Detection of malicious games
Some implementations relate detection of malicious games. In some implementations, a computer-implemented method includes obtaining a list of games that includes a plurality of games, analyzing the plurality of games to identify at least one likely malicious game, and creating a ticket.
1. A computer-implemented method comprising:
obtaining, by a processor, a list of games, wherein the list includes a plurality of games, wherein obtaining the list of games comprises querying a database that stores one or more game sorts, and wherein the list of games includes unique games in the game sorts;
analyzing, by the processor, the plurality of games to identify at least one likely malicious game, wherein the analyzing comprises:
constructing regular expressions based on words from a description of each game; and
determining that the game is a likely malicious game if there is at least a partial match between the description and at least one of one or more keywords associated with known malicious games based on a comparison of the regular expressions to the one or more keywords associated with known malicious games; and
creating, by the processor, a ticket, wherein the ticket identifies the likely malicious game and includes one or more descriptors of the likely malicious game.
2. The computer-implemented method of claim 1 , further comprising, prior to creating the ticket, verifying that a predetermined time period has elapsed from a previous ticket creation time associated with the likely malicious game.
3. The computer-implemented method of claim 1 , further comprising removing the likely malicious game from the list of games; and after the removing, generating a user interface that includes one or more games from the list of games.
4. The computer-implemented method of claim 1 , wherein obtaining the list comprises retrieving names of the plurality of games that are currently being highlighted on a game platform.
5. The computer-implemented method of claim 1 , wherein the one or more keywords associated with known malicious games are generated using prior tickets that resulted in detection of a malicious game.
6. The computer-implemented method of claim 1 , wherein the one or more descriptors comprises a title of the likely malicious game, an owner of the likely malicious game, a link to an account of the owner of the likely malicious game, a uniform resource locator (URL) to the likely malicious game, number of upvotes or downvotes for the likely malicious game, and player count for the likely malicious game at a time of generation of the list of games.
7. The computer-implemented method of claim 1 , wherein analyzing the plurality of games to identify at least one likely malicious game further comprises comparing a profile parameter of each game of the plurality of games against a threshold profile, wherein the profile parameter is indicative of a rate of change of game popularity of the game.
8. A non-transitory computer-readable medium comprising instructions that, responsive to execution by a processing device, causes the processing device to perform operations comprising:
obtaining, by a processing device, a list of games, wherein the list includes a plurality of games, wherein the obtaining the list of games comprises querying a database that stores one or more game sorts, and wherein the list of games includes unique games in the game sorts;
analyzing, by the processing device, the plurality of games to identify at least one likely malicious game, wherein the analyzing comprises:
constructing regular expressions based on words from a description of each game; and
determining that the game is a likely malicious game if there is at least a partial match between the description and at least one of one or more keywords associated with known malicious games based on a comparison of the regular expressions to the one or more keywords associated with known malicious games; and
creating, by the processing device, a ticket, wherein the ticket identifies the likely malicious game and includes one or more descriptors of the likely malicious game.
9. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise, prior to creating the ticket, verifying that a predetermined time period has elapsed from a previous ticket creation time associated with the likely malicious game.
10. The non-transitory computer-readable medium of claim 8 , wherein obtaining the list comprises retrieving names of the plurality of games that are currently being highlighted on a game platform.
11. A computer-implemented method comprising:
obtaining, by a processor, a list of games, wherein the list includes a plurality of games, wherein obtaining the list of games comprises querying a database that stores one or more game sorts, and wherein the list of games includes unique games in the game sorts;
analyzing, by the processor, the list of games to identify a likely malicious game, wherein the analyzing the list comprises:
obtaining a profile parameter associated with each game, wherein the profile parameter is indicative of a rate of change of game popularity of the game; and
determining that the game is a likely malicious game if the profile parameter of the game meets a threshold profile parameter based on a comparison of the profile parameter with one or more threshold profile parameters; and
creating, by the processor, a ticket, wherein the ticket comprises the likely malicious game.
12. The computer-implemented method of claim 11 , further comprising, prior to creating the ticket, verifying that a predetermined time period has elapsed from a previous ticket creation time associated with the likely malicious game.
13. The computer-implemented method of claim 11 , further comprising removing the likely malicious game from the list of games; and after the removing, generating a user interface that includes one or more games from the list of games.
14. The computer-implemented method of claim 11 , wherein obtaining the list comprises retrieving names of the plurality of games that are currently being highlighted on a game platform.
15. The computer-implemented method of claim 11 , wherein the profile parameter comprises a measure of suddenness of appearance of the game on a list of popular games.
16. The computer-implemented method of claim 15 , wherein the profile parameter further comprises a measure of number of players associated with the game at a time of first appearance of the game on the list of popular games.
17. The computer-implemented method of claim 11 , wherein analyzing the list of games to identify the likely malicious game further comprises comparing words from a description associated with each game of the plurality of games to one or more keywords associated with known malicious games.
18. A system comprising:
a memory with instructions stored thereon; and
a processing device, coupled to the memory, the processing device configured to access the memory and execute the instructions, wherein the instructions cause the processing device to perform operations comprising:
obtaining, by the processing device, a list of games, wherein the list includes a plurality of games, wherein the obtaining the list of games comprises querying a database that stores one or more game sorts, and wherein the list of games includes unique games in the game sorts;
analyzing, by the processing device, the list of games to identify a likely malicious game, wherein the analyzing the list comprises:
obtaining a profile parameter associated with each game, wherein the profile parameter is indicative of a rate of change of game popularity of the game; and
determining that the game is a likely malicious game if the profile parameter of the game meets a threshold profile parameter based on a comparison of the profile parameter with one or more threshold profile parameters; and
creating, by the processing device, a ticket, wherein the ticket includes the likely malicious game.
19. The system of claim 18 , wherein analyzing the list further comprises comparing words from a description associated with each game of the plurality of games to one or more keywords associated with known malicious games.
20. The system of claim 19 , further comprising, prior to creating the ticket, verifying that a predetermined time period has elapsed from a previous ticket creation time associated with the likely malicious game.