No Silk Road for Online Gamers!: Using Social Network Analysis to Unveil Black Markets in Online Games

01/19/2018 ∙ by Eunjo Lee, et al. ∙ Soonchunhyang University 0

Online game involves a very large number of users who are interconnected and interact with each other via the Internet. We studied the characteristics of exchanging virtual goods with real money through processes called "real money trading (RMT)." This exchange might influence online game user behaviors and cause damage to the reputation of game companies. We examined in-game transactions to reveal RMT by constructing a social graph of virtual goods exchanges in an online game and identifying network communities of users. We analyzed approximately 6,000,000 transactions in a popular online game and inferred RMT transactions by comparing the RMT transactions crawled from an out-game market. Our findings are summarized as follows: (1) the size of the RMT market could be approximately estimated; (2) professional RMT providers typically form a specific network structure (either star-shape or chain) in the trading network, which can be used as a clue for tracing RMT transactions; and (3) the observed RMT market has evolved over time into a monopolized market with a small number of large-sized virtual goods providers.



There are no comments yet.


page 8

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1. Introduction

Online game is one of the most successful applications having a large number of users interacting in an online persistent virtual world through the Internet (Infiniti Research Limited, 2014). Particularly, a massively multi-online role playing game (MMORPG) is considered one of the most popular online game genres. For example, there were about 11.7 million subscribers playing World of Warcraft, one of the most popular MMORPGs (Lee and Chen, 2010). Users often compete against and/or collaborate with other users to complete given missions (called quest) while playing an MMORPG. Online game companies have typically created various virtual goods (referred to as “virtual currency” or “game items”) that are needed to enhance game character abilities. In most MMORPGs, virtual goods can legitimately be handed over from a user to another user as a trade or gift within the game. Similar to the real world, an economic system can be established in the virtual world so that virtual goods can be purchased, sold or exchanged between users (Castronova, 2001). Moreover, users who do not want spend much time in playing a game but are eager to level up their characters might spend their real money in buying virtual goods. Such demands have led to the emergence of the exchanging market of virtual goods with real money called “real money trading” (RMT) (Huhh, 2008). We note that RMT is different from “In-app purchase”, which refers to the activities to purchase virtual goods in an official store.

Although RMT itself is a reasonable economic activity, the overproduction and popularity of RMT could have a negative impact on the virtual economy and cause severe damage to the reputation of the MMOPRG. In practice, professional cyber criminals known as a gold farming group (GFG)—a group of users running multiple client programs for MMORPGs on numerous machines to efficiently collect virtual goods—started to get involved in RMT transactions in a well-organized manner. Naturally, such activities by a GFG could discourage normal users from playing MMORPGs because their efforts are not properly rewarded (Fujita et al., 2011) and the game company experiences monetary damage as a result (Castronova, 2007). Furthermore, RMT is often associated with other criminal activities, such as money laundering (Digital, 2008), identity theft (Woo et al., 2012) and cheating (Chen et al., 2005). Because of the double-sidedness of RMT, many online game companies have defined a policy to officially prevent RMT while some companies have launched an official RMT service (Orland, 2017).

Besides, it is also important issue to monitor volumes and trends of RMT. RMT presents the potential revenue which online game company may get from In-app purchase. Consequently, the analysis of RMT could be used as important data for identifying potential consumers of virtual goods in the official market, understanding user preferences for virtual goods and managing the price of the virtual goods (Lehdonvirta, 2008).

However, it is challenging to correctly identify RMT transactions from a very large dataset in an MMORPG. When a user hands over a virtual item to another user for RMT, it is difficult to distinguish such an activity from legitimate activities (e.g., sending a virtual item to a friend as a gift). Further, players use the real money market outside the virtual world, so it is difficult to exactly match user identities in the real money market with accounts in the virtual world.

To address those challenging issues, we focused on analyzing communities of users in a virtual goods trading network instead of individual RMT transactions between users. Game users, who are consumers in RMT, usually trade virtual goods with their friends and acquaintances rather than strangers, and as such, form a highly clustered structure in a virtual goods trading network. Moreover, previous studies (Keegan et al., 2010; Woo et al., 2011) demonstrated that members in a GFG, who are main providers in RMT, are also likely to form a separate community in a virtual goods trading network because a GFG member is obligated to frequently perform trading activities with another member in the same GFG. That is, the trading activities between different communities, especially provider communities and consumer communities, may represent RMT transactions, while the trading activities between users within a community may represent legitimate trading activities.

Recent advances in the field of social network analysis provided us with the fundamental tools to detect communities in a network and understand their characteristics better. We used approximately 6,000,000 virtual goods trading transactions between April 2015 and June 2016, collected from more than 200,000 users in Lineage111, one of the most popular MMORPGs in Korea, to construct a virtual goods trading network. We analyzed its key characteristics utilizing nodes to represent users and edges to represent trading transactions (e.g., sending an item) between users, respectively. Our key contributions are summarized as follows:

First, we detected RMT groups and estimated the size of RMT market (e.g., the number of RMT transactions) in an online game using community detection algorithms in a virtual goods trading network and evaluated our estimation with the dataset crawled from two real world RMT websites. This is a significant advancement from previous literature (Fujita et al., 2011) because we divided a given communities into more fine-grained categories based on network structure, and analyzed users’ play styles and in-game economic activities to identify the target groups accurately while the previous study used trade activities only.

Seconds, we analyzed the key characteristics of the network structure and found that star-shaped and chained structures were typically formed for professional RMT provider groups.

Third, we analyzed the dynamics of virtual goods trading behaviors over time. We constructed weekly trading networks from virtual goods trading transactions during a year. We then demonstrated how a virtual goods trading network grows and changes over time by visualizing the temporal changes of the network. Finally, we observed that the market has evolved into a monopolized market with a small number of RMT provider groups.

2. RMT Flow

RMT is an interesting economic activity because it is used to exchange assets in a virtual world with real world value (Huhh, 2008). As a result of increasing demands from users for trading virtual goods, RMT markets have naturally become popular in recent years, although RMT is prohibited in most online game companies (Heeks, 2010). In addition, by the nature of the black market, professional criminals (i.e., GFG) have, in turn, materialized in the RMT market (Heeks, 2008). The size of the RMT market is getting larger and larger, and now, is becoming a new industrial market. To summarize, the overproduction of RMT is one of the serious problems that can cause imbalance of game economy and inequality of wealth and opportunity. It exploits the economic safety system and destroy the overall design of player’s growth model.

Fig. 1 briefly describes how GFG is organized and connected to consumers for RMT. A typical GFG consists of a few bankers and many gold farmers in a hierarchical manner (Kwon et al., 2013). A gold farmer is an entity working full time playing online games in order to harvest virtual goods by using automated programs (e.g., game bots and macros) or by hiring low-cost laborers (Lee et al., 2016). Several gold farmers work together as a team to accomplish challenging tasks such as hunting a gigantic monster. A banker is an entity who gathers virtual goods from the gold farmers in his or her own GFG and sells it to online customers.

Brokers have emerged with the growing popularity of commercial MMORPGs (e.g., “Ultima Online”, “World of Warcraft” and “Lineage”). There are two types of brokers in the RMT transactions. One is an in-game broker who performs intermediate trades between GFGs and customers inside the virtual world. Another is a real world broker (i.e., RMT website) who advertises massive quantities of virtual goods to customers and provides a reliable payment system (e.g., escrow). In most cases, brokers receive a commission from the sellers or buyers in RMT.

Figure 1. Typical flow of cash and virtual goods for RMT.

3. Dataset

We use a dataset of Lineage, which is released by NCSOFT, in this study. It is a popular MMORPG in Korea with a long history, and it has also English, Chinese and Japaneses versions. Various activities performed by the user in the virtual world or state change events are recorded in the form of a structured log through the game server in Lineage. The game log consists of the following information.

  • [leftmargin=.5cm]

  • Time: When a specific activity or event occurs

  • Location: Where a specific activity or event occurs

  • User information: the user’s character ID, level, job and race, etc.

  • Event ID: An ID that identifies the type of activity (hunting, trading, item acquisition, dungeon entry, etc.) or event type (level up, game money increasing or decreasing, etc.)

  • Target user information: The other character information if the log is related to the interaction with another user

  • Detailed information: Depending on each activity type or event type, detailed information related to the activity type or event type

Specifically, we used the game activity logs of more than 200,000 users from April 2015 to June 2016.

4. Trade Network Analysis for RMT Detection

We propose a framework highlighting five phases to detect RMT: (1) Given a set of virtual goods transactions in game log files, we construct a virtual goods trading network, and then find community structures in the constructed network; (2) Using the characteristics of the structure of the community, we categorize the communities into five groups; (3) We categorize game users into seven groups by play style in virtual world; (4) After analyzing the network characteristics of each community type and behavior types of users belonging to the community, we diagnose abnormal communities and detect suspected RMT group. The community groups are tagged into provider type, consumer type and non-RMT type; (5) When we classify communities into provider, consumer and others groups, transactions between provider and consumer communities are filtered out as RMT.

4.1. Construction of a virtual goods trading network and community detection

In general, there are two types of trades in online games: (1) direct trade and (2) indirect trade, by which one deposits goods in the warehouse and then another retrieves it.

Given a set of trade transactions in an online game, we construct a weighted directed network called “virtual goods trading network”. In this network, a node represents a character (i.e., account) or a warehouse and an edge represents a virtual goods trade. The weight of an edge reflects the number of trades between them. We constructed a virtual goods trading network on a weekly basis because Lineage has a weekly shutdown for its content updates and server maintenance.

Lineage operates several game servers. Although a user has several characters, one character should play on one game server. All servers are disconnected, and all characters can trade items with just others in the same server. Among fifty operating game servers in Lineage, we chose one server in which RMT appears to be the most active. From the game logs in the server, we constructed a virtual goods trading network. Table 1 summarizes some basic properties of the constructed virtual goods trading network.

Feature Value Feature Value
# of nodes 25,633 degree mean 2.125
# of edges 36,598 degree std. 10.8338
average path length 8.8283 betweenness mean 31,709
clustering coefficient 0.001989 betweenness std. 464,528
Table 1. Summary of network characteristics of virtual goods trading network.

When a virtual goods trading network is established, we try to find communities in the trading network where nodes in a community construct denser relationships than between nodes in the remaining communities. This is a reasonable technique to detect suspicious trading behaviors—people usually trade virtual goods with their friends and acquaintances rather than strangers, and thus form a highly clustered structure in a virtual goods trading network.

To achieve this here, we tested five community detection algorithms (‘multilevel (Blondel et al., 2008)’, ‘fastgreedy (Clauset et al., 2004)’, ‘walk trap (Pons and Latapy, 2005)’, ‘label propagation (Raghavan et al., 2007)’ and ‘infomap (Rosvall and Bergstrom, 2008)’) and compared their performances based on the modularity that is a quantity that represents how well communities are constructed (Clauset et al., 2004). As more densely connected communities are formed, the modularity closes to one.

From the results of modularity tests, we selected the ‘multilevel’ algorithm. This algorithm has the highest modularity value (see Table 2).

Algorithm Modularity
Min. Avg. Max.
multilevel 0.73 0.97 0.99
fast greedy 0.71 0.96 0.99
walk trap 0.61 0.75 0.87
label propagation 0.61 0.91 0.96
infomap 0.66 0.91 0.94
Table 2. Comparison of community detection algorithms in terms of modularity.
(a) Total network (b) Type 1
(a) Type 2 (b) Type 3
(c) Type 4 (d) Type 5
Figure 2. Visualization of community types
(a) Community size (b) Radius
(c) Degree assortativity (d) STD of degree
Figure 3. Network characteristics of community types.

4.2. Community grouping by network structure

When community structures are found in a trading network, we categorize those communities into several interesting groups by their network statistics using the -means clustering algorithm. We used the following statistics:

Mean and standard deviation of degree centrality.  

The degree is the number of connections that a node has to other nodes. The degree of the community characterizes the network in such a way that the average degree is closely related with the network density and the standard deviation shows how evenly the degree centrality is distributed, in other words, centralization of the network.

Mean and standard deviation of betweenness.   We adopt the betweenness centrality to show the centralization in terms of information flow. The betweenness centrality of the node implies the ability to broker between groups. The betweenness centrality of a node is calculated as the number of shortest paths from all nodes to others through the target node. These statistical features imply that many members have the capability to efficiently deliver the asset or information within the community.

Degree assortativity coefficient.   Degree assortativity is a preference of the node to attach to others that are similar in terms of degree. The value will be close to one if two or more connected nodes have the same degree, or negative one otherwise.

Clustering coefficient.   A clustering coefficient is a measure of the likelihood that three nodes will become fully connected and form a clique. We adopt the clustering coefficient as a measure of the property that all members in the community have a trade-relationship with each other.

Radius.   The radius is the longest distance path from all paths between nodes in the community. This metric shows how long it takes to deliver information or assets to all members in a community.

Community size.   To characterize the community in their scale, we use the number of nodes in a community to derive the community size.

According to our experiments, trading communities are clustered into five groups. Table 3 shows the number of communities and the ratio of community members in the total number of users participating in the virtual goods trading by community type (type 1, 2, 3, 4 and 5). Fig. 2 shows a visualization of the five categorized communities. We derive unique network topology by clustering communities in terms of network statistics as mentioned above. Fig. 3 shows the differences in the network statistics by community types.

Type 1 2 3 4 5
# of community 1 19 732 104 471
Member rate 10.21% 37.00% 33.38% 15.62% 3.78%
Table 3. Community count and community member’s rate for community types

4.3. User grouping by play style

To further characterize communities, we investigate users’ play style per communities. We summarized users’ play data using features which are described in table 4 and categorized users into seven groups by play style using -means clustering algorithm (see Table 5). Table 6 shows the proportions of user play styles in each community type.

No. Feature

Play time (unit: second)


The number of days a user plays


The amount of experience a user obtains


The number of death


The number of combats against another player


The number of combats against monster


The number of dungeons a user plays


The number of parties a user joins


The number of an item was enchanted by a user


The number of an item was traded with another user


The amount of game money a user gets from other users


The amount of game money a user gives to other users


The amount of money a user obtains


The amount of money a user spends


The amount of time a user spends for fishing


The amount of time a user spends for shopping

Table 4. Features for user clustering.
Play style Description
Fisher users who focus to play for fishing contents
Genuine users who enjoy various contents
Hard core users who have very high play time and
various activities extremely
Light users who have low play time and activities
Party users who focus to party-activities
Shop host users who play shop activities heavily
Worker users who concentrate on activities for
earning game money, i.e., hunting, harvesting
Table 5. Categorization of users by play style.
Play style Type 1 Type 2 Type 3 Type 4 Type 5
Fisher 13.12% 0.01% 3.83% 0.14% 16.73%
Genuine 46.67% 0.07% 18.42% 0.54% 31.99%
Hard core 0.55% 0.14% 0.22% 0.32% 0.40%
Light 21.69% 75.25% 25.79% 0.30% 26.37%
Party 2.43% 0.00% 5.97% 0.16% 2.81%
Shop host 14.21% 24.33% 21.87% 98.54% 21.15%
Worker 1.32% 0.20% 23.89% 0.00% 0.54%
Table 6. Proportions of users’ play styles in each community type.

4.4. RMT group detection

After clustering communities and users, we compare users’ in-game economic activities and the proportion of types of users in each community type.

According to the previous study (Heeks, 2009), providers have a unique play style to achieve efficiency. Thus, the analysis on play styles could be used to detect RMT providers and consumers (see Table 6). We also analyze users’ in-game economic activities in each community type (see Fig. 4). In most cases, the purpose of RMT providers is only to make money so they did not pay to game companies, while consumers often pay to game company for their fun. Consequently, the differences in the amount of economic activities could be used to categorize community types into consumer group and provider group. The users in normal communities buy items from RMT providers, thus we call the normal community the consumer community. Based on the results in Table 6 and Fig. 4, we will explain the main characteristics of each community type and discriminate communities into types in the following sections.

(a) Play time (b) Hourly income
(c) Payment to company (d) Earning rate/consuming
(e) In-game asset (f) In-game shop activity
Figure 4. Users’ in-game economic activities by community types.

4.4.1. Type 1: giant component

The members in this type comprise the largest community (see Fig. 3(a)) and have the most inter-community trades (see the center node in Fig. 5

). Particularly, the giant component has characteristics of a scale-free network by which degree distribution follows a power-law. In a scale-free network, the probability distribution of degree complies with Eq. 



According to this test for the community of type 1, for giant component ranged from 2.7 to 2.8.

The giant component also has the most ‘genuine’ players who enjoy various game contents (see Table 6), and pay the most to the game company among communities (see Fig. 4(c)). From above observations, we conclude that this community is naturally formed from normal users’ trades and is a consumer group in RMT.

4.4.2. Type 2: large star-shaped network

This type is a community in which a few nodes are in the center and remaining nodes trade only with center nodes. The degree of most nodes is one or two, while the degree of the center nodes is in the hundreds. Consequently, the standard deviation of the degree in this type is very high, while degree assortativity is close to -1 (see Fig. 3(c) and (d)). Previous studies (Kwon et al., 2013; Woo et al., 2011; Kwon et al., 2017) showed that gold farming groups tend to construct communities similar to this type. The reasoning why this type is a gold farming group follows. Gold farmers repeatedly earn game money and items. Collected items and game money are delivered to merchant characters, and the merchant characters sell the items for game money. The game money from gold farmers and the money acquired through item trade by a merchant character flow to banking characters (Kwon et al., 2017). From this point of view, the center node is a banker whose role is to gather and store virtual assets for GFGs.

Characters in these communities focus on producing virtual assets, however, do not consume the virtual asset in their play as shown in Fig. 4(d)222. However, they do not possess many assets because they frequently send bankers or consumers their production (see Fig. 4(e)). Moreover, their payment for the game company is lower than other communities because their purpose of game playing is economic income by their labor, not entertainment (see Fig. 4(c)).

These communities are mainly composed of ‘Shop host’ and ‘Light’ type users. ‘Shop host’ users are merchant characters and ‘Light’ users are gold farmers, who have a short play time to avoid game bot detection. They conforms peripheral nodes from the perspective of the network structure in Fig. 2 (c).

4.4.3. Type 3: small star-shaped network

The network structure of type 3 is similar to type 2, but its size is smaller than type 2. The interesting point is that the play style of this type is different from type 2 in terms of play time and productivity even though the network structure is similar to type 2. This type consists of players with more various play styles than type 2 (see Table 6). In the economic point of view, type 3 seems to be less efficient than type 2. Type 2 pays less for the game company, however, produces more income than type 3. That is, users in the large star earn more game money hourly with less play time and cost (see Fig. 4(a), (b) and (c)). Besides, the total revenue of type 2 is much higher than type 3. Consequently, we guess that communities of type 3 are unspecialized and immature RMT providers, while communities of type 2 are professional organizations.

4.4.4. Type 4: chain network

The criminal network is organized to balance efficiency and security (Morselli et al., 2007). The centralized network has a high efficiency, but weak for targeted attack  (Albert et al., 2000). According to previous works, decentralization has also been observed to be a key tactic adopted by members of a criminal network to reduce the risk of targeting and asset confiscation  (Morselli and Petit, 2007). We could also observe this decentralization in MMORPGs.

This type is a very different structure from the star network and looks like peer-to-peer network. Most nodes in this community have one or two degrees, and their connections construct a long circular chain. A node in this type sends all items to another node and then, after a time the receiving node sends all of these assets back to the other. These trading activities form a circular chain. Consequently, these communities have a high radius and degree assortativity (see Fig. 3(b) and (c)). Regarding economic activities, the characters’ focus is on playing for a long time (see Fig. 4(a)), however, they exclude producing or consuming activities (see Fig. 4(b) and (d)). Moreover, they pay minimal amounts to the game company (see Fig. 4(c)). They mostly perform an in-game shop activity primarily buying or selling items to other characters in the virtual world (see Fig. 4(f)). Based on these observations, we could conclude this group is an abnormal group.

We discovered that these are arbitrage groups, who realize profit from buying virtual items and selling them back. They possess a large amount of assets in order to buy bulky items at a low price, thus this type of community accounts for the largest asset portions in the game world (see Fig. 4(e)). This unique type community also appears because of the game rule.

In MMORPGs, the cost to buy and sell items, i.e., real estate rental fee, wages, distribution costs, etc, is minimal. Consequently, a player can easily make money from arbitrage if enough in-game currency and time is available. However, there is one limit for arbitrage in Lineage. Lineage imposes a duty on characters if they participate in shop activity more than forty times in a week to prevent massive in-game shop activities. Eventually, a character in an arbitrage group does hit the shop activity limit and sends another character all the virtual goods obtained. The character receiving the goods continues with the arbitrage. After a week, the original character receives all items and returns to arbitrage. Consequently, the chain network is constructed to reduce the risk of target banning by the game company and avoid the constraint on economic activities. We could conclude that these communities are RMT providers as well, because they play to get a benefit like GFG.

4.4.5. Type 5: outcast communities

The play style of this type is similar to that in type 1 (see Fig. 4 and Table. 6). However, users in this community have trades with only one or two friends. We conclude that users in this type are normal users who limit their social relationship regarding trading. We filtered out their trades from our estimation.

4.4.6. Evaluation of RMT group detection

Based on the analysis of this step, we could detect abnormal community types and name abnormal communities as provider of RMT by network structure. To evaluate the detecting result, we measured the rate of users who were banned by using game bot among users belonging to each community type. Table 7 shows that RMT provider groups have more banning users than other groups.

Type 1 Type 2 Type 3 Type 4 Type 5
10.05% 65.60% 23.01% 10.64% 7.64%
Table 7. The rate of banning users by community types

4.5. RMT Estimation

In this step, we built the inter-community trading network where nodes and edges represent communities and inter-community trade transactions, respectively (see Fig. 5). After that, we extracted trading transactions between provider communities and consumer communities as RMT, which reaches 5% of the total transactions.

Figure 5. Inter-community trading network with nodes (communities) and edges (inter-community trade transactions).

To compare with the RMT estimation, we crawled publicly accessible RMT records between May 2015 and June 2016 from two popular RMT websites (ItemBay333 and ItemMania444 According to the web traffic ranking website named Rankey555, ItemBay and ItemMania dominate the Korean RMT market, with approximately 90% of the total traffic volume for RMT websites in Korea. A typical RMT record is composed of unit price, trade volume, game server and trade completion time.

The best way to evaluate the performance of our estimation is to measure the precision and recall rates using the real RMT records at RMT websites as the ground truth. When real transaction records are not accessible, we can only approximate RMT transactions by articles posted in RMT sites, but the approximation naturally has error because of following reasons.

First, the trading time in RMT websites and in the game world does not exactly coincide because the trades take place in the virtual world and real world at different times. To minimize the error from this, we used weekly based time window. If we use small time windows (e.g. daily based, or hourly based) then it can miss RMT record occurred in the very next time period. Setting long-term time window for the analysis can increase the possibility of including RMT events occurred in a short time difference.

Second, the actual transaction volume is not precisely equal to the volume posted on the RMT website. The volume in the article is the maximum amount that the seller wants to trade, however, most customers buy only part of it. We do not have the exact information available on the transaction volume in the RMT website.

Third, there is no confirmation that the user in RMT websites is the same user in the game even if they used the same user name.

As an alternative to the problem, we computed the correlation coefficient of weekly trade transactions between the RMT transactions estimated by the proposed method and those of real RMT records at RMT websites.

For our analysis, we categorized trades into three categories as follows:

Intra.   The trades between users in an identical community.

Inter.   The trades between users in different communities.

Inter (RMT).   The trades between RMT providers and consumers.

As we might expect, the trade transactions of “Inter (RMT)” and RMT websites have a statistically significant correlation, while the correlation coefficients for other categorized transactions do not (see Table 8).

Intra -0.1280 0.3754
Inter 0.0082 0.9534
Inter (RMT) 0.4722 0.000468***
Table 8. Correlation coefficient of the number of transactions per week with RMT websites (*: 0.05, **: 0.01, ***: 0.001).

5. Measurement study of RMT

5.1. Volume of RMT

As we mentioned in the previous section, the volume of transactions crawled from RMT websites could overestimate the real transactions.

Category Intra Inter (RMT) RMT website
Min. 1 50,000 500,000
1st Qu. 25,290 5,000,000 11,000,000
Median 1,500,000 12,000,000 30,000,000
3rd Qu. 6,315,000 32,620,000 54,380,000
Max. 1,276,000,000 300,000,000 860,000,000
Mean 10,310,000 28,520,000 57,640,000
STD 36,335,270 44,811,145 95,322,270
Table 9.

Volume of virtual goods per transaction (Qu.: Quartile, unit: game money).

Figure 6. CDF of the volume of virtual goods per a transaction of inter-RMT and RMT website(left: original data, right: normalized data).
Figure 7. histogram of the weekly sales per game account of RMT provider.

To get information on RMT volume, we analyzed the distribution of individual transaction volume. The actual RMT transaction volume from our estimation reaches approximately 40% of the transaction volume in RMT websites (see Table 9). Fig. 6 shows that the distribution of the transaction volume in the RMT websites is close to the distribution of our RMT estimation if we perform the median normalization for the transaction volume in RMT websites.

The RMT website shows a cash price for the game money, so we can use it to estimate the volume of seller’s sales. According to our estimations, the total volume of RMT for Lineage is approximately sixty millions USD per year. This is equivalent to about 25% of Lineage’s annual sales in 2014. The seller’s average weekly sales is about 209 USD (see Fig. 7). Among the things that we have seen, the highest total volume per game account recorded sales of about half million USD per year. Given the fact that RMT providers usually operate multiple game accounts, the actual average sales per RMT provider are likely to be larger.

5.2. Monopoly of RMT market

In this section, we analyze how the RMT market changes over time. Lineage consists of multiple servers; each server manages its own virtual world with different history. The oldest world has been in service for eighteen years while the youngest world has been in service for only half a year. Interestingly, we can see that the structures of trading networks in those servers are significantly different with elapsed time.

(a) Young server (b) Old server
Figure 8. Comparison of network structures between young server and old server.

In Fig. 8, we can observe that many provider communities compete with each other for an extensive consumer community in the young server (see Fig. 8(a)) while a few extra-large provider communities monopolize RMT in the old server (see the red circle in Fig. 8(b)).

To analyze the temporal characteristics of virtual goods trading networks, we traced its dynamic variations for a year (see Fig. 9).

Figure 9. Dynamics of a virtual goods trading network over time.
Figure 10.

Examples of oddly-shaped providers at old servers on Lineage.

In the beginning, there exist many scattered local consumer communities due to that a large number of new users join and existing users leave the MMORPG; small-sized provider communities appear too. As time passes, the provider communities grew bigger and bigger. After a certain time interval, RMT consumption, which was boomed excessively in the beginning, decreases and a significant number of providers become extinct. After this period, a few extra-large provider communities, survivors, emerge. Finally, “winner-takes-all” phenomena (with a small number of well-organized providers only) could be observed in the RMT market of online games. In the process, we found several extremely large communities having an hierarchical structure (see Fig. 10). In the hierarchical network structure, nodes are divided into groups that are subdivided into smaller groups. According to Clauset, Moore and Newman’s work  (Clauset et al., 2008) and Xu and Chen’s work  (Xu and Chen, 2005), a network of association between terrorists has a hierarchical structure. The hierarchical structure with many subgroups are effective to deliver the order from a central node and also minimizes the risk of network being collapsed even though one of subgroups are detected. The emergence of hierarchical structure indicates that the RMT provider communities become more systematically organized and at the same time, to minimize the risk of revealing.

5.3. RMT network in other games

To generalize our approach and findings from a game, Lineage, we applied our method to other similar genre games. Fig. 11 is a visualization of the trading network in Aion and Blade and Soul, which are other famous MMORPGs of NCSOFT. Fig. 11 shows that star-shaped communities, which are suspected as RMT providers, also are discovered in trading networks of the games. We will apply our methodology to other games’ dataset in future work.

(a) Aion (b) Blade and Soul
Figure 11. Virtual goods trading networks in other MMORPGs

6. Ethical considerations

Before installation of a game client program, participants were asked to acknowledge a consent form under the end user license agreement (EULA) and domestic laws. This informed them that their data may be used in improving the quality of the installed game. Anonymous data samples were collected only for the purpose of conducting statistical analyses. Ethical compliance of our research went through an internal experimental review process at our organization before it launched (IRB and equivalents).

7. Related Work

The study about RMT was originally initiated in the field of Economics. Huhh (Huhh, 2008) viewed RMT in massively multi-online game in the perspective of network externality. Huhh pointed out that RMT has contributed to the commercial success of online games. Heeks (Heeks, 2009) analyzed GFG and RMT in a macroeconomic point. According to (Heeks, 2009), RMT is essential to provide a channel to transfer assets between the virtual and real world.

In this paper, we provide valuable information to prove the claims made in previous studies. For example, Heeks (Heeks, 2009) explained that RMT providers pursued economies of size and scale in the RMT market. We confirmed that this phenomenon was observed through our analysis of the virtual goods trading networks in the real game dataset.

Several studies analyzed the social network structures in online games because such games provide various social activities similar to the real world. Chung et al. (Chung et al., 2014) and Son et al. (Son et al., 2012) studied various characteristics of social interaction networks in MMORPG. All of these studies could be used as a practical guide for understanding the social relationship between users.

Keegan et al. (Keegan et al., 2010) particularly explored the behaviors of GFGs using a network analysis. They showed similarities between a GFG network and real world drug trafficking network. This is proof that analyzing a community network in an online game can assist in understanding a real world community structure. Woo et al. (Woo et al., 2011) analyzed the free money trade referring that people only give game money without getting any goods in return for GFG detection. Fujita et al. (Fujita et al., 2011) proposed a RMT detection method based on the observation that RMT traders tend to form dense relationships with each other. Although their works and our work had similar approaches in terms of analyzing trading network, we improved the RMT detection method by considering community network structures and member characteristics in a community while previous studies analyzed only trade activities.

Meanwhile, we refer to many previous studies for social network analysis. Mislove et al. (Mislove et al., 2007) is a representative study for a social network on the Internet. Yang et al. (Yang et al., 2012) proposed a spammer detection model using network analysis in Twitter. Boshmaf et al. (Boshmaf et al., 2011) studied the social BOT network in Facebook. Although these studies analyzed services on the Internet, their approaches and techniques were helpful in analyzing social networks in online games. We believe that our work can additionally contribute to understanding network structures of other Internet services.

8. Conclusion

RMT could significantly influence online game services. The overproduction and popularity of RMT could have a negative impact on the virtual economy and cause severe damage to the reputation of the MMOPRG. On the other hand, RMT presents the potential revenue which online game company may get from In-app purchase. Therefore, it is critically important for game companies to estimate volumes of RMT and monitor the trend. In practice, however, it is very difficult to correctly distinguish RMT transactions from the millions of transactions.

To address this problem, we propose to detect abnormal communities on a trade network formed from in-game transactions. We construct a trading network with virtual goods trading records, split hundreds communities, detect RMT groups by characterizing their unique network statistics and analyzing community members’ in-game activities. We then filter out trades from RMT group, namely RMT provider to normal groups, namely RMT consumers and estimate the RMT volume based on filtered trades. To evaluate our RMT provider detection, we measured the rate of users who were banned by illegal activity (i.e. using game bot) belonging to each community type and found that RMT provider groups have more banning users than other types.

For practical use, we performed the experiment using large-scale game logs from a popular online game—Lineage, one of the most popular MMORPGs. To demonstrate the effectiveness of the proposed method, we compared the estimation on RMT detected from in-game log with real RMT transaction records crawled from two major RMT websites in South Korea. Through the analysis on a large-scale and long-term log from a popular online game, we derived following findings.

Professional RMT providers typically form the star-shaped network, which is highly centralized with a high-degreed key node and lots of low-degrees nodes. This shape is for efficient sales of asset; the key node collect asset from members and sell it to other users. We also found that chained structures in the virtual goods trading network. This network is emerged to minimize the risk of revealing and the damage of banning. This network structure has never been found in previous works to our best knowledge. Additionally, we showed several interesting results about dynamics of RMT network via long-term analysis. As the online game become mature, the RMT market is monopolized by a few large RMT providers. Also, in old server, the RMT provider communities with the hierarchical structure appear for more systematic operation. We expect that this work is helpful to understand the underground economy in not only an online game but also real-world. As a part of future work, we plan to apply our methodology to other online games’ dataset to generalize our findings.

Finally, our current analysis of RMT transactions only focused on the online game service. We believe the proposed method might work well for other black markets in other networks (e.g., Bitcoin transactions in the Deep Web (He et al., 2007)). We will also verify this as another part of future work.


  • (1)
  • Albert et al. (2000) Réka Albert, Hawoong Jeong, and Albert-László Barabási. 2000. Error and attack tolerance of complex networks. nature 406, 6794 (2000), 378–382.
  • Blondel et al. (2008) Vincent D Blondel, Jean-Loup Guillaume, Renaud Lambiotte, and Etienne Lefebvre. 2008. Fast unfolding of communities in large networks. Journal of statistical mechanics: theory and experiment 2008, 10 (2008), P10008.
  • Boshmaf et al. (2011) Yazan Boshmaf, Ildar Muslukhov, Konstantin Beznosov, and Matei Ripeanu. 2011. The socialbot network: when bots socialize for fame and money. In Proceedings of the 27th Annual Computer Security Applications Conference. ACM, 93–102.
  • Castronova (2001) Edward Castronova. 2001. Virtual worlds: A first-hand account of market and society on the cyberian frontier. (2001).
  • Castronova (2007) Edward Castronova. 2007. Effects of Botting on World of Warcraft. (2007).
  • Chen et al. (2005) Ying-Chieh Chen, Jing-Jang Hwang, Ronggong Song, George Yee, and Larry Korba. 2005. Online gaming cheating and security issue. In International Conference on Information Technology: Coding and Computing (ITCC’05)-Volume II, Vol. 1. IEEE, 518–523.
  • Chung et al. (2014) Taejoong Chung, Jinyoung Han, Daejin Choi, Taekyoung Ted Kwon, Huy Kang Kim, and Yanghee Choi. 2014. Unveiling group characteristics in online social games: a socio-economic analysis. In Proceedings of the 23rd International Conference on World Wide Web. ACM, 889–900.
  • Clauset et al. (2008) Aaron Clauset, Cristopher Moore, and Mark EJ Newman. 2008. Hierarchical structure and the prediction of missing links in networks. Nature 453, 7191 (2008), 98–101.
  • Clauset et al. (2004) Aaron Clauset, Mark EJ Newman, and Cristopher Moore. 2004. Finding community structure in very large networks. Physical review E 70, 6 (August 2004), 066111.
  • Digital (2008) Engage Digital. 2008. Group Laundered $38M in Virtual Currencies in 18 Months. (2008).
  • Fujita et al. (2011) Atsushi Fujita, Hiroshi Itsuki, and Hitoshi Matsubara. 2011. Detecting Real Money Traders in MMORPG by Using Trading Network. In

    Proceedings of the Seventh AAAI Conference on Artificial Intelligence and Interactive Digital Entertainment

  • He et al. (2007) Bin He, Mitesh Patel, Zhen Zhang, and Kevin Chen-Chuan Chang. 2007. Accessing the Deep Web. Commun. ACM 50, 5 (2007), 94–101.
  • Heeks (2008) Richard Heeks. 2008. Current analysis and future research agenda on” Gold Farming”: Real-world production in developing countries for the virtual economies of online games. Institute for Development Policy and Management, University of Mancester (2008).
  • Heeks (2009) Richard Heeks. 2009. Understanding” gold farming” and real-money trading as the intersection of real and virtual economies. Journal For Virtual Worlds Research 2, 4 (2009).
  • Heeks (2010) Richard Heeks. 2010. Real money from virtual worlds. Scientific American 302, 1 (2010), 68–73.
  • Huhh (2008) Junsok Huhh. 2008. Simple economics of real-money trading in online games. Available at SSRN 1089307 (2008).
  • Infiniti Research Limited (2014) Infiniti Research Limited. 2014. Global Online Gaming Market 2014. (2014). (accessed on 14 October 2016).
  • Keegan et al. (2010) Brian Keegan, Muhammad Aurangzeb Ahmed, Dmitri Williams, Jaideep Srivastava, and Noshir Contractor. 2010. Dark gold: Statistical properties of clandestine networks in massively multiplayer online games. In Proceedings of the 2nd International Conference on Social Computing. IEEE, 201–208.
  • Kwon et al. (2017) Hyukmin Kwon, Aziz Mohaisen, Jiyoung Woo, Yongdae Kim, Eunjo Lee, and Huy Kang Kim. 2017. Crime scene reconstruction: Online gold farming network analysis. IEEE Transactions on Information Forensics and Security 12, 3 (2017), 544–556.
  • Kwon et al. (2013) Hyukmin Kwon, Kyungmoon Woo, Hyunchul Kim, Chongkwon Kim, and Huy Kang Kim. 2013. Surgical strike: a novel approach to minimize collateral damage to game bot detection. In Proceedings of annual workshop on network and systems support for games. IEEE, 1–2.
  • Lee et al. (2016) Eunjo Lee, Jiyoung Woo, Hyoungshick Kim, Aziz Mohaisen, and Huy Kang Kim. 2016. You are a game bot!: uncovering game bots in MMORPGs via self-similarity in the wild. NDSS.
  • Lee and Chen (2010) Yeng-Ting Lee and Kuan-Ta Chen. 2010. Is server consolidation beneficial to MMORPG? A case study of World of Warcraft. In 2010 IEEE 3rd International Conference on Cloud Computing. IEEE, 435–442.
  • Lehdonvirta (2008) Vili Lehdonvirta. 2008. Real-money trade of virtual assets: new strategies for virtual world operators. Virtual Worlds, Ipe, Mary, ed (2008), 113–137.
  • Mislove et al. (2007) Alan Mislove, Massimiliano Marcon, Krishna P Gummadi, Peter Druschel, and Bobby Bhattacharjee. 2007. Measurement and analysis of online social networks. In Proceedings of the 7th ACM SIGCOMM Conference on Internet Measurement. ACM, 29–42.
  • Morselli et al. (2007) Carlo Morselli, Cynthia Giguère, and Katia Petit. 2007. The efficiency/security trade-off in criminal networks. Social Networks 29, 1 (2007), 143–153.
  • Morselli and Petit (2007) Carlo Morselli and Katia Petit. 2007. Law-enforcement disruption of a drug importation network. Global Crime 8, 2 (2007), 109–130.
  • Orland (2017) Kyle Orland. 2017. World of Warcraft gold can now be used to buy other Blizzard items. (2017).
  • Pons and Latapy (2005) Pascal Pons and Matthieu Latapy. 2005. Computing communities in large networks using random walks. In International Symposium on Computer and Information Sciences. Springer, 284–293.
  • Raghavan et al. (2007) Usha Nandini Raghavan, Réka Albert, and Soundar Kumara. 2007. Near linear time algorithm to detect community structures in large-scale networks. Physical review E 76, 3 (2007), 036106.
  • Rosvall and Bergstrom (2008) Martin Rosvall and Carl T. Bergstrom. 2008. Maps of random walks on complex networks reveal community structure. Proceedings of the National Academy of Sciences 105, 4 (2008), 1118–1123.
  • Son et al. (2012) Seokshin Son, Ahreum Kang, Hyunchul Kim, Taekyoung Kwon, Juyong Park, and Huy Kang Kim. 2012. Analysis of context dependence in social interaction networks of a massively multiplayer online role-playing game. PloS one 7, 4 (2012), e33918.
  • Woo et al. (2012) Jiyoung Woo, Hwajae Choi, and Huy Kang Kim. 2012. An automatic and proactive identity theft detection model in MMORPGs. Appl. Math 6, 1S (2012), 291S–302S.
  • Woo et al. (2011) Kyungmoon Woo, Hyukmin Kwon, Hyunchul Kim, Chongkwon Kim, and Huy Kang Kim. 2011. What can free money tell us on the virtual black market? ACM SIGCOMM Computer Communication Review 41, 4 (2011), 392–393.
  • Xu and Chen (2005) Jennifer Xu and Hsinchun Chen. 2005. Criminal network analysis and visualization. Commun. ACM 48, 6 (2005), 100–107.
  • Yang et al. (2012) Chao Yang, Robert Harkreader, Jialong Zhang, Seungwon Shin, and Guofei Gu. 2012. Analyzing spammers’ social networks for fun and profit: a case study of cyber criminal ecosystem on twitter. In Proceedings of the 21st International Conference on World Wide Web. ACM, 71–80.