And now for something completely different. I've written this short analysis of the cheating phenomenon in multiplayer first person shooter games as a preface to my C++ university project report. It summarizes my thoughts on the subjects from the past few years, and I'm posting it here to use it to save my breath/keyboard strokes when explaining the weakness of the PunkBuster anticheat model (or any of its clones) to those who still believe it will protect their server from cheaters.
Problem definitionMultiplayer games, akin to sports, have been plagued by cheaters almost since their inception. While in the latter case the community struggles against artificial, biochemical augmentation of the players' bodies (doping), in digital competition we are running up against digital "skill boosters".
Narrowing the problem down to FPS (first-person shooter) games, we can define the two basic cheat classes:
- those that augment the player's motor skills and reaction time and aid them in aiming at enemies and pulling the trigger - these are called aimbots,
- and those that augment the player's perception by revealing the location of enemies and/or important gameplay objects, using various means (turning walls transparent, giving text or audio hints to the player etc.) - we'll put them under the umbrella term of a wallhack.
There is also the
speedhack class of cheats, which we are not considering here. They exploit the fact that most popular engines' player locomotion code utilizes client clock for movement physics; older game engines, when fed with client input data at a double rate, would also move the player around the game world at double the speed. The reason we are not dealing with them is that they can be easily denied existence by well thought-out game logic alone, which is the case with practically all modern technologies.
Traditional countermeasures and their weaknessesThe traditional approach to combating cheats is to use methods similar to antivirus software: scanning the client systems for violations of game code and content integrity and/or traces of cheater programs, and sending the scan results over the network to the server. However, this method is
fundamentally flawed - since the entire system relies on the honesty of the client component, which is
beyond any reliable control of the server, a smart hacker may create a cheating program which will be able to either modify the anticheat system's transmission to send false negatives, or spoof the system entirely, claiming to be the actual anticheat client. Alternatively, having full, physical control of the client machine, the hacker can opt to sandbox the anticheat scanner (i.e. run it in a contained environment, intercepting and manipulating all of its system calls that perform the actual scanning etc.), effectively concealing the presence of the cheater program from it. Surely, it requires the hackers to present a remarkable level of skill; there are numerous examples, however, where this has been done, and it will be done even more frequently in the future, as e-sports tournaments and leagues gain prestige and real-world profits from gaming become involved.
This should leave you with no doubt that these vulnerabilities render the traditional model completely useless. Dependence on client-provided data is unsafe and should be discarded in favour of an untrusted approach: it should actually be assumed, from the very start, that the client is in fact attempting to cheat.
Proposed solutionWhen an experienced player spectates another person's performance in game, they are well capable of reliable recognition whether that person is playing honestly or they're using a cheat; especially when they're equipped with appropriate means, e.g. a wallhack of their own, which enables them to see what a cheating player would see, and connect the cheater's actions with gameplay events. I assume, then, that it is also possible to teach a computer to do just that. I'm trying to develop a scanner which will not be prone to these flaws, as it follows an entirely different principle, based on heuristics. My solution will run server-side only, which will eliminate the risk of spoofing and the clients feeding us false negatives. Machine learning will be utilized to teach the decision algorithms to tell cheaters from honest players via the means of behaviour analysis alone.
The project is in active development, even though it still has a long way to go.