Tree of Savior Forum

Anti-Botting Strategy: imc needs to start using behavioral biometrics

Suggestions
#1

It is hard for bot programmers to emulate the biases in human actions whether in mouse movements or in key strokes. imc needs to look into these kinds of strategies (or at least pass this on to Valve)…

Here is one example of such a system being applied in blogs to detect blogging bots. (I’m not saying imc should implement THIS system exactly, but it provides the flavor for the kind of strategy that should be used)

The system consists of two components, a webpage-embedded
logger and a server-side detector. The logger is implemented
as a JavaScript snippet that runs in the webpage
on the client browser. It records a user’s input actions during
her stay at the site and streams the data to the serverside
detector. The detector processes raw user input (UI)
data, and extracts biometrics-related features. The core of
the detector is a machine-learning-based classifier which
is tuned with training data for the binary classification,
namely determining whether the user is human or bot.

Informed with the classification result, the server decides
whether or not to accept the comment form submission.1
We evaluate the efficacy of the detection system by conducting
a series of experiments over the user input dataset. The
experimental results demonstrate that the system can detect
97.9% of current blog bots with extremely low false positive
rate of 0.2%

Source

5 Likes
How to solve bot issue
A B2W game? The future of ToS
Anti Bot & Anti A**es
#2

Difference is that many players act like bots, specifically AFK farmers.
They hold down Z and go watch a movie or something.

#3

Allowing players to afk ‘play’ the game is just horrible gameplay design in the first place. It was an awful idea in Grenado Espada and it remains a horrible gameplay design if imc actually intended for players to be able to hold down ‘z’ then go do something else.

1 Like
#4

What a tragedy that would be if they were to all disappear.

2 Likes
#5

holding down z and spam 1 spot isn’t soo bad as the new hacker, they are swordman class, but have ridiculous range.

#6

Like my suggestion in other thread.

For bots. My idea is when you right click a random player just put an option to send the player something like a captcha. This window will appear at the corner of the screen for few minutes so the player won’t be distructed by it and have time to settle things first. If the constantly moving player failed to answer lets say within 5 minutes, the character will be perma ban. IP block also LOL. It only takes 2 clicks for the other player to do, better if there’s a reward system as well.

They can remove it if they really want too, maybe it has to do with the game population stuff that’s why they let em… or the put lots of…:kissing:

#7

The problem with a captcha based method is that you can write a botting program to detect that a captcha has appeared and to call a human player to guide the bot through the captcha challenge.

The advantage of this biometrics method is that no player would know when they are being audited for being a bot or not. Because what is being analyzed are how keys are pressed, how the mouse is moved, how buttons are pressed, how the character moves through the world, etc…

2 Likes
#8

other games used that same method right?

#9

Which same method?

[poll][/poll]

#10

Your method, looks a very tasky one to do. Wonder if other devs used the similar method.
Wait. you’re a penguin too?

#11

Dood, I’m a prinny >____>

Don’t mistake the two…

As for difficulty, maybe 2-3 years ago I would’ve said doing something like the article I linked proposed would be very very hard, but many of these technologies and techniques are now fairly mainstream. It’ll take some time to develop, but it would be much more robust than current methods.

#12

wahaha lol a prinny.

Well uhm. Goodluck then.

#13

You would expect the dev not to be working for ToS if they do know how to code these.

#14

And you know exactly how skilled imc devs are? I have merely suggested a better bot detection method which has already been done 3 years ago as shown in the source. imc are free to ignore this suggestion. But I see absolutely no issue with proposing it.

Wouldn’t you want as a player a bot free game using methods that don’t require you to fill in captchas that don’t even work against more sophisticated bots?

#15

We can roughly know how skilled imc are by looking at the bug fixing speed.

There, you got it.

#16

Well, if you have a better idea I’m sure imc would love to hear…

Implementing what I suggested wouldn’t even be that hard. Machine learning techniques are extremely powerful and are becoming widely used so efficient pre-written open sourced functions likely already exist.

#17

It’s definitely not hard, but is out of imc’s expertise. Its like asking a technician to design a car, possible, but usually not achievable.

You probably don’t want to use this function without knowing what you are doing, or there will be crazier bug than the current one.

I’m not disagreeing on the method. If I were in bot countering team I will probably do a similar stuff and ban them manually. But I don’t believe in imc’s skill.

#18

Well like I previously stated it’s a suggestion. imc can take it or leave it. How do you suggest they solve the problem in a way that “fits their expertise”??

I still fundamentally disagree that calling a function and knowing a bit about how it works really requires expertise. Just like you or I use computers but don’t require expertise in electrical engineering or computer programming.

#19

Btw, its not hard for a bot to emulate the human’s movement (trick the detection) by adding a certain amount of rng to it.

I know of multiple not that actually does that to prevent detection.

Removing that noise though, can be a PhD thesis.

#20

rng is not enough especially since you can train and classify over so many different parameter spaces. Human actions are not random and even if the bot programmer used Markov chains to program more human like behaviors or incorporated real user keystroke trajectories or latencies into mouse movements or key presses there are always other parameters you could use to perform classification.

At that point I imagine programming such a bot would be outside most bot makers’ expertise ; P