Resource Using Machine Learning In Anti-Cheats

Discussion in 'Spigot Plugin Development' started by CJP10, Jan 23, 2018.

  1. Using Machine Learning In Anti-Cheats
    This is a general guide on using machine learning in anticheats
    KillAura is used as an example but the applications are nearly endless
    You are going to need a few prerequisites before starting

    - Basic knowledge of neural networks
    - Good grasp of the spigot API and Java
    - Research on a deep learning library, I will be use DeepLearning4j
    - Some knowledge on data structures and data sets

    Choosing a data set

    The first step is to find a data set that fits your goal. In this resource I will be using KillAura detection as an example. Thus, we will need to find a data set that fits KillAura detection.

    To detect KillAura, I decided that mouse movement would be a good place to start. Next, I needed to collect the data set to train and test the network. I know I want my data to be based around mouse movement, but I need a means of collecting that data in a meaningful way and be able to translate the data into input for our network.

    I came to the conclusion that when a player was hit, I would record the last 30 mouse movements of the attacking player. The first problem was I was left with a bunch of meaningless yaw and pitch data which was not human readable.

    My idea was to turn the sets of 30 mouse movements into images. The images could be easily read by humans. Which was helpful for detecting false positives and verifying the networks outcome as I could check the images that were flagged for being bot-like (Which means they came from a Aimbot or KillAura).

    Example images

    You can almost never have enough data, assuming it's accurate. The more time you spend building an accurate data set the better results you will have.

    It's best practice to split your data set into training and testing sets. The usual split is 80% of your data is for training and the rest is for testing.

    DeepLearning4j has a DataSetIterator which does this for you.

    Normalizing your data
    It's important to normalize your data. Images are quite easy to normalize as they are just channels of values between 0 and 255. In my case, these are black and white images meaning they are just 1 channel.

    DeepLearning4j has amazing utilities to normalize data, I used the ImagePreProcessingScaler, which does the above normalization for you.

    Building your network
    Now that you have a solid data set, you can build your network. It's hard to know exactly what network will provide the best results it's mainly educated guesses and trial & error.

    In my case, I was using images which gave me a bit of a direction on which network to choose. I decided a convolutional network was best, since it's regarded as the best network for image classification.

    The number of layers, Types of layers, etc is really just a guess that's verified by trial & error.

    DeepLearning4j has a good article on convolutional networks

    My network config was as follows
    Code (Text):

    int height = 180;
    int width = 360;
    int channels = 1;
    int outputNum = 2;
    int batchSize = 25;
    int nEpochs = 2;
    int iterations = 1;
    int seed = 1234;

    Map < Integer, Double > lrSchedule = new HashMap < > ();
    lrSchedule.put(0, 0.01);
    lrSchedule.put(100, 0.005);
    lrSchedule.put(300, 0.001);

    MultiLayerConfiguration conf = new NeuralNetConfiguration.Builder()
        .layer(0, new ConvolutionLayer.Builder(5, 5)
            .stride(1, 1)
        .layer(1, new SubsamplingLayer.Builder(SubsamplingLayer.PoolingType.MAX)
            .kernelSize(2, 2)
            .stride(2, 2)
        .layer(2, new ConvolutionLayer.Builder(5, 5)
            .stride(1, 1)
        .layer(3, new SubsamplingLayer.Builder(SubsamplingLayer.PoolingType.MAX)
            .kernelSize(2, 2)
            .stride(2, 2)
        .layer(4, new DenseLayer.Builder().activation(Activation.RELU)
        .layer(5, new OutputLayer.Builder(LossFunctions.LossFunction.NEGATIVELOGLIKELIHOOD)
        .setInputType(InputType.convolutionalFlat(height, width, channels))

    Tuning your network
    I can't offer much, other than make sure you data set is accurate. Everything else on tuning your network can be found here

    This topic is so broad, it's hard to write a single resource to provide all the information you need. I think this is a good starting point for anyone interested and there is a lot of information on the topic out there, hopefully you can do some research on your own time and contribute to this thread our you own.

    DeepLearning4j is an incredible project, they provided most of the information for this tutorial along with the library to implement deep learning in java. I suggest you use their project as a building block for anything deep learning related.

    I will be open-sourcing the anti-cheat that inspired this tutorial, I will update the thread with the link to the GitHub repo, along with some additional information.

    You can check out some examples of DeepLearning4j at
    #1 CJP10, Jan 23, 2018
    Last edited: Jan 23, 2018
    • Like x 20
    • Informative x 4
    • Useful x 4
    • Winner x 3
    • Creative x 1
  2. Nice tutorial, good work.
  3. Nice post, I love working with Machine Learning
  4. Nice tutorial and good work
  5. One of the best resources I've seen so far!
  6. Thank you for you feedback, hopefully this resource was insightful
  7. Nice resource. Great example of something that's so idiotically easy for a human to do, but when it comes to figuring out how to program an algorithm to classify the image it becomes an amazingly complex task.

    Perfect for machine learning.
  8. Very good explanation! I've been studying this topic for the last few days and decided to write an AntiCheat with machine learning for movement hacks myself. I found the thread here by coincidence but I'm sure it will be helpful:)
  9. Very interesting and definitely a good way to start by explaining the possible mindset needed to create something using ML. Never looked into detail on machine learning and I did find this very easy to understand so far. This is (from what I can see) not covered in the thread, but let's say you're making this anti cheat for a huge network, and you need to centralize this deep learning data somewhere, is there some kind of database specialized for this? Or would you somehow translate all "knowledge" to for example JSON files and dump them into MongoDB for example? I assume the knowledge of the machine learning needs to be saved somewhere.
    • Optimistic Optimistic x 2
    • Useful Useful x 1
  10. I tried to write a general tutorial that was easy to understand, mainly to combat the ML shit posts as I like to call them.

    In regards to saving data, it's entirely up to you. For the above example storing the labels and the img (as base64) in any database would be more than fine. I personally just store the yaw and pitch data, then I convert it to an img during processing.
    • Like Like x 1
  11. As machine learning needs lots of data. Do you have any clue how to reliably obtain them in high enough number? Are you planning on publishing an example dataset or a pre-trained network?
  12. I collected all the test data myself on localhost, I'm sure you can get creative.
  13. And whats wrong with making a Killaura Detection based on Rotation Yaw, or any math-related check?
  14. Will you publish this data or must everyone collect it themselves?
  15. That's the data I used
  16. I tried to create an algorithm to collect yaw and pitch data, I converted these data into a image but it doesnt look like your example images.
    I would be happy if you can give me a hint :D

    • Like Like x 2
  17. Instead of drawing the point,draw a line from the previous point to the new point
    • Like Like x 1
  18. Wouldnt it be possible to just use the values for the neural network.
    And only use the images for human validation?

    Also, do you think it's valid to valid to generate more than one image/dataset ever 30 ticks (30 mouse movements). Basically, having one image/dataset for every 30 tick span. This would give you much more data to work with. (Would this work for your image-based approach? Would this work for a simple 30 entry dataset approach?)
    (reading helps)
    #18 sirati97, Mar 2, 2018
    Last edited: Mar 2, 2018
  19. Yes but this is an entry level tutorial, it's way easier to understand through images and the 30 mouse movements was just arbitrary.
  20. I want to contribute to this post by adding my understanding on top of it, as the article contains some misleading information.

    Firstly, the model design is inherently flawed
    • Mouse movements are indeed a useful feature in determining the usage of KillAura, but the method OP used ignored a piece of important information: "how" the mouse is moved, instead of what is currently collected, "what" shape it drawed eventually.
    • The former one is, in fact, more effective than the latter one in most scenarios.
    • For example, this will not differentiate the two scenarios below:
      • A legit player aims at the enemy's head smoothly.
      • A hacker locks at the enemy's head instantly smoothly.
    • The solution is to add a new dimension: tick, to the original data and make it 3D, and perform 3D convolution accordingly.
    BUT, I doubt this approach and solution will yield a good accuracy (in fact, OP never mentioned the result, and I doubt the motivation behind this post,) since the network can be fooled easily. Any modern free hacked client can jitter the screen when Kill-Aura is enabled, and the movement would be hard to tell from that of a legit player with high DPI, or just shaking the mouse unnoticeably.

    The reason is 2D-CNNs are inherently unsuitable for this task due to the fact that the feature representation space it is aware of is way larger than the dataset OP designed. This is easy to understand:

    For an image, a 2D CNN captures its
    • Textures and edges
    • Object texture
    • Object shape
    • Some specific associated with the object
    • ...
    For most mainstream tasks (e.g., object recognition,) these features are absorbed by the network to a high extent and thus provides good accuracy.

    BUT, for OP's method, the only thing it can capture is the textures and edges, because the images have NO texture and shapes, not to mention other higher level features, which are vital for 2D CNN to accurately predict the label of an image.

    The solution is simply: DON'T USE 2D CNN LIKE OP, it is just not designed to perform this task well.

    What is a good model for this task?

    If you view the mouse movements as discrete coordinates that happen in an order, you can easily split the 2d movements into two 1d signals. In other words,

    Code (Text):
    # 2d:
    [(x1, y1), (x2, y2), (x3, y3), ..., (xn, yn)]

    # 1d:
    [x1, x2, x3, ..., xn]
    [y1, y2, y3, ..., yn]
    In this way, the signals can be processed by LSTMs and 1D-CNNs, which are two models that take the order, speed, and overall trend of movements into account. These models are also less resource-hungry than 2D CNNs.

    Or, we can try a new direction

    Excellent models usually stack a lot of features together. For example, instead of asking
    • Where was the mouse at tick k?
    We may also try
    • How fast did the mouse move to this point?
    • How fast did the mouse usually move?
    And, even
    • When the mouse moved like this in the past, where was the enemy?
    • When the mouse moved like this in the past, how fast was the enemy moving? (if it was moving fast, it is possible that the player "lock-aimed")
    Some thoughts on OP

    It has been 2 years since I first came across this post, the time where there were a lot of discussions about machine learning-based anti-cheats in the forum. I have seen OP criticizing other's works, but after seeing this post, I doubt if OP's work is really better than the work he criticized.

    Notice OP used identity activations for CNNs. For people without ML backgrounds, activation can be explained as follows:

    Data -> Convolutional Layer (conv) -> Activate -> Output. --- This is how data flow in a layer

    If the conv thinks the data have something really close to what it had learned, it is "activated", and produces an output indicating how "close" it is.

    The "activation" is done with a non-linear function e.g. sigmoid, because all inputs should be transformed into another kind of representation, e.g. probability (0.0-1.0), or the extent of activation (ReLU); it just cannot be the same as the input, otherwise, it doesn’t help with the complexity or various parameters of usual data that is fed to the neural networks.

    With that being said, OP's model uses identity activation, which outputs something exactly the same as the input... I personally did not use deeplearning4j before, but hmm, I wonder if OP's model actually works.

    It is kinda funny to see people claiming how smart they are while criticizing other's works, and the criticism itself makes little sense in the first place. In this way, people did not end up adding something meaningful to the community.
    #20 NascentNova, Dec 27, 2020
    Last edited: Dec 27, 2020
    • Like Like x 3