Greetings, glorious adventurers! If you're joining in our Alpha One spot testing, please follow the steps here to see all the latest test info on our forums and Discord!
Options

How to end/reduce Bots problem

escarreta1escarreta1 Member
edited January 10 in General Discussion
We all know that detecting and banning bots is relatively easy, but the real challenge lies in finding a way to permanently ban the individuals behind these activities. I recall playing on some Lineage 2 servers a long time ago, where they had a seamless method for banning bots, hackers, and real-money traders (RMTs). When you create an account, it is linked to your motherboard, similar to the activation process for Windows.

Could this approach work for Ashes of Creation? Implementing a system where game accounts are tied to specific hardware components, such as a motherboard, is technically feasible, but it comes with both advantages and disadvantages:

Advantages:

Effective Anti-Bot Measures: Linking accounts to hardware can make it more challenging for users to create and manage multiple accounts on the same machine, reducing the prevalence of bots.

Deterrent for Cheaters: The knowledge that their hardware is at risk of being permanently banned may discourage some players from engaging in cheating or exploiting the game.

Stability: It can contribute to a more stable player environment by discouraging malicious activities.

Disadvantages:

If you change your motherboard

Trying to login in other device


«1

Comments

  • Options
    Personally if I were going to combat botting I would just design a system that tracks the mouse movement of a player, every change in angle creates a point in a database, then use an algorithm to determine if there is a pattern across all changes in mouse movements. If so its a bot, if not probably a human. A bot cannot be random, fundamentally it has to have a pattern. Still I don't understand the entire picture so perhaps this is a useless endeavor. Of course it doesn't combat any RMT either.
  • Options
    escarreta1 wrote: »
    We all know that detecting and banning bots is relatively easy, but the real challenge lies in finding a way to permanently ban the individuals behind these activities. I recall playing on some Lineage 2 servers a long time ago, where they had a seamless method for banning bots, hackers, and real-money traders (RMTs). When you create an account, it is linked to your motherboard, similar to the activation process for Windows.

    Could this approach work for Ashes of Creation? Implementing a system where game accounts are tied to specific hardware components, such as a motherboard, is technically feasible, but it comes with both advantages and disadvantages:

    Advantages:

    Effective Anti-Bot Measures: Linking accounts to hardware can make it more challenging for users to create and manage multiple accounts on the same machine, reducing the prevalence of bots.

    Deterrent for Cheaters: The knowledge that their hardware is at risk of being permanently banned may discourage some players from engaging in cheating or exploiting the game.

    Stability: It can contribute to a more stable player environment by discouraging malicious activities.

    Disadvantages:

    If you change your motherboard

    Trying to login in other device


    that doesnt work. you can fake / spoof your hardware.
    Voxtrium wrote: »
    Personally if I were going to combat botting I would just design a system that tracks the mouse movement of a player, every change in angle creates a point in a database, then use an algorithm to determine if there is a pattern across all changes in mouse movements. If so its a bot, if not probably a human. A bot cannot be random, fundamentally it has to have a pattern. Still I don't understand the entire picture so perhaps this is a useless endeavor. Of course it doesn't combat any RMT either.

    bots dont use mice.
  • Options
    VyrilVyril Member
    edited January 10
    You can read their plans here.

    https://ashesofcreation.wiki/Security_systems
  • Options
    tenor.gif?itemid=17500205
  • Options
    Vyril wrote: »
    You can read their plans here.

    https://ashesofcreation.wiki/Security_systems

    sounds good on paper :wink: will have to see the reality of it. Most ToS in games claim similar things lol.
  • Options
    Voxtrium wrote: »
    Personally if I were going to combat botting I would just design a system that tracks the mouse movement of a player, every change in angle creates a point in a database, then use an algorithm to determine if there is a pattern across all changes in mouse movements. If so its a bot, if not probably a human. A bot cannot be random, fundamentally it has to have a pattern. Still I don't understand the entire picture so perhaps this is a useless endeavor. Of course it doesn't combat any RMT either.

    That’s already been tried, it’s easy to simulate random or “human-like” mouse movement.

    No automated system can replace human oversight, monitoring and enforcement. Actual people are better at recognising botting behaviour than any algorithm. Any MMO that doesn’t hire enough GMs to actually take on that kind of role will end up suffering.
  • Options
    Cyridius wrote: »
    Voxtrium wrote: »
    Personally if I were going to combat botting I would just design a system that tracks the mouse movement of a player, every change in angle creates a point in a database, then use an algorithm to determine if there is a pattern across all changes in mouse movements. If so its a bot, if not probably a human. A bot cannot be random, fundamentally it has to have a pattern. Still I don't understand the entire picture so perhaps this is a useless endeavor. Of course it doesn't combat any RMT either.

    That’s already been tried, it’s easy to simulate random or “human-like” mouse movement.

    No automated system can replace human oversight, monitoring and enforcement. Actual people are better at recognising botting behaviour than any algorithm. Any MMO that doesn’t hire enough GMs to actually take on that kind of role will end up suffering.

    That i agree but then why even companies with unlimited money like blizzard have barely no active Gms?
    Looks like an expensive solution even more for Entrepid studio

  • Options
    nanfoodlenanfoodle Member, Founder, Kickstarter
    At best this is a wack a mole system. Best way to deal with bots is hard banning real players that use RL money to buy items or gold. Then make regular announcements on how many players were banned for buying gold and items. Drive off the customers you drive off the farming botts.
  • Options
    I am by no means an expert but since we will have an extensive Alpha 2 Phase designed for (amongst other things) collection of data, I think there are a few things Intrepid can do:

    Feed bot behavior into the system - Deliberately create bot accounts to establish a database of behavior patterns that identifies behavior of bot characters. Intrepid could hire 2-3 groups and make it a contest: 1 bot per week can be put into the world, they try to find it and will ban them if discovered. At the end of the week "surviving" bots grant a point to the group that designed it, the data for the bots programming will be disclosed by the end of the month, so Intrepid can innovate their security system based on that and then new bots come in, Intrepid tries to find and destroy them etc etc. By the end of the testing period (maybe half a year) the group with the most points receives a payment bonus.

    Partial automation - The security system does not need to be fully automized. I think it is also a decent system if it would be able to fairly accurately identify "suspicious" players. This could trigger a ticket sent to an ingame GM. The GM now engages in some shape of form with the suspicious character, reviews the log files of that accounts behavior and determines if either (A) This is indeed a bot and therefore initiates the ban process, (B) this is clearly no a bot or (C) further investigation is required as no clear judgement was possible.

    Effective banning - Intrepid is a private company with the right to deny service of entities they do not deem trustworthy business partners. Should a bot or someone engaging in RMT be discovered, it might be effective to not only close the account but also blacklist the linked financial accounts through which this account was set up. Furthermore the blacklist then can be analysed to identify more suspicious accounts, if after a couple of months it becomes clear that a whole lot of bots always are run with accounts from XYZ bank but basically no regular customers uses that bank, Intrepid could contemplate to limit their business with all customers of XYZ bank in general.
    Additionally creating a player account with a bank account linked to anything but an individual person could be rejected outright.
    The answer is probably >>> HERE <<<
  • Options
    NoaaniNoaani Member, Intrepid Pack
    escarreta1 wrote: »
    Cyridius wrote: »
    Voxtrium wrote: »
    Personally if I were going to combat botting I would just design a system that tracks the mouse movement of a player, every change in angle creates a point in a database, then use an algorithm to determine if there is a pattern across all changes in mouse movements. If so its a bot, if not probably a human. A bot cannot be random, fundamentally it has to have a pattern. Still I don't understand the entire picture so perhaps this is a useless endeavor. Of course it doesn't combat any RMT either.

    That’s already been tried, it’s easy to simulate random or “human-like” mouse movement.

    No automated system can replace human oversight, monitoring and enforcement. Actual people are better at recognising botting behaviour than any algorithm. Any MMO that doesn’t hire enough GMs to actually take on that kind of role will end up suffering.

    That i agree but then why even companies with unlimited money like blizzard have barely no active Gms?
    Looks like an expensive solution even more for Entrepid studio

    GM's as people here seem to be discussing them come in two types.

    The first type is the type you see in game. They are there as a show of presence. They are there to make players feel the company is doing something.

    The second type is the type you don't see. Instead of being online on a game server so people can see them, they are actually doing the real work.

  • Options
    Farming bots > active GM/community team >permabann
    spamming bots > GM/community team > shadowbann
  • Options
    VaknarVaknar Moderator, Member, Staff
    Vyril wrote: »
    You can read their plans here.

    https://ashesofcreation.wiki/Security_systems

    Nice assist! 💪
    community_management.gif
  • Options
    Ehrgeiz wrote: »
    Farming bots > active GM/community team >permabann
    spamming bots > GM/community team > shadowbann

    you are probably onto something here.

    banning a gold seller advertising a website doesn't do much since they can create another bot. these bots also pm players advertising their website. so a shadowchat ban could be the solution for this. don't ban the bot, don't mute, don't kick, etc. let the bot keep spamming and dming, but, but redirect its messages to a channel where no one can see them.
  • Options
    NoaaniNoaani Member, Intrepid Pack
    Depraved wrote: »
    Ehrgeiz wrote: »
    Farming bots > active GM/community team >permabann
    spamming bots > GM/community team > shadowbann

    you are probably onto something here.

    banning a gold seller advertising a website doesn't do much since they can create another bot. these bots also pm players advertising their website. so a shadowchat ban could be the solution for this. don't ban the bot, don't mute, don't kick, etc. let the bot keep spamming and dming, but, but redirect its messages to a channel where no one can see them.

    This will only work for a few minutes.

    If I have a second account that should be able to see that spam message but can't, it won't take me long to figure out whats happened.
  • Options
    Noaani wrote: »
    Depraved wrote: »
    Ehrgeiz wrote: »
    Farming bots > active GM/community team >permabann
    spamming bots > GM/community team > shadowbann

    you are probably onto something here.

    banning a gold seller advertising a website doesn't do much since they can create another bot. these bots also pm players advertising their website. so a shadowchat ban could be the solution for this. don't ban the bot, don't mute, don't kick, etc. let the bot keep spamming and dming, but, but redirect its messages to a channel where no one can see them.

    This will only work for a few minutes.

    If I have a second account that should be able to see that spam message but can't, it won't take me long to figure out whats happened.

    afaik those sites who use spam bots don't have people playing the game (who knows they might when they arent working). they have multiple bots which will all be in the same channel so they can see each other messages and everyone else's messages, but people who arent spamming cant see them. they will only log in on another character to trade gold and if no one is reading the spam bots, people might not ever know that website exist, unless they googled gold selling in aoc or something.

    besides, what can the shadowbanned bot do? nothing. just make another character / account and it will have the same fate. you are just delaying the gold selling to maybe make it not worth it for sellers. they might just think that not many people are interested in buying.

    of course, having active gm banning them right away is another solution.
  • Options
    NoaaniNoaani Member, Intrepid Pack
    Depraved wrote: »
    Noaani wrote: »
    Depraved wrote: »
    Ehrgeiz wrote: »
    Farming bots > active GM/community team >permabann
    spamming bots > GM/community team > shadowbann

    you are probably onto something here.

    banning a gold seller advertising a website doesn't do much since they can create another bot. these bots also pm players advertising their website. so a shadowchat ban could be the solution for this. don't ban the bot, don't mute, don't kick, etc. let the bot keep spamming and dming, but, but redirect its messages to a channel where no one can see them.

    This will only work for a few minutes.

    If I have a second account that should be able to see that spam message but can't, it won't take me long to figure out whats happened.

    afaik those sites who use spam bots don't have people playing the game (who knows they might when they arent working).
    Playing? No.

    Working? Yes.

    Keep in mind, some of the companies that sell gold have hundreds of employees. You aren't going up against some guy in a garage that thinks selling gold would be a good side hustle, you are going up against actual tech companies with millions of dollars of investment.

    In the case of a game like Ashes, any given gold reseller may well be a larger company than the game developer, with better in house developers who get paid more.

    This is why these companies are quite happy to let the image of the Chinese bot/gold seller remain, it leaves everyone underestimating the resources they have at hand.
  • Options
    Feedback from GMs after reporting a bot would be wholesome 😊
  • Options
    VeeshanVeeshan Member
    edited January 18
    You see suspected bot. You pull out sword and stab it, collect the loot it gathered for you and repeat :P (maybe work off corruption a little in between loot Piñata i mean bot farming)
  • Options
    - Put mobs everywhere to make impossible for bots to farm.
    - Make a report system that really works with enough ressources allocated
    - Track other caracters of these bots
    -
    Bots are cancer, and after 20% of the population is bot, Studios don't want to ban them if they pay every month...
  • Options
    HughJardonHughJardon Member
    edited January 19
    Three factor authentication to prevent account selling
  • Options
    ILLPeonUILLPeonU Member, Leader of Men, Kickstarter, Alpha One
    escarreta1 wrote: »
    Cyridius wrote: »
    Voxtrium wrote: »
    Personally if I were going to combat botting I would just design a system that tracks the mouse movement of a player, every change in angle creates a point in a database, then use an algorithm to determine if there is a pattern across all changes in mouse movements. If so its a bot, if not probably a human. A bot cannot be random, fundamentally it has to have a pattern. Still I don't understand the entire picture so perhaps this is a useless endeavor. Of course it doesn't combat any RMT either.

    That’s already been tried, it’s easy to simulate random or “human-like” mouse movement.

    No automated system can replace human oversight, monitoring and enforcement. Actual people are better at recognising botting behaviour than any algorithm. Any MMO that doesn’t hire enough GMs to actually take on that kind of role will end up suffering.

    That i agree but then why even companies with unlimited money like blizzard have barely no active Gms?
    Looks like an expensive solution even more for Entrepid studio

    Because Blizzard are greedy pieces of crap, that only care about the bottom line and little about anything else. Once a great company, now has sold out to be no better than EA.
    TwitchTV Streamer: The Hidden Dagger Inn Saturday's 5:00 PM Cst
    7wg8px59ktyc.jpg


    https://www.youtube.com/@TheHiddenDaggerInn/featured
  • Options
    I would start by not allowing anyone using a vpn to log into the game. You must use your Ip making it easier to track who you are.This wouldn't deter the more serious and qualified botter/hacker but would eliminate the wannabe botters leaving the GMs to deal with alot fewer but more serious bots.
  • Options
    IskiabIskiab Member
    edited January 26
    Best way - add a box price. All the systems in the world won't help if the cost of creating a bot is low, the financial decision for gold sellers is the cost of the bot compared to the amount made per bot, just working to catch them quickly will help, but increasing the cost per bot will help too.
  • Options
    EndowedEndowed Member, Alpha One, Adventurer
    Zehlan wrote: »
    I would start by not allowing anyone using a vpn to log into the game. You must use your Ip making it easier to track who you are.This wouldn't deter the more serious and qualified botter/hacker but would eliminate the wannabe botters leaving the GMs to deal with alot fewer but more serious bots.
    Agreed. Allow an account to have 5 ISPs associated with it. They can replace one every 4 months or so. That covers their possible different play spots. And serves to remove many bot farms.

  • Options
    nanfoodlenanfoodle Member, Founder, Kickstarter
    edited January 26
    Iskiab wrote: »
    Best way - add a box price. All the systems in the world won't help if the cost of creating a bot is low, the financial decision for gold sellers is the cost of the bot compared to the amount made per bot, just working to catch them quickly will help, but increasing the cost per bot will help too.

    That's just not needed. Actively ban anyone who buys gold or items with RL cash. Add a counter to a Ashes site that keeps track of every player who who has their account banned. Make a pop up when you log in of everyone's chars names of people banned once a week. Make buying from bot farmers such a scary thing and you will drive away the customers. No customers no bots.
  • Options
    PherPhurPherPhur Member
    edited January 26
    IPs change even if you're not using statics. It can be locked to a region though, so if an IP is trying to log on the same account 2 hours later from hundreds of miles away, that's an issue.

    That more deals with account security though and less on the botting end. Botters don't have much need for VPNs in the sense of evasion, IP banning is not a real solution anymore. You use to get IP only bans, then it was like IP and MAC, but then people learned how to change both of those. Now you'll see some places that will HWID ban, but even that's changeable(with a bit of work).

    Honestly I'd just like to see them take on South Koreas approach, at least for the US, and make account creation require a Social Security Number. Apart from that they need to have client side kernel level anti-cheat software. It's widely hated these days cause "muh privacy", but lets be real, these days you could be stranded out on a deserted island without any tech and still have your data stolen.
    5lntw0unofqp.gif
  • Options
    PherPhur wrote: »
    IPs change even if you're not using statics. It can be locked to a region though, so if an IP is trying to log on the same account 2 hours later from hundreds of miles away, that's an issue.

    That more deals with account security though and less on the botting end. Botters don't have much need for VPNs in the sense of evasion, IP banning is not a real solution anymore. You use to get IP only bans, then it was like IP and MAC, but then people learned how to change both of those. Now you'll see some places that will HWID ban, but even that's changeable(with a bit of work).

    Honestly I'd just like to see them take on South Koreas approach, at least for the US, and make account creation require a Social Security Number. Apart from that they need to have client side kernel level anti-cheat software. It's widely hated these days cause "muh privacy", but lets be real, these days you could be stranded out on a deserted island without any tech and still have your data stolen.

    Requiring a social security would drive away a significant amount of people and be extremely risky for IS.

    There's really not much you can do to stop bots from existing; it's going to happen regardless of any punitive repercussions. The best thing they can do is have more people actively working to hide/mitigate the effects of bots. The unfortunate thing is it's wildly costly to do such a thing.
  • Options
    EndowedEndowed Member, Alpha One, Adventurer
    PherPhur wrote: »
    IPs change even if you're not using statics. It can be locked to a region though, so if an IP is trying to log on the same account 2 hours later from hundreds of miles away, that's an issue.

    That more deals with account security though and less on the botting end. Botters don't have much need for VPNs in the sense of evasion, IP banning is not a real solution anymore. You use to get IP only bans, then it was like IP and MAC, but then people learned how to change both of those. Now you'll see some places that will HWID ban, but even that's changeable(with a bit of work).

    Honestly I'd just like to see them take on South Koreas approach, at least for the US, and make account creation require a Social Security Number. Apart from that they need to have client side kernel level anti-cheat software. It's widely hated these days cause "muh privacy", but lets be real, these days you could be stranded out on a deserted island without any tech and still have your data stolen.

    That is why they get a handful of ISPs to set to their account. And then can change one every few months. That's your limit. That will handle more than 99% of the normal player base.
Sign In or Register to comment.