14
\$\begingroup\$

I'm looking to create a multiplayer top down shooter. While I've read about different topics, I can see them I've got some real challenges ahead, but I'm all up for it.

One thing I can't understand is how am I supposed to be protecting the game from people who try to create bots?

What I mean is, as far as I understand, it's impossible to protect the network traffic in a way that players won't be able to create programs that listen to what's going on and understand it.

So what worries me is that people can create bots that listen to the current location of rival players, and send communication that mimic as if the player is shooting in the exact "perfect" location to win that match.

So what kind of techniques are used to protect real time games from such bots?

Also I'd like to mention that I've tried searching for discussions (as this sounds like something many people struggle with), but couldn't find anything about it specifically, only as a part of broader questions about networking in real time games. If I should have looked harder feel free to put me in my place :)

|improve this question|||||
\$\endgroup\$
  • \$\begingroup\$ Punkbuster, hehe.. There is a reason there is a third party app that detects third party apps and alterations :) \$\endgroup\$ – James Mar 17 '11 at 23:52
  • \$\begingroup\$ Why are you worried if people create bots? Maybe you can work around it, so it's just not a problem. \$\endgroup\$ – Beska Mar 18 '11 at 13:15
  • \$\begingroup\$ @James Punkbuster is horrible. I am many others have had bad experiences trying to play new games when they come out. Constantly get kicked for some punkbuster error, not fun. \$\endgroup\$ – AttackingHobo Mar 18 '11 at 19:48
  • \$\begingroup\$ @Beska: as cool as that sounds I need some serious convincing that bots wont destroy the game for non-bot players. I sure a game could be designed where bots would not ruin the experience. I am quite certain that for most online multiplayer games it's non-trivial to make the game mechanics bot proof. \$\endgroup\$ – deft_code Mar 18 '11 at 19:49
  • \$\begingroup\$ @AttackingHobo All I meant to point out is that there are entire companies who do nothing but attempt to figure out a solution to this problem. PunkBuster is just one of the more known pieces of software that attempts to do this, good or bad :) \$\endgroup\$ – James Mar 18 '11 at 22:05
8
\$\begingroup\$

There are two approaches to countering bots. They are client-side protection and server-side analysis.

Client-side protection is the most obvious approach - brute force, in a sense. You make all efforts to ensure that the game client is fully legitimate, has not been tampered with, and no other programs affect it. Now this is a difficult problem, and impossible to fully solve. But many games try, and have some success with this method. I know there exist some ready-made solutions for client protection, and suggest you look for them. Implementing one yourself is a daunting task.

In addition to being less then 100% effective, client-side protection has the drawback of being extremely annoying for your players. Usually it implies things like disabling alt-tab task switching, antivirus programs, etc.

Server-side analysis is less intrusive. In this approach, you have some server code that analyses patterns in players' behavior. Most often, bots play demonstrably different. For example, human players have varying time between actions (such as shooting), and this time obeys a bell-curve distribution. Primitive bots will have constant time, or distributed evenly over some interval. Fun fact: using this method, we once caught a player with a mechanical bot - a clever device that pushed buttons on his physical keyboard. Needless to say, not amount of client protection can catch that. Still, this analysis is not perfect. More advanced bots will fool your systems, and the more checks you implement, the more advanced bots would become.

For best protection, you can combine both these methods. Client protection will make it harder to develop bots, and server analysis will stop simple bots that were developed quickly. But whatever you do, you can never stop bots entirely. Well, unless you send your representatives to players' homes, to supervise their playing and report violations. (Which is not unheard of, by the way. I've definitely read a story about online poker company sending people to a very successful player's home, to confirm he was playing legitimately. But I can't seem to find it now.)

There are two more dubious recommendations for fighting bots. One, encrypt your network traffic. I don't think this is gonna work. With your client in the hands of an enemy, traffic can be and will be decrypted... or you own client will be used for encryption. On the other hand, encryption adds lag, and that is really bad for a "real-time shooter". Second recommendation is "just design your game around this". While this seems like a sound idea, I've yet to see a single game that managed this.

|improve this answer|||||
\$\endgroup\$
  • 1
    \$\begingroup\$ I doubt you found a guy with a mechanical bot. It was more likely a software bot that emulated a hardware keyboard for the inputs. \$\endgroup\$ – AttackingHobo Mar 18 '11 at 15:30
  • 2
    \$\begingroup\$ No, actual mechanical bot. The author sent us pictures. Unfortunately, they're already deleted from server (it was back in 2007!), so you'll have to take my word for it. \$\endgroup\$ – Nevermind Mar 18 '11 at 19:35
  • \$\begingroup\$ thanks for the response. I suppose encryption could "raise the bar" a bit and shield from many of the hackers. But would any real communication encryption be practical in time-critical games such as shooters, or even MMO's? \$\endgroup\$ – Zaky German Mar 24 '11 at 17:10
  • \$\begingroup\$ None of the games I worked on used encryption anywhere except login sequence, so I don't know just how much it affects lag. Depends on encryption algorithm, I guess. \$\endgroup\$ – Nevermind Mar 24 '11 at 17:52
2
\$\begingroup\$

I wouldn't expect any of the big players to talk about what they do to protect their games. The less people know about what they're doing, the harder it is for people to work around it. I think part of what Steam does is look for certain applications running that are on a black list.

Personally I'd try and encrypt and obfuscate communication as much as possible between communicating machines, it might be worth reading up on the way https/ssl works to get some ideas. If the hosts were to generate a random public/private keys and only send the public part out to other clients then something wouldn't easily be able to intercept and change the contents of the packages being sent, although if you have access to the client machine then nothing is completely secure.

You'll also need to ensure that the client exe isn't tampered with.

|improve this answer|||||
\$\endgroup\$
1
\$\begingroup\$

Design your game so that team work and actual intelligent decisions are more important than being able to aim perfectly. It becomes exponentially harder to make decent bots.

|improve this answer|||||
\$\endgroup\$
  • \$\begingroup\$ I think that games that depend on teamwork and preparation, and games that depend on pure twitch skills have their place. Still I don't think anyone should adapt their game design choices to technical obstacles \$\endgroup\$ – Zaky German Mar 18 '11 at 17:09
  • \$\begingroup\$ @Zaky: I once prototyped a worms-style game where during sudden death the screen would slowly fill with an SPH fluid. It looked really cool until the game lagged to death. I think many game design decisions are effected by technical obstacles. \$\endgroup\$ – deft_code Mar 18 '11 at 19:57
  • \$\begingroup\$ @deft_code I meant game design as in gameplay mechanics, not artistic or graphical design \$\endgroup\$ – Zaky German Mar 18 '11 at 20:02
  • \$\begingroup\$ My use of SPH is as much a game mechanic as the watery death in worms. I just change the way the water interacted with the game. \$\endgroup\$ – deft_code Mar 18 '11 at 23:41
0
\$\begingroup\$

And ask yourself the all important question of whether it's worth the trouble. Cheaters and botters can do 2 things:

  1. destroy the game for themselves. They can't play without the bot, they quickly loose interest and leave because it's no fun.
  2. destroy the game for others. They become overly powerful through their bot, thus costing you customers. This is usually accompanied by a single player controlling multiple bots from the same physical computer (or uses far more computers than a single player can be expected to control manually).

The two aren't mutually exclusive of course.

Usually then the biggest problem is 3+ (as a human being can with training use 2 keyboards or other input devices at the same time, but not more as he only has 2 hands) clients from the same or closely related ip addresses (or MAC addresses) acting in direct unison, executing commands within milliseconds of each other. So if you detect say 5 clients originating from the same ip address all giving commands at an abnormally high rate and at abnormally close coordination, you likely have found your botter. Usually this'll be most damaging in pvp scenarios where this bot army can dominate an engagement against a similar number of human controlled toons due to its higher coordination and speed. In pve scenarios, typically there's limited damage to the game (except in that it allows one person to train multiple toons to high levels more quickly, a typical characteristic of powerleveller companies, a constant scourge in the mmo industry).

|improve this answer|||||
\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.