Identifying Game Processes Based on Private Working Sets

Fueled by the booming online games, there is an increasing demand for monitoring online games in various settings. One of the application scenarios is the monitor of computer games in school computer labs, for which an intelligent game recognition method is required. In this paper, a method to identify game processes in accordance with private working sets (i.e., the amount of memory occupied by a process but cannot be shared among other processes) is introduced. Results of the W test showed that the memory sizes occupied by the legitimate processes (e.g., the processes of common native windows applications) and game processes followed normal distribution. Using the T-test, a significant difference was identified between the legitimate processes and C/S-based computer games, in terms of the means and variances of their private working sets. Subsequently, we derived the density functions of the private working sets of the considered game processes and those of the legitimate processes. Given the private working set of a process and the derived probability density functions, the probability that the process is a legitimate process and the probability that the process is a game process can be determined. After comparing the two probabilities, we can easily determine whether the process is a game process or not. As revealed from the test results, the recognition accuracy of this method for C/S-based computer games was approximately 90%.