KOA Solves Bot Problem Forever!

[Rue]

One thing you are missing is that sometimes real players turn off the conversation thing. I have done so when fishing amongst people with really boring or profane conversation. Sometimes I also turn it off if I want to have more screen clickable. maybe just make a challenge something that would pierce this.

Something visible, possibly audible, like an incoming thunder storm?

[Darth Kaz2]

Yes, I am thinking the challenge would appear in a pop-up, which would require typing in the name of the challenger or some such action to counter the challenge.

The main problem as I see it is definitely protecting players that aren't paying close attention to the game. That is why I was thinking that the challenge would last a few minutes before making one vulnerable to attack. The challenge would also have to prevent you from just logging out and hopping worlds, or a macro would probably be rewritten to respond with such.

Thanks guys...keep picking holes in this idea...if we can work out something practical and effective, we will offer it to Jagex!

[Dave]

Another lil problem I see with the challenge aspect (not meaning to pick on it or anything, I have no idea of a solution), is what if "I1l llIl1 lIl" challenges you? I'd get banned (or killed or w/e) for sure.

[Darth Kaz2]

Lol, excellent point! Hmmm....

Any ideas anyone?

[Frobozz]

This is an interesting discussion.

I, for one, think that all mouse and keyboard movement/input should be fed back to Jagex for analysis. It's extremely hard to fake human randomness (as opposed to computer-generated randomness).

EDIT: Also, dynamically generated item IDs per build or per session.

Jagex has been doing what you've suggested since at least 2006, when they enacted several mass bans. If an account gets a sufficient number of macro complaints against it, Jagex will start logging all their input and analyzing it. This requires significantly more network bandwidth, plus the CPU power for analysis, so they only activate this feature when there is a strong suspicion of rule breaking.

Tamal, you give humans too much credit. :lol: It's easy to fake human randomness. I'm a software engineer by trade, and have always been interested in Turing tests. MMORPGs are the ideal scenario to apply Turing test theories. Out of curiosity, I wrote a small perl script to see how difficult it would be to move a mouse cursor and have it look like a human. I used sinusoidal algorithms to simulate the general motion, with a few extra algorithms to simulate velocity and over-shooting/under-shooting of the click target.

As an example, try quickly pointing your cursor at something on this web page. You'll probably find that you move the cursor in two distinct motions. The first motion gets you close to the target area. The second is a more fine-tuned correction, which allows you to point precisely at the intended target.

The result of this coding was an automated cursor that looked like it was being controlled by a human. It's kind of unnerving to watch it move. This only required a few dozen lines of code to implement. I'm sure that real bot systems are far more sophisticated.

Same goes for keystrokes. You can vary the intervals between keystrokes, how long the key is held down, how quickly it is released, etc. All of this can be simulated in such a way that the OS thinks it's coming directly from a physical input device, rather than a program.

This is literally distinguishable from human input. Any algorithm that Jagex would apply to detect bot behavior would likely result in too many false positives. (i.e. falsely accusing a human of being a bot.) Think about your average training behavior. The sad truth is, many training activities in MMORPGs require bot-like repetitive motions and routines, even from actual humans.

The suggestion of dynamically generated item IDs also has risks. The more complex Jagex makes their item ID coding, the more likely it is that some hacker will figure out an exploit leading to item duplication, which would be a problem far worse than botting.

Bots pay for the game like Honest Folk.

Often, they don't. A primary motivation for Jagex implementing the trade limits wasn't just the in-game effect of bots. They were getting so many fraudulent stolen credit card purchases from asian bot companies that they were at risk of losing their contract for credit card processing, which would have likely put the company out of business. That was the final straw that made them take the drastic move of shutting down the wild.


Jagex has a full-time team of engineers dedicated solely to combating bots. All MMORPG companies do. Any solutions that we may come up with here have likely been suggested internally at Jagex, thoroughly analyzed, and shot down because of some fatal flaw that could potentially do more harm than good. The problem isn't that Jagex is incompetent, or just don't care. They haven't solved this problem because it is fundamentally very difficult, if not impossible, to solve. The discussion here is interesting, but I wouldn't expect to find some amazing overlooked solution that has no unwanted side effects.

This is becoming a thesis. I'll stop here before it gets excessively TLDR.

[Myztra Roxxs]

Very interesting post. I'm sure you are correct in many aspects. But does it really contradict this suggested solution?

My solution:
- Make randoms mortal again.
- When you die (from randoms only?), you lose x% of your current exp from a random skill.

*poof* bots gone.

[Darth Kaz2]

Froboz, Thanks for the excellent post. If you read back to my original premise, I think it agrees with your assessment of the problem: There is no good software solution to botting, and a dozen or so Jagex employees are insufficient to handle the botting problem. The obvious solution, in my opinion, is to engage the 50k or 100k players on at any given time in killing bots. I would happily kill bots while mining or fishing in the LRC, for example, just for the drops and the satisfaction. I am completely sure that dragon bone bots and the like would be heavily targetted for death!

The question then becomes, how can we empower players to kill bots without killing each other.

The only other solution I know of is to rescind Wild/Free Trade, and I don't know if the disruption to the game in doing that (again) would be acceptable to any of us.

[Tamal]

Thank you for your thoughts Frobozz. You're correct in that one can write software that looks like it's a human to a human, but at the minute level there will be pauses and behaviors that are different and hard to emulate when analyzed by skilled persons or software.

Allow me to depart from bots for a moment and talk about Benford's Law, which states that most real-world numbers' first digit distribution is unbalanced; most real-world numbers start with 1. Humans are horrible at coming up with random numbers and thus if we're making up numbers (such as with the coin flip experiment used in the link above) then we'll unconsciously attempt an even distribution of digits… resulting in what appears to be passable fake data, but to the trained eye/software it's quickly identified as fraudulent.

Mouse/keyboard input is much more complex than simple integers and if machine learning and behavior analysis was applied to thousands of samples then not only could bot/human input be identified, but if a player was right/left handed, mouse/trackpad/mousekeys, etc.

Some students wrote one such neural network for WoW (http://www.cs.wm.edu/~srgian/paper/ccs09.pdf) and it was extremely successful, catching the bot 99.8% of the time within 40 seconds.

EDIT: More fun reading…

http://scholar.google.com/scholar?hl=en ... mnG2Xd3kMJ
http://iseclab.org/papers/botdetection-article.pdf
http://cs229.stanford.edu/proj2009/Winslow.pdf