# US 2021/0241576 A1 · Method to detect and counteract suspicious activity in an application environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0241576 A1 - Document ID: US20210241576A1 - Status: Published application - Kind: A1 - Application number: 17/237,233 - Filed: 2021-04-22 - Published: 2021-08-05 - Earliest claimed: 2019-02-28 - Assignees: AT&T Intellectual Property I, L.P. - Applicants: AT&T Intellectual Property I, L.P. - Inventors: Eric Zavesky; David Crawford Gibbon; Lee Begeja; Paul Triantafyllou; Bernard S. Renger - Web page: https://patentgrep.com/patent/US20210241576A1 ## CPC - G07F 17/3241: {Security aspects of a gaming system, e.g. detecting cheating, device integrity, surveillance (computer security G06F21/00)} - A63F 13/40: Processing input control signals of video game devices, e.g. signals generated by the player or derived from the environment - A63F 13/71: using secure communication between game devices and game servers, e.g. by encrypting game data or authenticating players - A63F 13/73: Authorising game programs or game devices, e.g. checking authenticity - A63F 13/75: Enforcing rules, e.g. detecting foul play or generating lists of cheating players - A63F 13/77: involving data related to game devices or game servers, e.g. configuration data, software version or amount of memory - A63F 13/79: involving player-related data, e.g. identities, accounts, preferences or play histories - A63F 2300/5586: for enforcing rights or rules, e.g. to prevent foul play - G07F: COIN-FREED OR LIKE APPARATUS (coin sorting G07D3/00; coin testing G07D5/00; {handling coins or paper currencies apart from payment activated apparatus G07D; payment architectures, schemes or protocols G06Q20/00}) - A63F: CARD, BOARD, OR ROULETTE GAMES; INDOOR GAMES USING SMALL MOVING PLAYING BODIES; VIDEO GAMES; GAMES NOT OTHERWISE PROVIDED FOR ## Abstract Aspects of the subject disclosure may include, for example, comparing an input received from a peripheral device associated with an execution of a gaming application with a threshold value, wherein the threshold value is based on a first identification of a first user, a second identification of the peripheral device, and a third identification of stimuli presented as part of the execution of the gaming application. Responsive to the comparing, a determination may be made that the input exceeds the threshold value. Responsive to the determination, a validation request may be transmitted to a user device of the first user. Other embodiments are disclosed. ## Claims ### Claim 1 A device, comprising: a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising: receiving a selection of an application included in a plurality of applications; presenting a simulation of an execution of the application to generate a model that is representative of a plurality of users and a plurality of input devices; obtaining a first identification of a first user of the plurality of users and a second identification of a first input device of the plurality of input devices associated with an execution of the application; executing the application subsequent to the obtaining the first identification and the second identification; receiving at least one input from the first input device during the executing of the application; responsive to the receiving of the at least one input, obtaining a validation request based on a comparison of the at least one input and the model; responsive to the receiving of the at least one input, polling at least one additional user; and determining a probability that the first user is engaging in an unauthorized activity based on the polling. ### Claim 2 (depends on 1) The device of claim 1, wherein the application is one of a gaming application, a voting application, a test taking application, or a finance application. ### Claim 3 (depends on 1) The device of claim 1, wherein the operations further comprise: responsive to the receiving of the at least one input, limiting an ability of the first user to engage in communication during the executing of the application. ### Claim 4 (depends on 1) The device of claim 1, wherein the operations further comprise: modifying the model based on the at least one input to generate a modified model; and applying the modified model during a subsequent execution of the application to determine whether the at least one input exceeds a threshold. ### Claim 5 (depends on 1) The device of claim 1, wherein the operations further comprise: presenting a validation request. ### Claim 6 (depends on 5) The device of claim 5, wherein the presenting of the validation request comprises presenting the validation request to the first user, and wherein the operations further comprise: receiving a response to the validation request from the first user. ### Claim 7 (depends on 5) The device of claim 5, wherein the presenting of the validation request comprises presenting the validation request to a component of the device, and wherein the operations further comprise: receiving a response to the validation request from the component, wherein the response to the validation request is not based on user input. ### Claim 8 (depends on 5) The device of claim 5, wherein the presenting of the validation request causes an activation of a sensor that monitors the first user, an environment where the first user is located, or a combination thereof. ### Claim 9 (depends on 1) The device of claim 1, wherein the operations further comprise: responsive to the receiving of the at least one input, limiting an ability of the first user to engage in communication during the executing of the application. ### Claim 10 A non-transitory, machine-readable medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising: receiving a selection of an application included in a plurality of applications; presenting a simulation of an execution of the application to generate a model that is representative of a plurality of users and a plurality of input devices; obtaining a first identification of a first user of the plurality of users and a second identification of a first input device of the plurality of input devices associated with an execution of the application; executing the application subsequent to the obtaining the first identification and the second identification; receiving at least one input from the first input device during the executing of the application; responsive to the receiving of the at least one input, obtaining a validation request based on a comparison of the at least one input and the model; responsive to the receiving of the at least one input, polling at least one additional user; and determining a probability that the first user is engaging in an unauthorized activity based on the polling. ### Claim 11 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the application is one of a gaming application, a voting application, a test taking application, or a finance application. ### Claim 12 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the operations further comprise: presenting the validation request to the first user; and receiving a response to the validation request from the first user. ### Claim 13 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the operations further comprise: causing an activation of at least one sensor responsive to obtaining the validation request, wherein the at least one sensor comprises a camera, a microphone, a biometric sensor, or a combination thereof. ### Claim 14 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the operations further comprise: performing an integrity test on a component of the first input device responsive to obtaining the validation request; and transmitting a result associated with the performing of the integrity test to a server, wherein the component is included in a gaming console, a peripheral device coupled to the gaming console, or a combination thereof, and wherein the validation request is based on a probability of cheating by a macro, hacked code, or software assistance exceeding a threshold. ### Claim 15 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the operations further comprise: responsive to the receiving of the at least one input, limiting an ability of the first user to engage in communication during the executing of the application. ### Claim 16 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the operations further comprise: monitoring traffic in a network; and identifying, in accordance with the monitoring, an abnormality in terms of a pattern or volume of data traversing the network exceeding a threshold. ### Claim 17 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the determining of the probability that the first user is engaging in an unauthorized activity comprises determining a probability that the first user is receiving unauthorized assistance from a second user. ### Claim 18 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the operations further comprise: responsive to the receiving of the at least one input, transmitting a message that causes a posting on a social media platform, wherein the posting identifies the first user and the application. ### Claim 19 A method, comprising: receiving, by a processing system including a processor, a selection of an application included in a plurality of applications; presenting, by the processing system, a simulation of an execution of the application to generate a model that is representative of a plurality of users and a plurality of input devices; obtaining, by the processing system, a first identification of a first user of the plurality of users and a second identification of a first input device of the plurality of input devices associated with an execution of the application; executing, by the processing system, the application subsequent to the obtaining the first identification and the second identification; receiving, by the processing system, at least one input from the first input device during the executing of the application; responsive to the receiving of the at least one input, obtaining, by the processing system, a validation request based on a comparison of the at least one input and the model; responsive to the receiving of the at least one input, polling, by the processing system, at least one additional user; and determining, by the processing system, a probability that the first user is engaging in an unauthorized activity based on the polling. ### Claim 20 (depends on 19) The method of claim 19, further comprising receiving, by the processing system, a response to the validation request, wherein the response comprises data originating from a sensor that monitors the first user, an environment where the first user is located, or a combination thereof, wherein the response comprises user feedback, and wherein the user feedback is based on a query included in the validation request.