Anticheat idea- Ghost of Lockout

[senadraxx]

I feel like I need to give everyone a warning before I post this, as this is going to be a long post that contains a LOT of speculation about the way 343's game servers/anticheat work. I'm fairly familiar with computers, but I'm not an expert and do not know the limitations of the agreements between 343/microsoft, so nobody take any of my assumptions as fact. But I've got a fun idea for how to tackle PC client cheaters. Will summarize in a TL;DR down below.

Intro: permissions

There are 4 levels of system permissions that most Anti-cheat software operates around. some of the most important to consider is level 3, User-side, and level 0, kernel-side permissions. Most cheating software uses Kernel-level permissions, which allows it to read and alter any byte of data present on the host system, which makes it easy for the user-side of the game to exploit the engine in the form of wall hacks and aimbots, and harder for the game to detect. 

Level 0 anti-cheat on a user device is a big deal, and not a preferable option, as this exposes devices to instability and privacy issues. kernel-level access on a game like this also opens a backdoor to cybersecurity threats and is not ideal. But what about anticheat on a game server, that uses a user-level update client-side to record and compare inputs from all connected machines? 

Step 1: Recording input

An update gets rolled out, that records the button input during active matches from all users during a match. You can use a machine-learning algorithm to watch matches live, from different perspectives. e.g a person getting killed during a match, and the one who killed them. This (maybe AI? we'll call it an AI) will have the ability to match input with in-game behavior, like watching a player lock on their reticle to another player's head through a wall, even though server-side, the game can't see that a user is using a wallhack to show other players' outlines. It would be able to do this more efficiently than a human. Such a program would be able to theoretically tell the difference between an aim-assisted kill and a regular kill, and be able to see when players are snapping to other players' heads. The challenge is training a machine to differentiate between professional players and hackers by spectating. However, if you have a program on the server reviewing all this, it could look at the match from all 8 player perspectives at once. discrepancies are easier to spot in a dataset like that. 

When you throw your own bots into the mix, especially since they're learning from people, this may also help them learn how to perfect their skills in matches, as well as recognizing the cheaters.
 

Step 2: making decisions

AI don't make decisions correctly 100% of the time, but when combined with human input, can increase certainty. Having an in-game report option would be immensely helpful, even if all that report does is flag the match for the AI to review. I am unsure of what happens during the regular reporting process, and how those matches get reviewed, but yes, the button would be incredibly helpful. For the first several hundred matches, you may need community assistance to help flag matches for such an AI.

After a certain period of time, my assumption is that the AI has probably watched enough matches, and seen certain players flagged enough times to be aware of what cheating looks like. 

Step 3: where it gets fun

Once an AI/human team can review enough matches and sift through the data to differentiate cheaters from people who are just really really good, Don't ban the cheaters from matches right away. Wait for them to get flagged more than once in a day. Flagging them and then being patient, instead of immediate action, will also make them cocky and unsure of whether or not their cheating software can be detected. 

Some Cheaters can turn on/off their anti-cheat at will, so the bot registering suspicious input (switching in and out of the game, esp. during matches, clicking areas in the game window on a pause menu that the game doesn't register visual assets in) isn't necessarily a clear case of cheating, but can be suspicious enough to warrant a closer look into input and gameplay analysis. But some cases are more clear-cut than others. in a case of 100% certainty (or whatever the industry average threshold on certainty is, in these events), here's what should happen:

Instead of banning them outright, have the game spawn a special bot. This bot's mission is to go after the cheater it registers. Assign the bot to an unused team (Team 3, so Teams 1 and 2 can't benefit from its killcount), make it unkillable, and give it active camo. Why not a sword, sniper rifle, or a special loadout to make this thing a pain?

The Cheater will either ragequit, disconnect upon seeing that they've been killed by the special bot, or alternatively, you can have an entire lobby of cheaters quit when they see the bot, because they don't know who the bot's going for. Again, the special bot shows up when the system Absolutely, Positively suspects cheating is going on in the match, and if the cheater disconnects, the bot can despawn or just stand still, in camo in a corner or whatever. 

Call it Joyeuse or the Ghost of Lockout, the fans would get some chuckles. It used to be a bug, make it a feature. 

 

TL;DR: 

Let the server learn how users are inputting controls into the game, and teach it to find discrepancies. If cheating has been flagged and confirmed, send the Ghost of Lockout to kill the cheaters and make them rage quit. Once a cheater is in a match, it stops being a legitimate match, and if the cheater is occupied or disconnects, everyone else can still have fun. 

Thank you everyone for letting me subject you to this idea salad, I hope this makes for a good contribution. Again, I am uncertain of a lot of things and how feasible an idea like this would be to execute, but if there's any game company I trust to come up with creative uses for AI, it's 343.  

Edited December 2, 2021 by senadraxx