Serverside only protection ?

[Azura]

Do any of you think it's possible to develop a serverside only protection against aimbots ? The main caveat in any uscript protection seems to be the client side files which is where the hacking takes place.

Now, I think you'll agree that aimbots are no different from any other software. They might not be entirely predictable but they are attempting to emulate the behaviour of a human being. In that might lie the beginning of an answer and most of those who are into computers will have heard of the Turing test :

http://www.turing.org.uk/turing/scrapbook/test.html

Is this transposable in an environment such as a UT server ? How would one go about "forwarding" questions to a client and under what form ? I have at least one idea of a test where an aimbot would fail and would be interested to hear about any others people might have.

[kawaii]

Well i doubt that you can develope a purely serverside anticheat package. However it would be cool if you have an (autoupdating) package on the server, and only a very small package clientside, so all the code etc is on the server. But than again, a check for the physics of the players doesn't require a client package, but will it be enough to stop hooks/aimbots/etc ?

And still that won't completly solve the cheating problem, since people like Helios use these forums to get the cheat protections so they can break them again.

[Sardukar]

The idea is of course fesable... however, aimbots do try to emulate human actions (do they? or do they just try to hide the fact they're automated?) but you have to look at it from the other end of the scale, which is human nature is so eratic, what is to say in one moment of time they DO play like an aimbot? If an aimbot outputs numbers such as 1 and 2 and 3, and we consider the human playstyle to be "random" - then theres always a clean cut chance you will hit one of the "rules" set out in the anticheat and get a false positive.

There is no such thing as artificial intellegence (as i'm sure you know if you've read about the Turing test), we only have rules based intellegence... for both the anticheat, and of course the aimbot. But then, if we have only rules to "combat" against another rules-based intellegence but also to allow for "true intellegence" to go unaffected by playstyle rules, then either not going to work, or its going to have a heck of a lot of rules.

I've used server-side anticheat protections.

The problem with the latter (heck of a lot of rules), is that the transmission of data between the server and the client may prove too much (the forwarding of those "questions" would prove too much). I remember I used to test server-side versions of ASHLITE, and talk about grinding to a halt. It seems to be only very simple anticheats that do not use up a lot of resources that can reside entirely server side.

There are some entirely server side cheat protections, but these are very simple and do not pave the way for some of the more advanced things developers are coming out with recently.

But then, I am only guessing that you are talking about these "rules" for playstyle... are you?

I like the concept, though and I guess this will be a nice discussion

[Shambler]

Serverside aimbot protections would simply not cut it, aimbots can be configured in various ways and even tho they may be detectable if your watching a demo of one that doesn't mean you can translate that to code.

Maybe if you had serverside demo-recording on and a fairly sensitive server-side only detection, then it could log what it THINKS is a bot..that might be usefull but there would be very easy ways around it.


The only really effective way of automaticly determining if someone has a bot is through client-side cheat protections, there are also radars/wallhacks/timers too which are just about impossible to detect without something clientside.


A good team working on the cheat protection along with auto-updating system and another team finding the newest cheats would be something I'd like to see
It's not likely tho...and since most undetectable cheats are now private it's not really necessary either. (but would still be nice )

[Azura]

Originally Posted by Sardukar

...but you have to look at it from the other end of the scale, which is human nature is so eratic, what is to say in one moment of time they DO play like an aimbot?...

Ah ah ! Interesting paragraph there ^^ . One could go on to say the following :

Human => Erratic.
Aimbots => Systematic.

This would mean that, in theory, you could devise a continual test where a human would come up positive some of time and an aimbot would come up positive most, if not, all of the time. Combine that with simple statistics and you have a detection method.

But then, if we have only rules to "combat" against another rules-based intellegence but also to allow for "true intellegence" to go unaffected by playstyle rules, then either not going to work, or its going to have a heck of a lot of rules.

That's where statistics come into the picture as mentionned previously. Instead of doing multiple and complex checks, how about doing some simple checks that draw a picture over time. Perhaps you could design a mod such that all it does is log raw information which can then be processed afterwards on your home PC which has lot's of CPU power to spare.

There are some entirely server side cheat protections, but these are very simple and do not pave the way for some of the more advanced things developers are coming out with recently.

But then, I am only guessing that you are talking about these "rules" for playstyle... are you?

I like the concept, though and I guess this will be a nice discussion

Yes, I'm aware that anything too complex can bog down server performance and that is why the imperative is to keep things simple. Also, I understand that the way a server operates around the tick rate, it's probably impractical to scan for sudden minute changes of angle. However, I'm certain that there's something that one can come up with where you toss a simple "bone" (think dog) to which the aimbot reacts and the human doesn't.

[PizzaMan]

Originally Posted by Azura

. However, I'm certain that there's something that one can come up with where you toss a simple "bone" (think dog) to which the aimbot reacts and the human doesn't.

The first thing I thought of when I read this was; is it possible to make an invisible target that floats around the map, that aimbots would fire at?

[LeeBe]

If anything like this was made, it would also have to be private I think, because whatever 'questions' it asks the client, the 'answers' could be faked if they knew what those questions were.

[Azura]

Originally Posted by PizzaMan

The first thing I thought of when I read this was; is it possible to make an invisible target that floats around the map, that aimbots would fire at?

Heh . And what if I told you that someone has already implemented something similar ^^ ? If you have any further ideas like these, send them to me via PM.

[iDeFiX]

Can't something also be done with monitoring shot>hit rate or viewport?

[Just_Me]

Originally Posted by PizzaMan

The first thing I thought of when I read this was; is it possible to make an invisible target that floats around the map, that aimbots would fire at?

That would be incredibly easy to get around. And then your devising ways of
"detection" rather than concentrating on ways to eliminate the method they use.

[Azura]

Yes, but once you've mistakenly invited a "vampire" into your house, how do you defeat him ^^ ? Detection methods need not necessarily exclude each other and they can very well be complementary.

<= has watched too many episodes of Buffy :p .

[Just_Me]

Originally Posted by Azura

Yes, but once you've mistakenly invited a "vampire" into your house, how do you defeat him ^^ ?

Take away his teeth.

[BLTicklemonster]

I somehow was under the impression that what made bots work in the first place was the bots themselves. You know, the bots on the server. Probably way off there, but if not, then a truly competition server package with the ut code stripped of bot functionality would probably at least keep autoaiming from working. (this is where you all dump me for being teh noob)

[Shambler]

Aimbots have nothing to do with actual AI bots, writing the code to make you aim at another players head is trivial vector math....Albeit there is more complicated stuff involved with getting the bots to be less noticable but that still has nothing to do with the original ingame code.

[PizzaMan]

Originally Posted by Just_Me

And then your devising ways of
"detection" rather than concentrating on ways to eliminate the method they use.

I think that even if you can stop people from cheating, it is still nice to know who tried to cheat.

[Azura]

Originally Posted by Just_Me

Take away his teeth.

Damn, there goes my analogy ^^ . What I was trying to say is that it would be nice to have a simple detection method in place that is there in case the classic "police search" upon entering a server is bypassed somehow.

Originally Posted by Shambler

Aimbots have nothing to do with actual AI bots, writing the code to make you aim at another players head is trivial vector math....Albeit there is more complicated stuff involved with getting the bots to be less noticable but that still has nothing to do with the original ingame code.

Yep, the code somehow taps into the internal workings of UT and samples data such as "bones" and vectors to relay it to the aiming software.

Originally Posted by PizzaMan

I think that even if you can stop people from cheating, it is still nice to know who tried to cheat.

...Or at least gather some data that can be analyzed afterwards, i.e a player's hit/miss ratio or his bonus item timing. Of course, it will never provide hard evidence such as logs from UTDC or UTPure and it should be treated more lightly. Most of the admins of public servers out there seem like reasonable people so this would be just another tool (and not a way to bring up false accusations with the stupid witchhunts they bring about).

From watching demos of players at WCG and other competitive events, I realize that there are some players out there that have mastered the game to an unimaginable degree but even they will make mistakes ^^ .