Tree of Savior Forum

A Solution to the Bot Problem (No more bots!đŸ˜± - No more gold-spammers! đŸ˜± - A minor inconvenience to noobs! 😑 )

Suggestions Game
#1

I came up with this idea a while ago, but never posted it because it I think is makes things more annoying for legit users.

But, I have come to realize that the bots are more annoying than this system would be. Especially the in-town chat spammer ones. I do not think IMC will ever be able to get rid of those ones without some sort of instant-ban system like the one I propose below.

The Basic Idea

The basic premise is fairly simply. Each account has a “credibility” rating. This rating is associated to how “bot-like” a player is. This could be tied to IMC’s machine-learning bot classifier they have. Everyone should start out as “guilty” [of being a bot] until there is enough data for that player for the system to prove they are “innocent”.

  • If you do a lot of things a bot does, your Credibility Rating goes down. If you have a low credibility then you may encounter Captchas.
  • If you do a lot of things a bot does not/can not do, your Credibility Rating goes up. If you have a high Credibility then you will never encounter Captchas.
  • Credibility is account-wide (if 1 of your characters is not a bot, it should be assumed that the others are not bots as well)

If you have an incredibly low Credibility Rating: when you are reported as a bot, you are prompted to solve a Captcha (or given some other, highly-intrusive but effective bot-test). If you fail the test, something happens to you immediately - possibly a (temp?) auto-ban. In order to prevent abuse (i.e. botters reporting themselves so they can manually solve the Captchas), solving this Captcha can not raise your credibility.

If you have a medium-low Credibility Rating: you will be randomly prompted to solve a Captcha at a low chance (if you successfully solve it, your Credibility Rating goes up). If someone reports you, it goes to the GMs without affecting you in any way. You shouldn’t stay in this range for too long. If you are able to solve random Captchas, thrown at you at any time - that is pretty un-bot-like. And if you can’t, that is pretty bot-like.

If you have a high Credibility: you will never have to solve any Captchas. When you are reported as a bot, the report gets sent to the GMs without affecting you in any way. A high Credibility should be shown on their Character Info in some way (maybe an achievement or something) so that if you encounter someone that is obviously a bot, and they have a high Credibility, you can record a video and make a legit bot report because a GM investigation may actually not turn up anything without your help.

Answers to Questions You Have

Q. But my Khaleesi, what about the bots that can defeat Captchas?
A. If you do some research into beating Captchas, you will know that it is possible - but not easy. The most common solution that malicious entities currently use for beating Captchas still involves having a human solving them, which makes things pretty annoying for bot-handlers.
But, it still doesn’t have to be a Captcha. If it turns out bots are defeating the Captchas, it can be changed to something else - perhaps a puzzle, or a random quest - anything that a bot would not be programmed to do (it could change weekly or so if it has to, to catch them off guard), even if it is incredibly annoying for legit players.

Q. Won’t this just annoy legit users?
A. Yes, it will be incredibly annoying, but only if you have a low credibility. It should not take you too long to earn a higher credibility if you are not a bot. Maybe between levels 1-50 you would see a few Captchas when people report you, and between level 50-150 you could see a few random Captchas occasionally, but after that it should be evident that you are not a bot. And once the system is certain you are not a bot, you will never see a Captcha ever again. That, I believe, is the beauty of my solution.

Q. Won’t players just abuse this during World Bosses and PvP?
A. Player reports against you should only bring up a Captcha if you have a low credibility, and are therefore behaving very bot-like. In early-to-mid game, player reports against you will be non-intrusive. And in mid-to-end game, all legit players should have “high” credibility so they will never ever see a Captcha ever again, on any character.

Q. How is this any different from IMC’s machine-learning classifier they are using now?
A. IMC could continue using their classifier to help determine a player’s credibility. In fact, they should. But what this solution allows is for players to instant-ban obvious bots, while letting obvious legit players play without having to worry about being accused of botting.

  • Those annoying gold-spammers - banned instantly by players.
  • Those annoying bots with incredibly low adventure rankings that keep KSing you - banned instantly by players.
  • Those legit players that use bots while they sleep - they wouldn’t have a low enough credibility to get instant banned, so GMs would have to manually investigate the report.

Q. So, this will not be able to stop all bots?
A. It will not stop bots that are also partially played by a human. Those ones will still need to be reported manually. It will allow the mass-created bots (the bigger problem IMO) to be instant-banned though.

Q. What happens when bots start doing quests to earn a higher credibility?
A. Who said doing quests gives you a higher credibility? Hopefully IMC is smart enough to realize bots can be scripted to do these linear quests, and their ML bot classifier takes that into account.

TL;DR

If IMC’s “machine-learning bot classifier” determines a player is likely to be a bot and if we report them, they should be prompted with a “bot-test” that will (temp?) intant-ban them if they fail the test.

By playing the game, and doing un-bot-like things, you can prove you are not a bot and will never ever see a Captcha ever on any of your characters, ever. If the system deems you un-bot-like, and you are reported, the report is processed exactly how it is being processed now.

#2

Okay i get that you want to help but this basically equals any players that like grinding = bots with this system.

Ontop of that this can be beaten relatively easily after some research. Eventually ( and it wont take that long) they will learn the conditions of bot vs human and program the simplest human action to be repeated every once in a while.

TLDR - i would rather not be classed as a bot because i like to grind and am picky about who i talk to.

#3

Yes, you are 100% correct. So if you like just grinding you will be prompted with random Captchas occasionally (and maybe when someone reports you). If you successfully solve them, your Credibility goes up and you will no longer be classified as a bot. You will then never ever see a Captcha ever again, on any character.

Essentially, if you like to act like a bot then you need to put up with the BS once and then never have to worry about it again.

Assuming it takes a while to earn credibility, lets say you wont move out of the “low credibility” range until level 50, that means bots (and legit players making their very first character) are subject to solving Captchas for those first 50 levels. Bots need to either learn to solve Captchas (or solve a better bot-test IMC can create), or they needa human to go through those first 50 levels - which means no mass-creation of bots/gold-spammers on the scale they have now.

This is also the worst case scenario - where a bot’s behaviour becomes indistinguishable from humans by IMC’s bot classifier system.

#4

Honestly, this seems too complicated to implement and too hard to make actually fail-safe.

Sure, it looks good on paper, but there will be false positives and RMTs finding workarounds.

We already have enough small annoyances because of bots (trading limits etc etc). We don’t need more of that, we need a bigger and more reliable GM team. And that will only come with more revenue (i.e. F2P phase).

(Stricter punishments for gold sellers and better client hack protection are suitable options too.)

#5

I don’t think a bigger GM team alone is going to stop the automated mass-creation of bots that we are seeing. Since the bots are being created automatically, manually trying to catch them is next to impossible.

There needs to be an automated solution.

Fixing the client’s API would also be a major step forward >.>

#6

In Mabinogi, which is also published by Nexon, bots can bypass captchas as soon as the captcha bomb is used on them (within a fraction of a second.) So your thing about bots needing humans to do that is plain wrong.

Your credibility system is basically just a discrimination system waiting to be abused anyway.

#7

Some games has a system of questions, like from 1h to 1h it will promp a question for you, like 2+2 or something easy and you have a quantity of time to answer it, if you don’t it you will be disconnected. This could be applied to players that are not during Dungeons or Mercenary but as soon as they leave they should answer. (and also to players with store open) .
Some system of counting down how many times has the account been disconnected because of that can help to select players who should be banned for booting

#8

Bump and thumbs up!!