Can game replays be used as cheat protection?

Question

Say you're writing a complex turn based multiplayer strategy game in the browser (i.e. JavaScript). The game state is big and complicated (think line of sight calculations in a 3d world). There can be many simultaneous games on different maps. Thus keeping all of those maps in memory on the server and verifying every single client action as it happens would quickly become prohibitively expensive. So we're faced with the situation that we cannot trust anything from the client and we cannot verify every individual client action on the server due to cost.

Has anyone experimented with recording game sessions and running offline/asynchronous verification on them as a cheat deterrent? Ideally, the players themselves would get suspicious and spot check each others' replays. Obviously there would be a significant delay between the cheat happening and the player getting flagged, but in a long-running strategy game with persistent state, I think this would be a significant disincentive.

Do you know of such examples? Have they worked well?

Answer 1

Depending on how the gameplay works and what cheats are possible in it, telling the difference between cheating and genuine skill paired with luck can be very difficult. The only situation where you can proof a cheat in a replay is when a player does something which violates the game mechanics, and these situations should be easy to detect automatically.

Delegating the verification of cheats to the community is maybe not the best idea. A group of players who want to bully another player could band together and flag all of his replays as cheating and get them banned although they didn't do anything wrong. The final decision whether or not to sanction a player for cheating should be left to a neutral admin.

On the other hand, you can expect that most replays won't be checked at all. I doubt that players will be interested in watching replays between matches of lower-class players. When you rely on the community to detect and report cheaters, you can expect that only the most prominent players will be examined thoroughly.

I would still recommend you to create that replay-feature. But not as a sole cheat prevention but because it's a really interesting feature the community will likely enjoy a lot.

Answer 2

A friend had a physics-based game with online score board, and tried doing score validation by offline verification.

If the simulation is perfectly deterministic, this is possible.

Unfortunately, if you use floats anywhere, you won't be perfectly deterministic. Different CPUs may have different internal floating point precisions, which means that as long as a value is in a floating point register, it'll be calculated at a higher precision. This is generally a good thing, but once it gets popped back to memory, the additional precision is lost. Now, if two different CPUs have different precision, a thousand iterations later you will end up with subtly different values.

To make things worse, different optimization passes may cause your compiler to generate slightly different FPU code, which means that even on a single machine, two compilations of the same source (with small changes that may not even seem relevant to the calculation) may cause subtle differences.

Answer 3

The important message to take here is that replays can be used for cheat detection sometimes and not protection. Even so, it may be hard or impossible to detect some types of cheats. It also begs the question what is considered plain cheating and what would be taking full advantage of tools that most players may not consider..

Here is an example:

In a strategy game with keyboard shortcuts, player A creates some advanced keyboard macros that allow her to build up a base faster than any human player using ordinary controls. Is that cheating? Perhaps. But who can tell the difference? Perhaps a machine doing some statistics. Is the implementation here worth it?

On the other hand, there is a competition going online in a deterministic single player game supposedly protected from cheating but player A again records her keyboard input until she loses, then she plays back her keyboard input and continues from the spot before she lost. She then repeats this process to allow her to basically save her state. Can anyone tell she is cheating? Yes but it will require someone to check and compare different playthroughs, even then it would be hard.

Another thing that may be destructive in a game like you specifically described is if someone creates an AI bot that listens to the packets and computes an optimal decision based on the state of the game. This could be impossible to detect.

Generally I think the conclusion is that when you are working to detect or prevent cheats (like any other security related matter), whatever technique you are using, is being used on people and they may outsmart your or simply pick another way you haven't thought of to cheat the system. Human and especially cheaters, are very resourceful.