate to each other. In the solution according to the present invention, a SOFM is instead utilized to force new data into an existing class and to describe graphically how well the new data vector fits in the class.

A perceptroπ model is built on an amount of in signals which, together with a weight for each in signal, are added together and transformed to an out signal through a transition function, for example through a formula such as:

y = f(w^τx)

where

x is a vector with in signals X₀... x_n, w is a vector with weights W₀... W_n, and y is the out signal from a perceptron computed through the function f(x).

Tables

Table 1 , according to the invention, schematically illustrates a card state representation for a deck of 52 cards having 104 values (1 or 0) in a game of Texas Hold^'em. Table 2, according to one embodiment of the invention, shows a card state vector for two closed cards in a poker game of Texas Hold^'em. Table 3 shows a card state vector for 5 open cards in a Texas Hold ^'em game, according to one embodiment of the invention.

Table 4 schematically illustrates a player state representation for a game of Texas Hold^'em according to the invention. Table 5 shows a first betting round in a game of poker between two people, also called heads up.

Detailed description of preferred embodiments

The present invention sets forth a system and a method for evaluation of possible fraud behavior in online games, such as internet poker games and the like card games, between at least two parties with bets including valuables.

To solve the problem of providing a functional system fpr evaluating fraud behavior in online games, a means for assessing the probability or normality of the actions or moves performed by a player during a game is needed. For a machine, such as a computer or computerized system, to be able to accomplish this, a model for probable or normal poker play is required, preferably in a piece of software, hardware components or a combination thereof. For a given state in a hand of poker the model should assess the probability of each possible move. By comparing the estimate of the model with the actual moves performed by a player it is possible to quantify the degree of normality of the player's tactics. The factor of divergence obtained through such an analysis of piayed hands serves as a strong indicator of the honesty of the player in further analysis.

A neural network model based on a single layer of perceptrons is only able to approximate simple functions and to classify linearly separable sets of data. Higher complexity approximation requires that the out signals from a row of perceptrons are forwarded as in signals to further rows of perceptrons. Such a neural network model, called a Multi Layer Perceptron model, can be extended to comprise an arbitrary number of layers with the capacity to approximate arbitrary functions. Classification of, problems which are not linearly separable also becomes possible with this model type.

In a preferred embodiment of the present invention, a player agent or agent array for probable poker play, and specifically for a certain type of poker game called Texas Hold^'em, is built based on database stored data of a multitude, perhaps as much as millions, of previously played hands of that game type. This enables building a player agent or agent array describing a norm player. The States and corresponding poker moves of the stored games are extracted or polled from the database, for empirical neural network training of a set of multilayer perceptrons. Each state is trained versus a known target value for each individual set of multilayer perceptrons, according to the well known supervised learning technique.

The player agent or agent, array can alternatively be directed at describing the optimal player, which theoretically is accomplished through neural network training based on rewards instead of on previously played games, for example by utilizing the well known TD (λ)-algorithm for reinforcement learning. The objective of the player agent trained through reinforcement learning can be directed towards maximizing the profit amount in a game, since most players are^< usually interested in winning large sums of money. Alternatively the training could be directed at maximizing the frequency of wins. The training is preferably performed utilizing a variant of an algorithm, well known for this purpose, called error .backpropagation, but other the like algorithms for training multilayer perceptrons can be used just as well. Backpropagation employs the just as well known delta rule connected in series from the last layer to the first. The delta rule enables training a perceptron to produce a certain out signal responding to a set of in signals and thus the perceptron functions as a classifier.

A non-linear transition function, such as the logistic sigmoid function,

/W = l + e^~

is, in the preferred embodiment of the present invention, utilized for enhancing the neural networks approximation ability. The logistic sigmoid function, which is continuous, has an out domain which is limited between 0 and 1 and is well suited for use in both hidden, i.e. in-between layers, and out signal layers.

Since the type of poker game called Texas Hold ^'em currently is one of the most popular poker variants, also on the internet casinos. This specific online card game type, which is played between at least two parties with bets including valuables, is the one referred to below in the evaluation of possible fraud behavior. However, other types of online card games, for example such as "seven card stud", are just as well suited for evaluation of possible fraud behavior with the solution according to the invention. The poker game of Texas Hold'em is played with a regular deck of 52 cards. One player is appointed dealer, whose job it is to deal closed cards to the other players, and to place open cards on the table. The cards are dealt clockwise beginning with the player directly to the left of the dealer. The task of being dealer is also shifted to the player sitting directly to the left of the current dealer when the current hand has been played. The game commences by the dealer dealing two cards each to every participant player. These two cards are called "the pocket cards" and shall be kept secret for the opponents. From these cards each player, in turn beginning with the player to the left of the dealer, can bet according to defined betting rules. After the first round of betting is completed, three open .cards are dealt to the table. These three cards are called "the flop" and can be used in combination with each of the players pocket cards to form a hand of poker. A second betting round then follows, where the players have the opportunity to use the information that became available through "the flop". A fourth open card, "the turn", is thereafter dealt and put on the table followed by yet a betting round. Finally the fifth and last open card, "the river", is dealt to the table and the betting can be completed in a fourth betting round. The distribution and names of the cards are schematically shown in Fig. 1. When all the cards have been dealt, all the remaining players, in clockwise order, can choose to either show their poker combination or to admit defeat. The best combination wins the game. The combinations, beginning with the worst, are High Card, Pair, Two Pairs, Three of a Kind, Straight, Flush, Full House, Four of a Kind, Straight Flush and Royal Straight Flush. Every move or action performed in a game of poker is based on the information or data available to the player at the time of the move. All such information or data put together constitutes the game state prior to each move. The game state in, for example a game of Texas Hold ^'em, is constituted of the player's closed and open cards, betting round, position from dealer, the player's previous moves and the opponents previous moves. The player agent or model shall generate an estimation and move based on the unique game state for every given moment in the card game. A state vector, which is unique for the given game state, is therefore established describing all the relevant details of the game process leading up to that particular moment.

In the preferred embodiment, a state representation for a Texas Hold^'em player agent is divided into two logic sections. The first section describes the card state and consists of 2 * 52 flag values (1 or 0), which represent the closed cards of the player, so called pocket cards, and the open table cards, so called community cards. Since the number of cards available per player is constant irrespective of the number of players, the card state vector always consists of 104 elements and can, according to one embodiment of the invention, have an appearance as shown in table 1 below.

The two closed cards: 2 of hearts and 5 of spades are described through a state vector according to table 2 below.

The state vector for the open cards is designed in the same way, for example as shown in table 3 below for the open cards: 4 of diamonds, 8 of clubs, ace of hearts, 3 of spades and ace of clubs.

The second state section, i.e. the player state, describes data on player position, betting round and previous bets. The number of player positions and the size of the bets are dependent on the number of players. Thereby the size of the second state vector varies with the number of players. The player state representation, where P is the number of players, then, in one embodiment of the invention, can have an appearance as shown in table 4 below. An example of how this state looks like for the first betting round in a game of poker between two people, also called heads up, is shown in table 5 below. The player is dealer and responds to the opponent calling his/her cards.

The player agent or agent array comprising neural networks, trained as described above, respond to game states with signals corresponding to the norm player's tendency to choose fold, check/call or bet/raise. For game states, which were included in the training sets of the neural networks, the out signal is an approximation of the average of the corresponding target values in the training sets. The thus achieved generalizing capabilities of the neural networks are utilized for other states to provide target values that correspond to similar states in the training sets. Fig. 2 schematically illustrates a player agent or agent array according to the preferred embodiment of the invention, comprising three neural networks, i.e. three structurally identical three layer perceptrons, one for each of respective game move fold, check/call and bet/raise, and is thus trained to respond with one of the respective moves corresponding to the move of a norm player for a given state in a Texas Hold ^'em game for example. The strongest out signal determines which move will be executed by the player agent or model for the given game state. In order to accomplish this, the three multilayer perceptrons rank the different moves based on a complete state vector or state array comprising amalgamated card state data and player state data.

Fig. 3 schematically illustrates a player agent or agent array, according to another embodiment of the invention, where the state underlying a move has been separated into two parts. The card state describes the player's own cards and the cards that are available on the table. The player state comprises game size or number of game participants, table position and the moves and bets made by the player and by the opponents. Through this distribution the state assessment can be distributed onto several multi layer perceptrons. In this embodiment of state representation of the player agent, a multilayer perceptron ranks the card state and the ranking is sent onwards to three further multilayer perceptrons. These three multilayer perceptrons rank fold, check/call and bet/raise respectively from the card ranking and the player state. Since the desired rank values for the individual states are unknown during training, this state representation is only useful when combined with reinforcement learning.

A separate neural network based player agent or agent array has to be trained for every sought after game type, size, i.e. number of participating players in a game, and betting structure, e.g. limit, pot limit, no limit etc, since both the appearance of the strategies and the dimension and composition of the state vectors or state arrays are dependent on these variables.

Instead of multilayer perceptrons, other mechanisms for value approximation, such as tile coding, can alternatively be used in the player agents or agent arrays. A heuristic model, based on manually specified rules could theoretically also serve as an alternative to neural network based models, given that proper rules describing the norm player could be formalized.

When analyzing poker hands of potential dumpers/receivers, the player moves or actions are compared with the moves suggested by the player agent, for example the three neural networks trained for the specific type of poker game. In cases when player moves differ from the moves of the agent, a scalar deviation is calculated as the difference between the out signals corresponding to the agent- and the player moves. The deviations, accumulated over all the moves of a hand and normalized over the number of moves, then represents a quantization of the probability of the player's strategy, where a small deviation means that the hand is normal and vice versa.

A few divergent hands do not necessarily imply dumping or receiving. For a better precision in the analysis, one embodiment of the invention comprises that the average of the difference of several hands is combined with other factors such as difference distribution, e.g. a few highly divergent hands or constantly divergent, cash flow analysis and how many opponents there are, their distribution and divergence.

The results from such analysis's or comparisons are, in the preferred embodiment of the invention, graphically visualized through a pre-trained map array such as, for example a SOFM. The map array or SOFM for this purpose has a graphical surface where every point on the surface corresponds to an attribute vector. The size of the attribute vector corresponds to the dimensionality of the data set to be projected thereon. A pattern from the set of data is matched against the attribute vectors of the map array or SOFM one by one. The attribute vector, which according to a set dimension represents the closest match pattern-wise, represents the position of that pattern in the map array or SOFM. Thus the map array or SOFM achieves the function of a classifier of analyzed players, i.e. their card hands, into different clusters or regions corresponding to, for example, normal or conventional and abnormal behaviour for player hands in a game of poker. Traditionally, the training of a SOFM is accomplished by computing, for each pattern in a training set, the corresponding position in the SOFM and iteratively making the attribute vectors in the area around the position more similar to the pattern. In order for the training algorithm to be applied to specific problems, measurements for similarity and regional neighborhood must be specified. For the training of the map array or SOFM utilized in the preferred embodiment, Euclidean distance is used as a measurement of the similarity between patterns and attribute vectors and Gauss functions are utilized for updating the . attribute vectors in each region. The training sets of the map array or SOFM according to the invention are constituted of manually selected sets of player hands, where both players of normal and "criminal" behavior of different types are represented. The surface of the map array or SOFM is thus prepared with regions or clusters of vectors each corresponding to players with different attributes as exemplified in Fig. 4, in which a player with, for example abnormal play and a big loss, is positioned in one region or cluster, whereas a player with normal play and a medium win is placed in another region or cluster. Fig. 5, in a block diagram, illustrates one embodiment of a deployed system 100 according to the invention, utilizing an agent array such as, for example software with a neural network pre-trained player agent or model according to the preferred embodiment described above, and a map array, for example software with a neural network pre-trained SOFM model according to the preferred embodiment described above, for detecting and visualizing fraud behavior in online gambling with bets, including valuables.

Online gamblers are connected through a PC to an Internet gambling site, to play a game of, for example, Texas Hold ^'em against one another for money or other valuables, through betting. Each player preferably logs onto the game through his/her individual player account, containing certain personal data required of the player in a registration procedure before gambling is allowed on the site. The individual data are preferably checked by game administrators for authenticity and against possible earlier records of misconduct, before allowing/stopping the player participating in an online game with bets. The individual player data as well as the data of the poker hands played through such a registered account are stored in a poker database 130. The poker hand data for each participating player comprises at least card state data, player state data and data on decisions taken for each state of the played hand arranged in a play array, which is individual for each player. Thereby each played hand of poker can be re-created and connected to individual player accounts for analysis of possible fraud behavior.

Such an analysis is in the preferred embodiment of the invention performed in one step. In an alternative embodiment it is performed in two steps.

The first analysis step comprises that a polling or fetching means in the analysis server 140 fetches the data or play array of a previously played hand of, for example, Texas Hold ^'em from database 130 storage for re-creating the game through the agent array or player agent via system comprised software. The player agent or agent array preferably being pre-trained according to the steps described above for said game type and size. The moves or actions of the agent array or player agent for the thus re-run game are then for each game state, through means for comparing, compared with those of the play array, comprising the actual moves or actions taken by the players at each game state, and a resulting scalar difference is, through a computing means, computed for each action or move. The deviance average and distribution of all moves in the hand is computed for each player and is mapped pattern-wise fitting within prepared regions on the map array, for example such as a SOFM, preferably according to the steps described above, wherein at least one region defines fraud behavior and at least one region normal behavior. The analysis is then stored in the analysis database 150.

The map array, for example the SOFM according to the embodiment shown in Fig. 4, as discussed above, thus receives the function as classifier of data as being able to classify players into the surface region of the map array or SOFM having the attribute data vector pattern most resembling the pattern of the data set originating from the above described comparison/analysis of an actually played hand with that of the agent array or player agent.

The map array or SOFM, according to one embodiment of the invention, distinguishes the fraudsters from the honest players graphically, for example digitally on the screen of a digital display, and is also able to visualize possible relations between players, such as the relationship between a dumper and a receiver. The game administrators are thus able to visually detect accounts, i.e. players, showing obvious fraud behavior in an online game of, for example Texas Hold ^'em, through their computed positions in the map array and are hence able to take appropriate measures against these for avoiding such as dumping/receiving and collusion behavior.

Step two of the analysis comprises that the result of step one also is combined with other data such as cash flow data, opponent data and any previously logged analysis results of each player fetched from database 150 through the polling means in the analysis server 140 for a more finely tuned computing of the position in the map array, according to the steps described above, for each player.

Human administrators can at any time inspect the results of the continuously ongoing analysis of individual players. By connecting a client instance 120, such as a web browser on a PC, to the application server 110, a network connection between the application server and its clients allows for the interactive inspection of analyzed players through a graphic rendering of the SOFM with the analyzed players plotted on the surface at their computed positions, as illustrated in Fig. 4.

Fig. 6, according to another embodiment of the invention, through a flowchart schematically shows system events for a continuous evaluation of fraud behaviour in an online game of Texas Hold^'em with bets between at least two parties, according to one embodiment of the invention. The poker database is, through system comprised software, queried for a newly played hand 210. If a new hand is not found, the system "sleeps" 290 or rests for set time

, period and thereafter queries the database once again, otherwise, the new hand found is, via a polling means, fetched from the database 220. The game is then reconstructed with corresponding agent arrays or player agents 230 and the game state is advanced 240. If there are player actions left, a state vector or state array is constructed for the current player

250. The player agent is then exposed to the state vector and the probability of fold, check/call and bet/raise actions or moves is computed 260. The scalar difference between the action preferred by the agent or model and the actual move taken is computed 270 through a comparator and the game model is updated with the actual move taken 280. The game state is again advanced 240. If there are no player actions left, the game is finished and the deviance average and distribution is computed for each player 300, through system comprised computing means. The cash flow and relations between participating players are computed 310 through said means and the accumulated values are combined with previously logged analysis of each player 320 and the positions in the map array, for example SOFM, are computed through said computing means for each player 330. The analysis is finally stored in an analysis database.

In accordance with the above teaching, the present invention comprises that a polling means fetches a plurality of input attributes for a specific state in a game between at least two players, wherein the state demands a decision from the players. The attributes and decisions taken are stored in a play array for each piayer. A predetermined agent array is arranged with attributes closest to represent the specific state for each player and a conventional decision taken for the specific state for each player. A map array is pre¬ arranged with a set of possible agent arrays for specific state arrays as attributes, subdividing the set in at least two subsets. Each subset determines a class for the play arrays and at least one subset classifies a play array as conventional behavior and at least one subset classifies a play array as fraud behavior. A comparator determines a difference between the play array and the agent array for each player and the difference is mapped on the map array positioned within one subset. Each player decision is classified in a subset during play, determining an individual player pattern over said subsets. The pattern comprises every decision taken by said individual player and determines said player as fraud if the corresponding pattern fits to a predetermined pattern of fraud behavior within the map array.

The input attributes can comprise at least one of card data, betting round, position from dealer and earlier player moves. The map array, for example such as a pre-trained SOFM, can be prepared with regions for classifying the behavior of said player. At least one region can then correspond to the agent array.

The agent array can comprise at least one neural network trained on multiple previously played games through error back propagation.

Through the polling means, the agent array can be iteratively trained in norm playing tactics through utilizing training sets with the most recently analyzed games fitting within the frame of normal behavior in the map array or SOFM, thus accomplishing a periodic updating and fine-tuning of the norm playing tactics of the agent array. A digital screen can preferably be used for displaying the map array with the regions and players visualized discrete. Alternatively the regions of the map array is visualized on another media, such as paper or the like printout media.

A first, a second and a third mutually separate and structurally identical neural network of the kind fully connected, feed forward, multilayer perceptron can be used for said agent array, each outputting a respective signal response corresponding to a degree of probability for fold, check/call and bet/raise respectively for a given state in the game, wherein the strongest signal of the three determines the move of the array for the state.

The difference for each game action can be added and normalised over all actions in the game to form a basis for evaluating and classifying the behaviour of the players as normal or fraudulent depending on the degree of divergence from preset threshold values for norm play according to the agent array.

At least one of a number of further game attributes including at least economic net, number of played hands and number of highly divergent hands can be considered in the evaluation or analysis. Means mentioned in the present description can be software means, hardware means or a combination of both.

The present invention has been described with non-limiting examples and embodiments. It is the attached set of claims that describe all possible embodiments for a person skilled in the art. Tables

Table 1 :

Pocket cards (52)

Community cards (52)

Table 2:

Table 3:

Table 4;

Po (P)

Table 5:

Meaning Value

Position 1 0 Position 2 1 Betting round 1 1 Betting round 2 0 Betting round 3 0 Betting round 4 0 Bet 1, player 1 Bet 2, player 0 Bet 3, player 0 Bet 4, player 0 Bet 1, opponent 1 1 Bet 2, opponent 1 0 Bet 3, opponent 1 0 Bet 4, opponent 1 0

Claims

1. A system for evaluation of possible fraud behavior in online games, with bets including valuables, said system comprising: a polling means, for fetching a plurality of input attributes for a specific state in a game between at least two players, said state demanding a decision from said players, and storing said attributes and decisions taken in a play array for each player; a predetermined agent array having attributes closest to represent said specific state for each player and a conventional decision taken for said specific state for each player; a map array, said map array having a set of possible agent arrays for specific state arrays as attributes, subdividing said set in at least two subsets;

. each subset determining a class for said play arrays at least one subset classifying a play array as conventional behavior and at least one subset classifying a play array as fraud behavior; a comparator, for determining a difference between said play array and said agent array for each player, the difference being mapped on the map array and being positioned within one subset; and each player decision being classified in a subset during play; determining an individual player pattern over said subsets, said pattern comprising every decision taken by said individual player, and determining said player as fraud if the corresponding pattern fits to a predetermined pattern of fraud behavior within said map array.

2. A system according to claim 1 , wherein said game is an online poker card game.

3. A system according to one of claims 1-2, wherein said input attributes comprise at least one of card data, betting round, betting rate and position from dealer.

4. A system according to one of claims 1-3, wherein said map array is a pre-trained

SOFM (Self Organized Feature Map) prepared with regions for classifying separate behavior of said player, wherein at least one region corresponds to said agent array.

5. A system according to claim 4, wherein said map array is displayed on a digital screen with said regions visualized discrete.

6. A system according to one of claims 1-5, wherein the agent array, through periodic polling via the polling means, is trained with the most recently finished games fitting within the frame of normal behavior for an iterative norm play tuning of the agent array.

7. A system according to one of claims 1-6, wherein the agent array comprises at least one neural network trained on multiple previously played games through error back propagation.

8. A system according to one of claims 1-7, wherein a first, a second and a third mutuaily separate and structurally identical neural network of the kind fully connected, feed forward, multilayer perceptron is used for said agent array, each outputting a respective signal response corresponding to a degree of probability for the moves fold, check/call and bet/raise respectively for a given state in the game, wherein the strongest signal of the three determines the move of the agent array for said state.

9. A system according to one of claims 1-8, wherein a difference for each game action is added and normalised over all actions in the game to form a basis for evaluating and classifying the behaviour of the players as normal or fraudulent depending on the degree of divergence from preset threshold values for norm play according to said agent array, .

10. A system according to one of claims 1-9, wherein at least one of a number of further game attributes including at least economic net, number of played hands and numbers of highly divergent hands are considered in the evaluation.

11. A method for evaluation of possible fraud behavior in online games with bets including valuables, comprising: fetching a plurality of input attributes for a specific state in a game between at least two players, said state demanding a decision from said players, and storing said attributes and decisions taken in a play array for each player; providing a predetermined agent array having attributes closest to represent said specific state for each player and a conventional decision taken for said specific state for each player; providing a map array, said map array having a set of possible agent arrays for specific state arrays as attributes, subdividing said set in at least two subsets; each subset determining a class for said play arrays at least one subset classifying a play array as conventional behavior and at least one subset classifying a play array as fraud behavior; determining a difference between said play array and said agent array for each player, the difference being mapped on the map array and being positioned within one subset; and each player decision being classified in a subset during play, determining an individual player pattern over said subsets, said pattern comprising every decision taken by said individual player, and determining said player as fraud if the corresponding pattern fits to a predetermined pattern of fraud behavior within said map array.

12. A method according to claim 11 , wherein said game is an online poker card game.

13. A method according to one of claims 11-12, wherein said input attributes comprise at least one of card data, betting round, betting rate and position from dealer.

14. A method according to one of claims 1 1-13, wherein said map array is a pre- trained SOFM (Self Organized Feature Map) prepared with regions for classifying separate behavior of said player, wherein at least one region corresponds to said agent array.

15. A method according to claim 14, wherein said map array is displayed on a digital screen with said regions visualized discrete.

16. A method according to one of claims 11-15, wherein the agent array, through periodic polling via the polling means, is trained with the most recently finished games fitting within the frame of normal behavior for an iterative norm play tuning of the agent array.

.

17. A method according to one of claims 11-16, wherein the agent array comprises at least one neural network trained on multiple previously played games through error back propagation.

18. A method according to one of claims 11-17, wherein first, a second and a third mutually separate and structurally identical neural network of the kind fully connected, feed ^■forward, multilayer perceptron is used for said agent array, each outputting a respective signal response corresponding to a degree of probability for the moves fold, check/call and bet/raise respectively for a given state in the game, wherein the strongest signal of the three determines the move of the agent array for said state.

19. A method according to one of claims 11-18, wherein a difference for each game action is added and normalised over all actions in the game to form a basis for evaluating and classifying the behaviour of the players as normal or fraudulent depending on the degree of divergence from preset threshold values for norm play according to said agent array.

20. A method according to one of claims 11-19, wherein at least one of a number of further game attributes including at least economic net, number of played hands and numbers of highly divergent hands are considered in the evaluation.