Combat Bots - Flaw in mouse movement. Bot may easily be detected

chartpk · December 9, 2017

not how they detect bots

@ Updated my post. I specified now more clearly, that mouse and camera movement would be the only things to look at if you'd want to seperate between a bot player and a human player. Because ultimately these are the only things you interact with the game by. Keep in mind in my scenario example, you are watching your bot at all time, and you are always interfering with it and pausing it to solve randoms, or chat with players nearby, or adjust if something's wrong such as a closed door you can't get past.

According to these criteria, THEN the only way to be detected as a bot would be by looking at mouse movements and camera movements. A bot that can simulate these as much as a human, would never be detected as a bot as long as you're making sure to interact if there's something.

Theorems · December 9, 2017

"The only ways to detect whether you are botting in this case would then be:
1) Client is detected as Botclient
2) Mouse patterns
3) Camera Movements"

Don't forget click patterns! maybe you meant that also when you said mouse patterns..

"If anything, this is the randomized mouse movements which @Theorems mentioned which are actually BAD. Because, a human would never be able to move mouse below canvas screen, and suddenly have it appear on the top again in only a few milliseconds, even not likely after a couple seconds."

I never mentioned any specific movements, but I agree with you that moving off the canvas at the bottom and reappearing at the top does not help the bot as far as looking human-like goes.

Also, I agree with you that the human-like actions should be based on other variables and not just a random timer. Mrcombat for example has a feature where it misclicks and I thought that was good because no human goes 2 hours straight without misclicking. But, the problem with it was that it seems far too predictable. It seemed to just have basic random number generation to decide if it misclicked. Also, it was only ever 1 single misclick.

I need to get better at java first, but if I were to create a misclick 'anti-ban' I would make it based on some variables, possibly the following:

If the player or npc is moving, increase than chance of a misclick occurring
If both the player and npc are moving, greatly increase the chance of a misclick
if the last action made was a misclick slightly decrease the chance of a second misclick in a row (and if last 2 actions were misclicks decrease it even more...etc)
if the npc is farther away from the mouse, slightly increase misclick chance
if the player has recently misclicked a few times, decrease misclick chance (simulating player starting to pay more attention)
if player has not misclicked in a while, increase misclick chance (humans pay more attention sometimes, and less attention others. They do not maintain the same level of focus for 2 hours straight)

Those are just a few variables I thought of for misclick. In the future, I want to try and make a fighter with low ban-rates that would include a very large amount of actions (not just misclicks) all based on variables like the above, but we'll see if it actually works or not when I have the time to make it.

None of the script's actions would be pseudo anti-ban like checking xp or moving the mouse "randomly" in a fairly straight line to a single point on the canvas like I see so many scripts doing.

chartpk · December 9, 2017

"The only ways to detect whether you are botting in this case would then be:

1) Client is detected as Botclient

2) Mouse patterns

3) Camera Movements"

Don't forget click patterns! maybe you meant that also when you said mouse patterns..

"If anything, this is the randomized mouse movements which @Theorems mentioned which are actually BAD. Because, a human would never be able to move mouse below canvas screen, and suddenly have it appear on the top again in only a few milliseconds, even not likely after a couple seconds."

I never mentioned any specific movements, but I agree with you that moving off the canvas at the bottom and reappearing at the top does not help the bot as far as looking human-like goes.

Also, I agree with you that the human-like actions should be based on other variables and not just a random timer. Mrcombat for example has a feature where it misclicks and I thought that was good because no human goes 2 hours straight without misclicking. But, the problem with it was that it seems far too predictable. It seemed to just have basic random number generation to decide if it misclicked. Also, it was only ever 1 single misclick.

I need to get better at java first, but if I were to create a misclick 'anti-ban' I would make it based on some variables, possibly the following:

If the player or npc is moving, increase than chance of a misclick occurring

If both the player and npc are moving, greatly increase the chance of a misclick

if the last action made was a misclick slightly decrease the chance of a second misclick in a row (and if last 2 actions were misclicks decrease it even more...etc)

if the npc is farther away from the mouse, slightly increase misclick chance

if the player has recently misclicked a few times, decrease misclick chance (simulating player starting to pay more attention)

if player has not misclicked in a while, increase misclick chance (humans pay more attention sometimes, and less attention others. They do not maintain the same level of focus for 2 hours straight)

Those are just a few variables I thought of for misclick. In the future, I want to try and make a fighter with low ban-rates that would include a very large amount of actions (not just misclicks) all based on variables like the above, but we'll see if it actually works or not when I have the time to make it.

None of the script's actions would be pseudo anti-ban like checking xp or moving the mouse "randomly" in a fairly straight line to a single point on the canvas like I see so many scripts doing.

Good ideas!

I think some of these functionalities could end up being performance consuming, all though I don't know how much. Maybe they would work just fine for one bot on one machine. It's certainly possible to implement. I think having only a few selection of your humanly click patterns would be enough, along with other larger human-looking interactions with the game.

Going back to one of the things I mentioned earlier about the current way most combat bots work in regards to mouse-> The mouse is left idle after for example interacting with an NPC or looting. So, the bot clicks attack, then leaves mouse at the same x,y positions through most of the combat fight until npc is dead.

This is what in my opinion is one of the large giveaways, BECAUSE, as the RS client detects and transmits mouse packets every 50ms, you would have a log filled with a certain player's mouse coordinates and clicks being stationary and idle through most combat fights. Picking this up with a couple lines of code is VERY simple, and considering a bot detection system is more advanced.

So a log of a BOT player's mouse coordinates would look something like this (simplified 500ms instead of 50ms):

Timer | Mousecoords | Action | Explanation

50ms | (137,137) | Idle | Mouse is just randomly hovered over some tile in the game

50ms | (143,151) | idle | Mouse is being hovered somewhere

50ms | (190,182) | Idle | Mouse is being hovered somewhere

50ms | (224,221) | Idle | Mouse is being hovered somewhere

50ms | (340,234) | Idle | Mouse is being hovered somewhere

50ms | (345,265) | Idle | Mouse is being hovered somewhere

50ms | (352,271) | Idle | Mouse is being hovered somewhere

50ms | (352,271) | Idle | Mouse is not moving

50ms | (352,271) | Idle | Mouse has clicked

50ms | (352,271) | Idle | (Now player is fighting NPC after mouse clicked attack on a nearby NPC)

50ms | (352,271) | Idle | Mouse is still on the same location as botplayer is fighting.

...

X10

...

50ms | (352,271) | Idle | Mouse is still on the same location as botplayer is fighting.

50ms | (352,271) | Idle | NPC has died

50ms | (331,264) | Idle | Mouse is being hovered somewhere

50ms | (285,240) | Idle | Mouse is being hovered somewhere

50ms | (212,220) | Idle | Mouse is being hovered somewhere

50ms | (212,220) | Idle | Mouse is clicked (NPC is attacked)

50ms | (212,220) | Idle | Mouse is idle in same location after clicking attack

...X10

...

50ms | (212,220) | Idle | Mouse is idle in same location after clicking attack

...Process repeats...

As you can clearly see, mouse coordinates easily identify bot pattern and bot behaviour. Consider this exact behaviour over a period of 1 hour.. 2 hours.. even 3 hours. This is exactly what the bot does in most cases, and even if it has some simple randomized mouse movements here and there, the majority of the mouse movements will display the same conclusion: No interaction after NPC is attacked - which is precisely what the bot does.

A human's interaction with the game following the same process to attack NPC's would easily translate into an examplified version of these mouse packets:

Timer | Mousecoords | Action | Explanation

50ms | (137,137) | Idle | Mouse is just randomly hovered over some tile in the game

50ms | (143,151) | idle | Mouse is being hovered somewhere

50ms | (190,182) | Idle | Mouse is being hovered somewhere

50ms | (224,221) | Idle | Mouse is being hovered somewhere

50ms | (352,271) | Idle | Mouse is not moving

50ms | (352,271) | Idle | Mouse has clicked

50ms | (352,271) | Idle | (Now player is fighting NPC after mouse clicked attack on a nearby NPC)

50ms | (348,261) | Idle | MOUSE IS NOW MOVED, after selecting attack NPC

50ms | (321,241) | Idle | MOUSE IS STILL MOVING

50ms | (301,221) | Idle | MOUSE IS STILL MOVING

50ms | (284,222) | Idle | MOUSE IS STILL MOVING

50ms | (284,222) | Idle | Mouse has stopped

50ms | (283,219) | Idle | Mouse has a micro-movement

50ms | (284,220) | Idle | Mouse has another micro-movement in +XY direction

....

Bold text illustrates the difference picked up by mouse packets sent to server which differentiate normal human interaction and most current bot's interaction.

...

dQw4w9WgXcQ · December 9, 2017

@ Updated my post. I specified now more clearly, that mouse and camera movement would be the only things to look at if you'd want to seperate between a bot player and a human player. Because ultimately these are the only things you interact with the game by. Keep in mind in my scenario example, you are watching your bot at all time, and you are always interfering with it and pausing it to solve randoms, or chat with players nearby, or adjust if something's wrong such as a closed door you can't get past.

According to these criteria, THEN the only way to be detected as a bot would be by looking at mouse movements and camera movements. A bot that can simulate these as much as a human, would never be detected as a bot as long as you're making sure to interact if there's something.

sorry, but ur thinking about this the wrong way. lets just say u have a bot that clicks a tree every 1 second for 6 hours. this alone is a detectable pattern, so mouse/camera arent the only ways you can determine if someone is botting.

also its not important to be human-like, its important to be not-bot-like. humans behave uniquely, so its difficult to make assertions about what is human. its much easier to make a profile for a bot since they all behave the same. If i made my mouse move in a perfect rectangle every second, it wouldnt be banned unless other bots are doing the same thing (this is pretending that they even consider mouse path, which they dont)

Theorems · December 9, 2017

sorry, but ur thinking about this the wrong way. lets just say u have a bot that clicks a tree every 1 second for 6 hours. this alone is a detectable pattern, so mouse/camera arent the only ways you can determine if someone is botting.

also its not important to be human-like, its important to be not-bot-like. humans behave uniquely, so its difficult to make assertions about what is human. its much easier to make a profile for a bot since they all behave the same. If i made my mouse move in a perfect rectangle every second, it wouldnt be banned unless other bots are doing the same thing (this is pretending that they even consider mouse path, which they dont).

Looking at it from Jagex's point of veiw..why wouldn't they consider mouse path? That would be one of the most effective ways of finding bots as it wouldn't be hard to compare it to their database of human movements. Are you saying that a bot that moves its mouse in a straight line wouldn't have an increased ban rate as long as its click positions and timings are just as randomized?

Also, I doubt this even more because I know of a certain off-site scripter who always implements very human-like mouse movements into his scripts and they all have a famously low banrate ..

edit: and actually I'll bet you would get banned moving the mouse in a perfect rectangle every second as long as the bot clicked at least every 50 seconds...maybe i'll try that later and post the results.

chartpk · December 9, 2017

sorry, but ur thinking about this the wrong way. lets just say u have a bot that clicks a tree every 1 second for 6 hours. this alone is a detectable pattern, so mouse/camera arent the only ways you can determine if someone is botting.

also its not important to be human-like, its important to be not-bot-like. humans behave uniquely, so its difficult to make assertions about what is human. its much easier to make a profile for a bot since they all behave the same. If i made my mouse move in a perfect rectangle every second, it wouldnt be banned unless other bots are doing the same thing (this is pretending that they even consider mouse path, which they dont)

Sorry not sorry.

Look. We're talking about a combat script which is far different than a bot that clicks a tree every 1000 milliseconds for 6 hours. That's obviously detectable. When I said Mouse Patterns, I naturally mean everything related to the mouse - that is path and clicks. But focusing on the path primarily because that's where the flaw is in my opinion. The clicks in a combat script seem to be fine, they're randomized by a gaussian distribution when you're interacting with something such as an NPC. So clicking the NPC at random coordinates on the npc. Which is fine, unless you think there's some flaw in that?

What other mechanism would there be to actually detect a bot without looking at mouse patterns and camera movements IF you always watch your bot and make sure to manually interact if something goes wrong? There is practically nothing else that can get you banned for botting except the pattern of your mouse (path and clicks) and keyboard (camera). The only physical difference between you playing and the bot playing is that the bot moves your mouse and camera for you (In a combat script where you always monitor it manually). If the bot could move its mouse, clicks, and camera nearly like you do, nobody could ever tell the difference between you and the bot. And now, there's a lot of humans playing RS with different set of mouse patterns and camera movements. Some don't even move their camera at all when fighting NPCs. Some use their laptop keypad. Some play using TeamViewer from their phone/tablet. All this is different input of data. Much different to the current way bots control the mouse. Even as you said, the key is to make the bot less bot-like.

"its much easier to make a profile for a bot since they all behave the same. "

That's why it's important to improve the static idle mouse path i've been explaining, which most combat bots have right now - most of them behave the same after interacting with something.

You might not get banned if you move your mouse in a perfect rectangle over a long period of time - but that does not mean it doesn't get caught up by some bot detection systems. You might not get banned because it would depend on the severity of the action. Whether you managed to gold farm and produce coins by making that rectangle pattern, or whether you managed to level up some skills. Be that the case, you would likely get banned.

I understand what you mean in terms of behaving not-bot-like, but that's why we're referring to a more humanly pattern and randomized set of actions and interference's in the game.

In my opinion, there is a high risk to get banned with the current combat bots EVEN if you watch your bot play & intervene when needed to (to solve randoms for example), use your residential IP, and play on a 1 year old account. That has to be primarily because of the bot's mouse path. Clicks and camera movements are less insightful. The giveaway in my opinion is in the mouse path. Or do you have any other input?

dQw4w9WgXcQ · December 9, 2017

Sorry not sorry.

Look. We're talking about a combat script which is far different than a bot that clicks a tree every 1000 milliseconds for 6 hours. That's obviously detectable. When I said Mouse Patterns, I naturally mean everything related to the mouse - that is path and clicks. But focusing on the path primarily because that's where the flaw is in my opinion. The clicks in a combat script seem to be fine, they're randomized by a gaussian distribution when you're interacting with something such as an NPC. So clicking the NPC at random coordinates on the npc. Which is fine, unless you think there's some flaw in that?

What other mechanism would there be to actually detect a bot without looking at mouse patterns and camera movements IF you always watch your bot and make sure to manually interact if something goes wrong? There is practically nothing else that can get you banned for botting except the pattern of your mouse (path and clicks) and keyboard (camera). The only physical difference between you playing and the bot playing is that the bot moves your mouse and camera for you (In a combat script where you always monitor it manually). If the bot could move its mouse, clicks, and camera nearly like you do, nobody could ever tell the difference between you and the bot. And now, there's a lot of humans playing RS with different set of mouse patterns and camera movements. Some don't even move their camera at all when fighting NPCs. Some use their laptop keypad. Some play using TeamViewer from their phone/tablet. All this is different input of data. Much different to the current way bots control the mouse. Even as you said, the key is to make the bot less bot-like.

"its much easier to make a profile for a bot since they all behave the same. "

That's why it's important to improve the static idle mouse path i've been explaining, which most combat bots have right now - most of them behave the same after interacting with something.

You might not get banned if you move your mouse in a perfect rectangle over a long period of time - but that does not mean it doesn't get caught up by some bot detection systems. You might not get banned because it would depend on the severity of the action. Whether you managed to gold farm and produce coins by making that rectangle pattern, or whether you managed to level up some skills. Be that the case, you would likely get banned.

I understand what you mean in terms of behaving not-bot-like, but that's why we're referring to a more humanly pattern and randomized set of actions and interference's in the game.

In my opinion, there is a high risk to get banned with the current combat bots EVEN if you watch your bot play & intervene when needed to (to solve randoms for example), use your residential IP, and play on a 1 year old account. That has to be primarily because of the bot's mouse path. Clicks and camera movements are less insightful. The giveaway in my opinion is in the mouse path. Or do you have any other input?

Didn't read too long, combat scripts also create patterns.

There were bots that sent 0 mouse movements by calling the method in the client that sends interact packets. They weren't banned.

Looking at it from Jagex's point of veiw..why wouldn't they consider mouse path? That would be one of the most effective ways of finding bots as it wouldn't be hard to compare it to their database of human movements. Are you saying that a bot that moves its mouse in a straight line wouldn't have an increased ban rate as long as its click positions and timings are just as randomized?

Also, I doubt this even more because I know of a certain off-site scripter who always implements very human-like mouse movements into his scripts and they all have a famously low banrate ..

edit: and actually I'll bet you would get banned moving the mouse in a perfect rectangle every second as long as the bot clicked at least every 50 seconds...maybe i'll try that later and post the results.

It's difficult to write an alg to analyse mouse movements. Also, it's easy to simply change the mouse alg and bypass detection. Mouse detection is similar to client detection in that way, it's a temporary fix. They wanted a more lasting system. Their current system is working fine for the vast majority of bots anyways and doesn't consider mouse path.

Theorems · December 9, 2017

Didn't read too long, combat scripts also create patterns.

There were bots that sent 0 mouse movements by calling the method in the client that sends interact packets. They weren't banned.

It's difficult to write an alg to analyse mouse movements. Also, it's easy to simply change the mouse alg and bypass detection. Mouse detection is similar to client detection in that way, it's a temporary fix. They wanted a more lasting system. Their current system is working fine for the vast majority of bots anyways and doesn't consider mouse path.

They are probably using some type of ai that is constantly adapting as it gets new data, not some fixed algorithm. Most companies do these days.

dQw4w9WgXcQ · December 9, 2017

They are probably using some type of ai that is constantly adapting as it gets new data, not some fixed algorithm. Most companies do these days.

They could, but they don't. Machine learning isn't easy and there's no one on staff with those credentials. Keep in mind it took this company 2 yrs to get a world map in game, they aren't google.

Besides, like I said earlier, you can bot using default mouse and not get banned, so it's not how they detect bots.

Theorems · December 9, 2017

They could, but they don't. Machine learning isn't easy and there's no one on staff with those credentials. Keep in mind it took this company 2 yrs to get a world map in game, they aren't google.

Besides, like I said earlier, you can bot using default mouse and not get banned, so it's not how they detect bots.

Idk man you seem pretty confident on how their system works for someone who isn't a jmod

Sign In

Combat Bots - Flaw in mouse movement. Bot may easily be detected

Recommended Posts

chartpk 1

Link to comment

Share on other sites

Theorems 23

Link to comment

Share on other sites

chartpk 1

Link to comment

Share on other sites

dQw4w9WgXcQ 184

Link to comment

Share on other sites

Theorems 23

Link to comment

Share on other sites

chartpk 1

Link to comment

Share on other sites

dQw4w9WgXcQ 184

Link to comment

Share on other sites

Theorems 23

Link to comment

Share on other sites

dQw4w9WgXcQ 184

Link to comment

Share on other sites

Theorems 23

Link to comment

Share on other sites

Archived

Browse

Store

Support

Important Information