CheatDetector 0.5.2.1

[ImportBot]

Originally Posted by grizzlybeer*:

 

first, let me thank you for your donation :-) really nice

 

you are absolutely right. a player with normal stats, that suddenly turns on a cheat and kills everyone on the server will not get detected as of now. this is is the top priority feature for the next update.

also in the current version, an "impossible" spm can not be the only reason for a ban/kick (impossible spm triggers about 95%, the plugin only acts when 99% is reached). i will also improve that in the next update.

 

expect the next big update (including all the requested features) in a few weeks. i try to be quicker :-)

 

as for voteban or votekick, i have lower percentages needed on my server (for example only 2 players are needed to start a voteban but about 35% are needed to pass that ban), but i guess that depends on a lot of things. i have lower percentages because i want votekick or voteban to be used to kick baserapers and such and i see some players just dont vote, so i lowered the percentages.

 

 

for the problem described here myrcon.net/...cheatdetector-0521#entry31513 i can fully agree with oscarmike myrcon.net/...cheatdetector-0521#entry31523

 

-grizzly

 

 

Ah right, you have included these averages from istats within the code. Great, thanks for answering my questions.

 

From what I understand, the plugin relies on averages of weapons and player stats which are accumulated over time.

 

If a player suddenly gets a new aimbot and decides to turn it on in our server when he thinks admins are not around to go on a rampage, would CD not detect him while in our server because 1) it already checked and cleared him before he turned on the aimbot, and 2) he would have to cheat enough over time to affect his battlelog stats enough to trigger a CD ban?

 

 

Ice cold beer donation is on it's way.

 

(Please consider adding a description/note field to donations to allow us to include a quick note letting you know who is making the donation since the forum name usually won't match the donation name.)

 

Confirmation number: 3AD83663AJ769164X

 

 

 

 

Update:

 

Tonight, I encountered what all server owners fear with a hacker, and that is one who is blatantly open about his hacking while running rampant without an admin on to stop him. Neither Cheat Detector nor VoteBan stopped him.

 

I have to post this in both the Cheat Detector and the VoteBan threads to try to figure out why he got away with this until a player used @admin to notify an admin to stop him (happened to be me who saw it first).

 

Aimbotter entered the server at 23:09:11 and I banned him at 23:31:17, which was within a minute of receiving the @admin notification in ProCon because I happened to be working in ProCon at the time. Had I not been there to see this, Im confident this hacker would have emptied out a full 64-slot server (had 62/64 players at the time).

 

VoteBan didn't work with so many people starting votes and even more voting yes. My start Vote Ban number is 10, and my Vote Ban Pass Percentage is 70% which means 10 people are needed to start the vote, but once it starts, only 7 need to vote yes to ban him.

 

Cheat Detector didn't ban him, although I saw Cheat Detector ban three others today in two of our servers (two CD bans in this server and one CD ban in the other server today). Looking thru the logs, including the plugin log, I see that Cheat Detector only came back with this for him 40 seconds after he entered:

 

[23:09:51] CD - Suspicious stats: xXDeadlystrikeXx spm: 1413.29

 

He's a 95.5% CONFIRMED CHEATER per Cheat-O-Meter here:

http://www.team-des-fra.fr/CoM/bf3.p...DeadlystrikeXx

 

In just 20 minutes on the server, he reached 114-5. Had he stayed the whole map at this rate, he would have hit 345-15 theoretically, assuming he wouldn't have cleared out the server before reaching such an absurd score.

 

 

Why do you think Cheat Detector didn't ban him?

 

Im posting this in hopes that we might see something you could tweak to stop this kind of threat in the future.

 

Your thoughts GrizzlyBeer?

 

 

 

I can provide you with any logs you need, of course. But here's what I isolated for you from the plugin log as well as the chat log about aimbotter xXDeadlystrikeXx:

 

Code:

Aimbot Cheater:  xXDeadlystrikeXx
EA GUID:  EA_DFF2063396651B0AF4728001B48698A3
Battlelog Profile:  http://battlelog.battlefield.com/bf3/user/xXDeadlystrikeXx/  



EA_DFF2063396651B0AF4728001B48698A3 Guid Permanent xXDeadlystrikeXx BAN for Hacks (95.5% on CoM) by SD

95.5% CONFIRMED CHEATER per Cheat-O-Meter
http://www.team-des-fra.fr/CoM/bf3.php_p=xXDeadlystrikeXx

Score was 114-5 after only 20 minutes in the server:
http://battlelog.battlefield.com/bf3/battlereport/show/52190062/1/796862659/



20130101_plugin.log

[23:08:41] [Insane Balancer] Queueing xXDeadlystrikeXx for stats fetching
[23:08:41] [Insane Limits] Queueing xXDeadlystrikeXx for stats fetching

[23:08:41] [Insane Balancer] Queueing xXDeadlystrikeXx for stats fetching
[23:08:41] [Insane Limits] Queueing xXDeadlystrikeXx for stats fetching
[23:08:41] [Insane Balancer] Stats fetching thread is now awake!
[23:08:41] [Insane Balancer] Getting battlelog stats for xXDeadlystrikeXx, no more players in queue
[23:08:41] [Insane Limits] Thread(fetch): Battlelog Cache plugin is disabled; installing/updating and enabling the plugin is recommended for Insane Limits!
[23:08:41] [Insane Limits] Thread(fetch): WARNING: (StatsException) Unable to fetch stats for xXDeadlystrikeXx, cache is disabled and direct fetching is disabled!
[23:08:43] [Insane Balancer] xXDeadlystrikeXx, fetched, score(4100547), rank(55), skill(1097.69), kills(9309), deaths(1738) kdr(5.9), spm(1404.03), kpm(3.19), quits(46.46), acc(19.44)
[23:08:43] [Insane Balancer] Done fetching stats, 1 player in new batch, waiting for players list now
[23:08:43] [Insane Limits] Thread(fetch): Unable to fetch stats for xXDeadlystrikeXx
[23:08:43] AdaptiveServerSize: IDLE -> 62 players online. 1 players joining. Server size set to 64. Round started at 64.


[19:40:04] CD - IMPOSSIBLE STATS: Haddek AS-VAL k/h: 70.7% (4.42)
[19:40:04] CD - SUSPECTED CHEATING: Haddek 99%

[b][23:09:51] CD - Suspicious stats: xXDeadlystrikeXx spm: 1413.29[/b]

[23:48:33] CD - IMPOSSIBLE STATS: Nox163RUS SCAR k/h: 83.45% (4.21)
[23:48:33] CD - IMPOSSIBLE STATS: Nox163RUS UMP k/h: 65.05% (4.06)
[23:48:33] CD - IMPOSSIBLE STATS: Nox163RUS F2000 k/h: 59.84% (3.52)
[23:48:33] CD - IMPOSSIBLE STATS: Nox163RUS XP1 L85A2 k/h: 100% (6.06)
[23:48:33] CD - IMPOSSIBLE STATS: Nox163RUS XP2 MTAR-21 k/h: 91.46% (5.39)
[23:48:33] CD - SUSPECTED CHEATING: Nox163RUS 99%




Players Witnessed his Hacks per 20130101_chat.log


[b]ENTERED at [23:09:11] ADMININ_AND_SPAWNMSG - XXDEADLYSTRIKEXX > WELCOME![/b]


[23:16:37] LankyFTW > Deadlystrike is 38 an 0 with a pistol...
[23:16:43] xXDeadlystrikeXx > im not using a pistol
[23:16:52] Vaughngoalie > any admins_ seriously
[23:17:01] Slug281 > Yes you are 
[23:17:09] xXDeadlystrikeXx > im using a fucking sniper
[23:17:11] LankyFTW > thats funny... because I have been shot out of a tank twice, by you, with a pistol...
[23:17:58] Slug281 > Oh look again you kill with a pistol
[23:18:01] LankyFTW > oh wow... look what happened... Deadlystrike with a pistol, again

[23:20:38] LankyFTW > @voteban <xXDeadlystrikexX><Hacker hacker hacker_
[23:20:42] Indy_303 > @yes
[23:20:45] ImpactedHorse > @yes
[23:20:47] SS_Angelic > @yes
[23:20:47] LeHozay > yes
[23:20:53] LankyFTW > @yes

[b][23:20:56] xXDeadlystrikeXx > @hugeblackdick[/b]
[23:23:23] LankyFTW > Deadlystrikes... you are such a bitch

[23:23:26] Skullhumper229 > @voteban xXDeadlyStrikeXx aimbot
[23:23:33] ImpactedHorse > @yes
[23:23:37] Friznutz999 - Russian Army > @yes
[23:23:43] rascalea > @yes
[23:23:45] CrackOxidation > @yes
[23:23:48] hotdoggyurkeyam > @yes
[23:23:51] FourFingerFrank > @yes
[23:23:53] LeHozay - US Army > @voteban Strike <aimbot>
[23:23:54] -lSpAzl- > @voteban xXDeadlyStrikeXx
[23:23:56] FourFingerFrank > !yes
[23:24:04] -lSpAzl- > TK his ass
[23:24:05] LankyFTW > @yes
[23:24:09] Friznutz999 - Russian Army > Vote again please
[23:24:12] SandStalker2002 > @yes
[23:24:12] LeHozay > @yes
[23:24:15] ImpactedHorse > @yes
[23:24:16] SlowburnVv > @yes
[23:24:17] SS_Angelic > @ye
[23:24:17] LeHozay > wow
[23:24:19] -lSpAzl- > @yes
[23:24:21] SS_Angelic > @yes
[23:24:21] mrench01 > @yes
[23:24:23] LeHozay > its not even fucking working
[23:24:27] Slickbaby > @yes
[23:24:31] Friznutz999 > @yes
[23:24:37] LeHozay > @yes
[23:24:38] Friznutz999 > peice of shi
[23:24:41] LeHozay > @YES
[23:24:49] elzod > @yes
[23:24:55] Skullhumper229 > @voteban <xXDeadlyStrikeXx> <aimbot>
[23:25:10] Slickbaby - Russian Army > @yes
[23:25:18] SS_Angelic > @yes
[23:25:30] CrackOxidation > @voteban xxdeadlystrikexx aim what_
[23:25:36] ImpactedHorse > @yes
[23:25:41] LeHozay > 2yes
[23:25:42] SlowburnVv > @yes
[23:25:42] LankyFTW > so no admins_
[23:25:43] SS_Angelic > @yes
[23:25:45] LeHozay > @yes
[23:25:50] CrackOxidation > @yes
[23:25:52] SandStalker2002 > @yes
[23:25:53] LeHozay > yes
[23:25:57] Friznutz999 > @yes

[b][23:26:46] xXDeadlystrikeXx > @superomgmegahack-activate[/b]

[23:27:26] SandStalker2002 > @voteban xxdeadlystrikexx hacks
[23:27:28] Friznutz999 > This is gay
[23:27:35] Slug281 > 89-3 
[23:27:38] CrackOxidation > @yes
[23:27:43] SS_Angelic > @yes
[23:27:44] SandStalker2002 > @yes
[23:27:45] CrackOxidation > type @yes everyone
[23:27:48] Skullhumper229 > @voteban  xXDeadlyStrikeXx  Aimbot
[23:27:48] -lSpAzl- - US Army > TK that dickwad
[23:27:53] CaptBattlefield > @yes
[23:27:53] Iskaryotes > @yes
[23:27:55] Friznutz999 > @voteban 
[23:27:57] Slug281 > @yes
[23:27:59] DanTheMan1386 > @yes
[23:28:00] Friznutz999 > @yes
[23:28:03] ImpactedHorse > @yes
[23:28:09] FourFingerFrank > @yes
[23:28:10] DanTheMan1386 > how do u vote
[23:28:13] SandStalker2002 > @yes
[23:28:15] FourFingerFrank > !yes
[23:28:19] Davilizer > @yes
[23:28:19] CrackOxidation > type @yes dan
[23:28:19] LeHozay > @yes
[23:28:24] Friznutz999 > ban system doesnt work
[23:28:25] DanTheMan1386 > @yes
[23:28:36] Skullhumper229 > @yes

[23:28:49] Skullhumper229 > vote yes
[23:28:50] Slickbaby > @voteban xxdeadlystrikexx douchehammer
[23:28:53] TomJoadsGhost70 > @voteban <xXDeadlystrikeXx> <nobodys that good>
[23:28:55] ImpactedHorse > @voteban xxdeadlystrikexx hack
[23:28:56] SandStalker2002 > @voteban xxdeadlystrikesxx hacks
[23:28:57] Monkeeyoz > @yes
[23:28:58] DanTheMan1386 > @yes
[23:29:00] SlowburnVv > @yes
[23:29:03] Slug281 > @yes
[23:29:03] Friznutz999 > @yes
[23:29:05] SandStalker2002 > @yes
[23:29:05] SexyScoot - Russian Army > @yes
[23:29:06] Indy_303 > @yes
[23:29:08] rascalea > @yes
[23:29:12] -lSpAzl- - US Army > where is he_
[23:29:13] Skullhumper229 > vote @yes
[23:29:13] Slickbaby > @voteban xxdeadlystrikexx cockfag
[23:29:15] -lSpAzl- - US Army > just keep TKing his ass
[23:29:15] Slickbaby > @yes
[23:29:17] SexyScoot > vote @yes
[23:29:20] Friznutz999 > Report him to admin because he wont get banned
[23:29:21] DanTheMan1386 > cunt
[23:29:21] -lSpAzl- > @YES
[23:29:25] -lSpAzl- > vote @yes
[23:29:25] LeHozay > @yes
[23:29:27] Friznutz999 > admin
[23:29:29] CrackOxidation > @yes
[23:29:34] SS_Angelic > @yes
[23:29:38] SandStalker2002 > @yes
[23:29:40] Slickbaby > EVERYONE TYPE @voteban xxdeadlystrikexx douche

[b][23:29:46] Notify Me!: ImpactedHorse requested an admin! (voteban not working.. xxdeadlystrikexx hack)[/b]
[23:29:49] ImpactedHorse > @admin voteban not working.. xxdeadlystrikexx hack

[23:29:49] Skullhumper229 > @yes
[23:29:49] LankyFTW > what admin...
[23:29:49] LeHozay > @voteban deadly
[23:29:53] SandStalker2002 > @yes
[23:29:54] CrackOxidation > @yes
[23:29:57] LeHozay > yes
[23:30:02] Friznutz999 > Just email an admin and he will be banned forever when he comes on
[23:30:03] SandStalker2002 > @yes
[23:30:03] Monkeeyoz > @yes
[23:30:08] Friznutz999 > @yes
[23:30:10] Slickbaby > @yes
[23:30:19] DirtyHarryPinga > this game will be over before that ban actually works lolololol

[b][23:30:22] xXDeadlystrikeXx > !votebank slick super hack[/b]

[23:30:22] SandStalker2002 > @voteban xxdeadlystrikesxx hacks
[23:30:28] LeHozay > three more people have to type the whole thing out
[23:30:32] Friznutz999 > Report him on ea website too
[23:30:32] Ooyah > all sight seeing and shit lol

[23:30:35] xXDeadlystrikeXx > @voteback friz

[23:30:36] Friznutz999 > @yes
[23:30:37] elzod > @no
[23:30:40] -lSpAzl- - US Army - Foxtrot > hey deadly
[23:30:45] -lSpAzl- - US Army - Foxtrot > why ruin the game for everyone else_
[23:30:53] DirtyHarryPinga > @yes
[23:30:53] SS_Angelic > @voteban 
[23:31:02] LeHozay > EVERYBODY TYPE @voteban xXDeadlyStrikerXx
[23:31:08] Skullhumper229 > @voteban  xXdeadlyStrikeXx  aimbot
[23:31:16] DanTheMan1386 > HE IS CHEATING im watching im right NOW
[23:31:16] SS_Angelic > @voteban xxx deadlystrike xxx hacker
[23:31:17] DanTheMan1386 > IM ON HIS TEAM


[b]BANNED at [23:31:17] AdminIn_and_SpawnMsg > xXDeadlystrikeXx REMOVED for: xXDeadlystrikeXx BAN for Hacks (95.5% on CoM) by SDS[/b]


[23:31:18] DanTheMan1386 > @yes
[23:31:19] LankyFTW > Deadlystrike... go fist yourself.
[23:31:20] Friznutz999 > @voteban xXdeadlyStrikerXX <faggot>
[23:31:26] Monkeeyoz > @vote ban 
[23:31:27] LeHozay > just say @voteban deadly
[23:31:30] SS_Angelic > @voteban xxdeadlystrikexx hacker
[23:31:30] Ooyah > wait wait,
[23:31:34] CrackOxidation > hes gone_
[23:31:34] Ooyah > it said removed_
[23:31:35] -lSpAzl- > he was banned
[23:31:38] Skullhumper229 > use 2 spaces 
[23:31:40] ImpactedHorse > it worked now___

[23:31:43] Admin > Admin: I got him.  Thanks for contacting me.  xXDeadlystrikeXx  BANNED by IAF SDS

[ImportBot]

Originally Posted by IAF-SDS*:

 

first, let me thank you for your donation :-) really nice

 

as for voteban or votekick, i have lower percentages needed on my server (for example only 2 players are needed to start a voteban but about 35% are needed to pass that ban), but i guess that depends on a lot of things. i have lower percentages because i want votekick or voteban to be used to kick baserapers and such and i see some players just dont vote, so i lowered the percentages.

 

-grizzly

@GrizzlyBeer

 

Great, thanks for considering what I wrote and adding tweaks to the next version. I can't wait.

 

I thought by setting the vote ban Start Vote Ban Number to 10 with a Vote Ban Pass Percentage of 70% that this would mean 10 people need to vote (yes or no) and only 7 of those 10 people needed to vote yes to ban. I set them this way to avoid a group of friends from coming into the server and banning everyone. But this interpretation is totally incorrect.

 

With a Start Vote Ban Number set to 10, that actually means 10 different people need to type @voteban Name Reason and only once 10 different people type this @voteban command, then 70% of the total people voting during the set Vote Ban Duration (in minutes) time will have to vote yes.

 

I just wanted 7 people required to vote yes to be able to ban at any time, regardless of how many are voting or how long the duration lasts, with 10 minimum voting either way. What should we set the pass percentage to prevent the buddies of a banned hacker coming in and banning the server?

 

With only 1 or 2 people required to type @voteban to start the vote, and at 35% as the Vote Ban Pass Percentage, all it would require for lets say a gang of five to start banning people is two of them to vote yes (if others in the server didn't vote No to stop it and we know most don't bother to vote). Even at 70% as the Vote Ban Pass Percentage, a gang of five would only need four votes to ban innocent people.

 

Grizzly, I've seen you helping with VoteBan in that thread. Are you working on VoteBan with TimSad, or is it just TimSad?

 

I'll post my thoughts in more detail about VoteBan for TimSad in that thread. I inlcuded this here only as it relates to our discussion about cheaters connecting and emptying servers.

 

 

@IAF SDS

 

On topic of preventing cheaters connecting and emptying servers:

 

Our BF community runs 5 servers and on each server we have multiple cheater prevention mechanisms active. (Insane Limits, CheatDetector, Metabans, GGC-Stream, PBBans, Admin Notification) We also have Rconnet Premium (Hall of Shame plugin, synchronized ban lists on all servers) & Procon Layers for each server, making sure that if one fails, theres still another mechanism to keep domination hackers at bay while admins try and resolve the issue.

 

In any case, Metabans is very useful if you follow the accounts of both the French and German Cheatometer sites and other trustworthy admins. Most blatant cheaters have been banned in the past by those accounts (xXdeadlyStrikerXX has been previously banned on the 9th of December 2012 by the French cheatometer site).

@OscarMike

 

Thank you for taking the time to share your measures of cheat prevention.

 

After reading what you wrote, I need to rethink using Metabans.

 

I've seen reckless admins, my own and others from other clans, kill servers including a COD4 server I had a long time ago by banning left and right. This experience caused me pause in the future to subscribe to the banlists of other admins from other servers. We all know the effort necessary to populate and maintain successful servers, and I remained hesitant that I could easily do more harm than good if I started subscribing to banlists of other admins on metabans.

 

I would really appreciate it if you posted here or PMd me your recommendations of the trustworthy ones I should follow on Metabans please.

[ImportBot]

Originally Posted by BF3-FairPlay*:

 

are you from professional noobs servers ?

No, I'm not. My server is not released yet and I'm working on it right now. The priority is to make sure I have a good protection against cheaters and we can do a 24h monitoring

[ImportBot]

Originally Posted by HexaCanon*:

 

No, I'm not. My server is not released yet and I'm working on it right now. The priority is to make sure I have a good protection against cheaters and we can do a 24h monitoring

magic trick for insane limits

 

Code:

if (Regex.Match(player.CountryCode, "(RU)", RegexOptions.IgnoreCase).Success) {
    plugin.PRoConChat("Kicking russian player : " + player.Name);
    plugin.KickPlayerWithMessage(player.Name, "Sorry, but we do not allow Russian players.");
}

get rid of 70%+ of hackers easily.

[ImportBot]

Originally Posted by OscarMike*:

 

@OscarMike

 

After reading what you wrote, I need to rethink using Metabans.

 

I've seen reckless admins, my own and others from other clans, kill servers including a COD4 server I had a long time ago by banning left and right. This experience caused me pause in the future to subscribe to the banlists of other admins from other servers. We all know the effort necessary to populate and maintain successful servers, and I remained hesitant that I could easily do more harm than good if I started subscribing to banlists of other admins on metabans.

 

I would really appreciate it if you posted here or PMd me your recommendations of the trustworthy ones I should follow on Metabans please.

The good thing about Metabans these days is that you can highly tweak your settings for following other people and enforcing bans. For example, you can list certain "keywords" (ie. cheater / hacker) from which only bans with those reasons will be enforced even if you follow the account. Therefore, you can highly customize the enforced bans for your own liking. This is what I have done, and it hasn't given us grief from false-positive bans. I also check our Metabans account daily to assess/monitor bans. Another useful part of Metabans is a web interface scoreboard, where you can see all connected players on your servers, giving you a quick overview of the players' standings with Metabans (# of bans, # of protections, etc.). If a player has several bans or bad ratings to their name, it is very quick to manually check their player stats and act accordingly.

 

Quick List of trustworthy Metabans accounts:

 

- Cheatometer (French) : Metabans account

 

- Cheatometer (German) Metabans account (If you enter a suspicious player name into their cheatometer website, it automatically alerts their admin team to review the player. If guilty, the bans are added to their Metabans account and enforced. I find this very useful as they ban a handful of very guilty players everyday!)

 

- HexaCanon: Metabans account (Should be a familiar guy from these forums)

 

- Oscarmike.com: Metabans account - My community's account, all our bans are assessed & reviewed objectively.

 

Feel free to PM me if you have any questions.

[ImportBot]

Originally Posted by HexaCanon*:

 

The good thing about Metabans these days is that you can highly tweak your settings for following other people and enforcing bans. For example, you can list certain "keywords" (ie. cheater / hacker) from which only bans with those reasons will be enforced even if you follow the account. Therefore, you can highly customize the enforced bans for your own liking. This is what I have done, and it hasn't given us grief from false-positive bans. I also check our Metabans account daily to assess/monitor bans. Another useful part of Metabans is a web interface scoreboard, where you can see all connected players on your servers, giving you a quick overview of the players' standings with Metabans (# of bans, # of protections, etc.). If a player has several bans or bad ratings to their name, it is very quick to manually check their player stats and act accordingly.

 

Quick List of trustworthy Metabans accounts:

 

- Cheatometer (French) : Metabans account

 

- Cheatometer (German) Metabans account (If you enter a suspicious player name into their cheatometer website, it automatically alerts their admin team to review the player. If guilty, the bans are added to their Metabans account and enforced. I find this very useful as they ban a handful of very guilty players everyday!)

 

- HexaCanon: Metabans account (Should be a familiar guy from these forums)

 

- Oscarmike.com: Metabans account - My community's account, all our bans are assessed & reviewed objectively.

 

Feel free to PM me if you have any questions.

note that not all of my bans are for hacking, some are for going out of map glitch (metro roofing) and some are for the behavior (example : ).

 

i also want to say that Oscarmike is a well known community .

[ImportBot]

Originally Posted by IAF-SDS*:

 

Very cool.

 

Thank you OscarMike and Hexa for taking the time to provide this input.

 

I came down with the flu or cold last night, but I will look into this as soon I feel better.

[ImportBot]

Originally Posted by grizzlybeer*:

 

@GrizzlyBeer

 

Great, thanks for considering what I wrote and adding tweaks to the next version. I can't wait.

 

I thought by setting the vote ban Start Vote Ban Number to 10 with a Vote Ban Pass Percentage of 70% that this would mean 10 people need to vote (yes or no) and only 7 of those 10 people needed to vote yes to ban. I set them this way to avoid a group of friends from coming into the server and banning everyone. But this interpretation is totally incorrect.

 

With a Start Vote Ban Number set to 10, that actually means 10 different people need to type @voteban Name Reason and only once 10 different people type this @voteban command, then 70% of the total people voting during the set Vote Ban Duration (in minutes) time will have to vote yes.

 

I just wanted 7 people required to vote yes to be able to ban at any time, regardless of how many are voting or how long the duration lasts, with 10 minimum voting either way. What should we set the pass percentage to prevent the buddies of a banned hacker coming in and banning the server?

 

With only 1 or 2 people required to type @voteban to start the vote, and at 35% as the Vote Ban Pass Percentage, all it would require for lets say a gang of five to start banning people is two of them to vote yes (if others in the server didn't vote No to stop it and we know most don't bother to vote). Even at 70% as the Vote Ban Pass Percentage, a gang of five would only need four votes to ban innocent people.

 

Grizzly, I've seen you helping with VoteBan in that thread. Are you working on VoteBan with TimSad, or is it just TimSad?

 

I'll post my thoughts in more detail about VoteBan for TimSad in that thread. I inlcuded this here only as it relates to our discussion about cheaters connecting and emptying servers.

i run a custom version of voteban (added viplist to increase votecounts and such). but for everything regarding voteban i would recommend asking timsad, as you already did. but you are also welcome to pm me if you want :-) but to be clear voteban belongs timsad :-)

 

to prevent some players ganging up and voting the server empty, i would recommend setting the threshold to at least 16 with the pass percentage of 25%. this would require at least 4 players (starting with 16 online) voting yes. i have set a threshold of 24 with a pass percentage of 19%. that requires 5 players voting yes (starting with 24 online).

 

still you are right the voting system itself is always vulnerable, but thats ok i guess :-)

[ImportBot]

Originally Posted by IAF-SDS*:

 

Thanks GrizzlyBeer for your input about settings for voteban.

 

 

Regarding Cheat Detector, I've seen that 8 out of 10 Cheat Detector bans so far are for having a high k/h (kills per hit).

 

I run HardCore, and I was curious if running HardCore with 60% health would produce false bans since it takes less hits to kill in HardCore. Or am I thinking about this wrong?

 

I've checked every ban shown below on CoM and most have a high percentage of confirmed cheater.

 

Still wondering if HardCore impacts the k/h (kills per hit) analysis within Cheat Detector.

 

Code:

The following stats are checked:
Player SPM (score per minute)
Weapon k/m (KPM, kills per minute)
Weapon hs/k (HSPK, headshots per kill)
Weapon k/h (KPH, kills per hit)
Weapon accuracy

A player is considered cheating if he has 4 suspicious stats or 1 impossible stat.



IAF #1 Cheat Detector Bans

1.     EA_1780AA937CDB428E2AD80375F104BE0A Guid Permanent BAN SUSPECTED CHEAT: w-Baltazar-w AS-VAL
 k/h: 75.42%
[url=http://www.team-des-fra.fr/CoM/bf3.php_p%3Dw-Baltazar-w]http://www.team-des-fra.fr/CoM/bf3.php_p=w-Baltazar-w[/url]  (88.5% CoM)

2.   EA_2DB7985381BDAD7BA1692F020DD80939 Guid Permanent BAN SUSPECTED CHEAT: TheLawl3ss SG553
 k/h: 70.09%
[url=http://www.team-des-fra.fr/CoM/bf3.php_p%3DTheLawl3ss]http://www.team-des-fra.fr/CoM/bf3.php_p=TheLawl3ss[/url]  (99.9% CoM)

3.   EA_0A35DEB2101DD2A7A071A0AECE548D53 Guid Permanent BAN SUSPECTED CHEAT: ElKaputtos UMP
 k/h: 69.84%
[i]Cheat-O-Meter: This Player doesn't have enough stats or playtime for an assessment![/i]

4.   EA_F9091D9C9D8CB9B14B913ECB756D4293 Guid Permanent BAN SUSPECTED CHEAT: CammandoDad UMP
 hs/k: 72.54%
[url=http://www.team-des-fra.fr/CoM/bf3.php_p%3DCammandoDad]http://www.team-des-fra.fr/CoM/bf3.php_p=CammandoDad[/url]  (77.8%)

5.   EA_5ECA5EAAF5B3CB73C519D633115050A8 Guid Permanent BAN SUSPECTED CHEAT: Netvox M416
 k/h: 61.67%
[i]Cheat-O-Meter: This Player doesn't have enough stats or playtime for an assessment![/i]



IAF #2 Cheat Detector Bans

1.     EA_658D73C1D81A028C9E2C3CB17335D7A3 Guid Permanent BAN SUSPECTED CHEAT: Haddek AS-VAL
 k/h: 70.7%
[url=http://www.team-des-fra.fr/CoM/bf3.php_p%3DHaddek]http://www.team-des-fra.fr/CoM/bf3.php_p=Haddek[/url]  (32.6% CoM)

2.        EA_1C2EA07E9C3AA23E3A2946DE01C2BDA2 Guid Permanent BAN SUSPECTED CHEAT: Nox163RUS XP1 L85A2 k/h: 100%
[url=http://www.team-des-fra.fr/CoM/bf3.php_p%3DNox163RUS]http://www.team-des-fra.fr/CoM/bf3.php_p=Nox163RUS[/url]  (50.4% CoM)

3.     EA_A81494338AEEC27772FE6E95E56E24ED Guid Permanent BAN SUSPECTED CHEAT: S0oap PP2000
 hs/k: 69.43%
[url=http://www.team-des-fra.fr/CoM/bf3.php_p%3DS0oap]http://www.team-des-fra.fr/CoM/bf3.php_p=S0oap[/url]  (44.4% CoM)

4.     EA_63E156EBDBA4939FDADB25B5000626CA Guid Permanent BAN SUSPECTED CHEAT: 1tWasntM3 M249
 k/h: 53.85%
[url=http://www.team-des-fra.fr/CoM/bf3.php_p%3D1tWasntM3]http://www.team-des-fra.fr/CoM/bf3.php_p=1tWasntM3[/url]  (47.1% CoM)

5.     EA_5ECA5EAAF5B3CB73C519D633115050A8 Guid Permanent BAN SUSPECTED CHEAT: Netvox M416
 k/h: 61.67%
[i]Cheat-O-Meter: This Player doesn't have enough stats or playtime for an assessment![/i]

[ImportBot]

Originally Posted by ty_ger07*:

 

I would say that hardcore mode definitely does affect the hits per kill statistic. But in Grizzly's defense, he is using an average hits per kill percentage based on hundreds of thousands of players which means that hardcore servers are naturally already represented in the statistical average.

[ImportBot]

Originally Posted by dyn*:

 

I too run hardcore servers and of the thousands of players checked thus far the biggest false positives come from high headshot percentage on only 1 weapon. It seems to be working well.

 

hits / kills false positives don't seem to be flagging like I expected.

[ImportBot]

Originally Posted by OscarMike*:

 

I too run hardcore servers and of the thousands of players checked thus far the biggest false positives come from high headshot percentage on only 1 weapon. It seems to be working well.

I have noticed this as well lately - most cheaters have chosen only 1 weapon on which they have a HKP of 70-140%+. All other weapons seem "normal" in an attempt to hide/mask the impossible weapon stats.

 

I haven't had any false-positive bans yet though, mainly because most of the bans are for Russian players late at night when the admins are sleeping..

[ImportBot]

Originally Posted by HexaCanon*:

 

I have noticed this as well lately - most cheaters have chosen only 1 weapon on which they have a HKP of 70-140%+. All other weapons seem "normal" in an attempt to hide/mask the impossible weapon stats.

 

I haven't had any false-positive bans yet though, mainly because most of the bans are for Russian players late at night when the admins are sleeping..

I dealt with those russians by only allowing those who make an application and investigated to be allowed on my servers.

[ImportBot]

Originally Posted by OscarMike*:

 

I dealt with those russians by only allowing those who make an application and investigated to be allowed on my servers.

That would explain why our servers have suddenly experienced a massive influx of russian players in the last days. During the morning, of all connected players we had an average of 60% russian players on http://ziba.oscarmike.com. However, our anticheat mechanisms have done good so far *Fingers crossed*. Otherwise we may have to implement a similar approach due to the massive influx. I wouldn't want to ban the entire region because they help a lot in the mornings in terms of filling our struggling servers that don't make it through the night.

 

On another topic, would appreciate your input in the ...* thread.

[ImportBot]

Originally Posted by HexaCanon*:

 

That would explain why our servers have suddenly experienced a massive influx of russian players in the last days. During the morning, of all connected players we had an average of 60% russian players on http://ziba.oscarmike.com. However, our anticheat mechanisms have done good so far *Fingers crossed*. Otherwise we may have to implement a similar approach due to the massive influx. I wouldn't want to ban the entire region because they help a lot in the mornings in terms of filling our struggling servers that don't make it through the night.

 

On another topic, would appreciate your input in the ...* thread.

you should thank me for filling your servers , i do admit that i have less activity now in the morning but it is better. i have received lots of applications and i am adding 15-20 players everyday.

[ImportBot]

Originally Posted by LumpyNutZ*:

 

I have a little problem with CD, first when i installed it, it was working fine giving ingame notifications and banned some people.

Afterwards it hasnt made any notifications nor banned anyone.

Have manually checked some players from istats.net and they have had A LOT suspicous stats.

Could it have something to do with this:

Code:

[22:17:17 91] [Insane Balancer] EXCEPTION: System.Net.WebException: The remote server returned an error: (429) Too Many Requests.
[22:17:17 91] [Insane Balancer] Extra information dumped in file InsaneBalancer.dump
[22:17:17 91] [Insane Balancer] EpicPoul, fetched, score(0), rank(0), skill(0), kills(0), deaths(0) kdr(0), spm(0), kpm(0), quits(0), acc(0)

tbh this is not IB thread, but just asking.

[ImportBot]

Originally Posted by HexaCanon*:

 

I have a little problem with CD, first when i installed it, it was working fine giving ingame notifications and banned some people.

Afterwards it hasnt made any notifications nor banned anyone.

Have manually checked some players from istats.net and they have had A LOT suspicous stats.

Could it have something to do with this:

Code:

[22:17:17 91] [Insane Balancer] EXCEPTION: System.Net.WebException: The remote server returned an error: (429) Too Many Requests.
[22:17:17 91] [Insane Balancer] Extra information dumped in file InsaneBalancer.dump
[22:17:17 91] [Insane Balancer] EpicPoul, fetched, score(0), rank(0), skill(0), kills(0), deaths(0) kdr(0), spm(0), kpm(0), quits(0), acc(0)

tbh this is not IB thread, but just asking.

too many requests for stats. it is a long story.

[ImportBot]

Originally Posted by KillaKali*:

 

can someone help me with this exception:

 

[16:21:53 85] Exception getResult: Request for the permission of type 'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

[ImportBot]

Originally Posted by ty_ger07*:

 

can someone help me with this exception:

 

[16:21:53 85] Exception getResult: Request for the permission of type 'System.Net.WebPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

If you are connecting directly to the game server (not using a PRoCon Layer server), in your PRoCon client, disable Plugin Sandbox mode by clicking Tools -> Options -> Plugins Tab -> Run plugins with no restrictions.

 

If you are connecting to a layer server, change your Layer server's procon.cfg file via FTP. Stop the layer server and then change this line "procon.private.options.runPluginsInSandbox True" to "procon.private.options.runPluginsInSandbox False". Then start the layer server.

 

That should do it.

[ImportBot]

Originally Posted by KillaKali*:

 

ty_ger07, i will gladly have your baby!!! THANKS!!

[ImportBot]

Originally Posted by LumpyNutZ*:

 

too many requests for stats. it is a long story.

So CD is failing because of this?

[ImportBot]

Originally Posted by BF3-FairPlay*:

 

So CD is failing because of this?

Try setting your MySQL database and enable BattleCache plugin to work with IL

[ImportBot]

Originally Posted by HexaCanon*:

 

Try setting your MySQL database and enable BattleCache plugin to work with IL

tbh either use IL or CD for cheat detecting.

[ImportBot]

Originally Posted by grizzlybeer*:

 

I have a little problem with CD, first when i installed it, it was working fine giving ingame notifications and banned some people.

Afterwards it hasnt made any notifications nor banned anyone.

Have manually checked some players from istats.net and they have had A LOT suspicous stats.

Could it have something to do with this:

Code:

[22:17:17 91] [Insane Balancer] EXCEPTION: System.Net.WebException: The remote server returned an error: (429) Too Many Requests.
[22:17:17 91] [Insane Balancer] Extra information dumped in file InsaneBalancer.dump
[22:17:17 91] [Insane Balancer] EpicPoul, fetched, score(0), rank(0), skill(0), kills(0), deaths(0) kdr(0), spm(0), kpm(0), quits(0), acc(0)

tbh this is not IB thread, but just asking.

generally, if you are in doubt if CheatDetector is working, set the debug level to 2 (or higher) and you should see the plugin reporting 0% for every player joining your server. debug level 1 will only show detections.

 

regarding the stats fetching: CheatDetector manages all stats fetching and reacting to timeouts by itself. other plugins need to do the same. the battlelog cache does solve this problem, but it does not provide dynamic throtteling or re-fetching and it requires a sql db.

CheatDetector is designed as a standalone sollution not needing any db or further setup and to be working regardless of what other plugins you installed or what they do :-)

i will add an option to use battlelog cache in future updates, but this is not a priority.

 

 

I would say that hardcore mode definitely does affect the hits per kill statistic. But in Grizzly's defense, he is using an average hits per kill percentage based on hundreds of thousands of players which means that hardcore servers are naturally already represented in the statistical average.

exactly :-)

[ImportBot]

Originally Posted by PapaCharlie9*:

 

Could it have something to do with this:

Code:

[22:17:17 91] [Insane Balancer] EXCEPTION: System.Net.WebException: The remote server returned an error: (429) Too Many Requests.
[22:17:17 91] [Insane Balancer] Extra information dumped in file InsaneBalancer.dump
[22:17:17 91] [Insane Balancer] EpicPoul, fetched, score(0), rank(0), skill(0), kills(0), deaths(0) kdr(0), spm(0), kpm(0), quits(0), acc(0)

Even though grizzly rightly points out that CD is independent of other plugins, the fact that Battlelog is a shared resource does mean that these errors are relevant to how well CD is working. In general, if one plugin is failing to fetch stats from Battlelog, all of them are.

 

However, all this means is that CD can't make an evaluation for any player for which stats cannot be fetched. Unless you are seeing this exception for every player that joins your server, it should only impact a percentage of evaluations. That said, the more game servers you have connected to a single layer/Procon instance and the more players you have on each server, the more likely you will reach the error threshold that makes the fetch for every player fail from that point on. In lieu of CD changing to use Battlelog Cache, your best workaround is to use more layers/Procon instances. Spread out your requests across multiple IP addresses.

 

BTW, now that we have database integration as an option, rather than use giant conglomerate averages from istats.net or bf3stats.com or whatever, we should start building our own community averages. This will be particularly useful for Hardcore, Infantry Only or Metro Only servers, where the averages aren't representative of the majority of your particular sub-community.

 

 

See here: www.phogue.net/forumvb/showth...stats-database*

[ImportBot]

Originally Posted by LumpyNutZ*:

 

Ok guys thanks for your input, will try to figure out something

[ImportBot]

Originally Posted by LumpyNutZ*:

 

Code:

[22:17:17 91] [Insane Balancer] EXCEPTION: System.Net.WebException: The remote server returned an error: (429) Too Many Requests.
[22:17:17 91] [Insane Balancer] Extra information dumped in file InsaneBalancer.dump
[22:17:17 91] [Insane Balancer] EpicPoul, fetched, score(0), rank(0), skill(0), kills(0), deaths(0) kdr(0), spm(0), kpm(0), quits(0), acc(0)

Ok, this is solved for now and battlelog cache plugin was the one to solve it.

When trying to solve this i noticed that my layer was still running 1.4.0.4 and there was a moment when i were totally lost what about blcache plugin these guys are talking.

But updated layer to .0.6 and lookslike everything is working well now.

Sorry for asking these stupid questions, i think this was all my bad

 

~Lumpy Out

[ImportBot]

Originally Posted by russel5*:

 

Hi. Tell me why this guy not banned

http://i-stats.net/index.php_action=...r=Check+Player

http://www.team-des-fra.fr/CoM/bf3.php_p=MrUnname

He is 100% aimbot

On my own server he was banned my AimDetect for ProconRules with stats 52% HS

[ImportBot]

Originally Posted by grizzlybeer*:

 

Hi. Tell me why this guy not banned

http://i-stats.net/index.php_action=...r=Check+Player

http://www.team-des-fra.fr/CoM/bf3.php_p=MrUnname

He is 100% aimbot

On my own server he was banned my AimDetect for ProconRules with stats 52% HS

weapons that could be rated suspicious have not enough kills to be taken into account by CheatDetector, like m9 with 75% hs/k (which would be considered impossible, 360% above average) but only 68 kills. 130 kills are needed for now.

other weapons which have enough kills are not rated suspicious because they dont exeed the averages too much, like the sv98 with 90% ks/k which is "only" 160% above the average

 

i can certainly see why you consider this player a cheater.

in addition to the suspicious (not impossible) stats, he received several pb violations, but all of them are "comfail"

 

Code:

[01.08.2013 05:59:57] |144088| VIOLATION (COMFAIL) #133: MrUnname (slot #25) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.60.144:3659] 
[01.07.2013 12:14:28] |27124| VIOLATION (COMFAIL) #133: MrUnname (slot #18) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.35.80:3659] 
[01.04.2013 10:28:51] |54310| VIOLATION (COMFAIL) #133: MrUnname (slot #11) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.57.189:3659] 
[01.04.2013 09:07:40] |287299| VIOLATION (COMFAIL) #133: MrUnname (slot #23) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.57.189:3659] 
[01.03.2013 12:52:45] |37947| VIOLATION (COMFAIL) #133: MrUnname (slot #7) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.33.82:3659] 
[01.03.2013 03:02:33] |57860| VIOLATION (COMFAIL) #133: MrUnname (slot #4) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.33.82:3659] 
[01.03.2013 01:35:21] |70259| VIOLATION (COMFAIL) #133: MrUnname (slot #44) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.33.82:3659] 
[01.02.2013 12:40:19] |53296| VIOLATION (COMFAIL) #133: MrUnname (slot #17) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.39.194:3659] 
[01.02.2013 12:31:30] |52834| VIOLATION (COMFAIL) #133: MrUnname (slot #6) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.39.194:3659] 
[01.02.2013 12:25:57] |52528| VIOLATION (COMFAIL) #133: MrUnname (slot #48) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 37.150.80.242:3659] 
[01.02.2013 08:00:33] |257215| VIOLATION (COMFAIL) #133: MrUnname (slot #25) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.51.53:3659] 
[01.02.2013 07:50:16] |256825| VIOLATION (COMFAIL) #133: MrUnname (slot #28) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.51.53:3659] 
[01.02.2013 07:46:20] |256685| VIOLATION (COMFAIL) #133: MrUnname (slot #17) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.51.53:3659] 
[01.02.2013 07:43:41] |256592| VIOLATION (COMFAIL) #133: MrUnname (slot #8) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.51.53:3659] 
[01.02.2013 03:22:09] |98042| VIOLATION (COMFAIL) #133: MrUnname (slot #24) No Packet Flow [ab3bb8ec6a81c8181ca65b7212cab1a9(-) 2.133.51.53:3659]

to force the detection of such stats (asuming he is a 100% cheater) weapons with less kills would need to be taken into account which does increase the false positives.

 

the stats are just not suspicious enough to make a final jugdement. if he is suspicious ingame too just ban him :-)

[ImportBot]

Originally Posted by Mgalbraith*:

 

Hi - a word of warning about this plugin for all high volume servers.

 

We run 3 servers which are usually full to the 64p limit.

 

This plugin was using on average 30MB of traffic every 5 minutes! which is about 600MB an hour...(for 3 instances of the script).

 

The sooner that this plugin uses the battlelog cache the better otherwise we might all be consuming a lot more data on our internet plans...

 

 

Cheat Detector Data Usage.png