Speculating on Blizzard's detection method

[rk53]

I'm willing to bet that the automated detection tools used by Blizzard are somewhat similar to the concept of IDS commonly used in network security to detect intrusions.

How would such a system work? A ton of metrics describing your activities as a player are aggregated over time. These metrics probably include your daily online time, daily node gathering count, daily pick pocket count, daily mob kills, auction posted, gold traded, gold from vendor, afk time, zone change count, messages sent, instances created, achievement points, honor points, etc. The next step for them is to identify the suspicious players. This is usually done using machine learning predictions based on a training data set of real player patterns and bot patterns.

This leads me to think that variety is probably the most important thing to avoid bans. Botting LFR, BG or dungeons on top of gather buddy for an additional couple of hours a week might reduce the chances of getting banned. E.G. 6 hours of gather buddy is probably more risky than 6 hours of gather buddy followed by an hour of LFR. This is based on the fact that a false positive ban is extremely damaging for them. The introduction of a very slight player-like behavior will therefor most likely reduce the risks.

This would also explain why people often lose only a certain percentage of their accounts. Machine learning classification can be very sensitive to only slight differences in the activity pattern, leading to the ban of only a portion of the accounts. Obviously, i'm not talking about IP bans, which are most likely the result of manual investigation following player reports.

Thoughts?

 

[Proceed]

No thats not how it works, its so easy to flag a bot and let a GM look into it, they earn money with every bot that pays monthly subscription fees, and they probably dont act as long as a paying bot is not reported too often, thats criteria id be analyzing.
I have been spamming so many auctions (at least 300 daily, sometimes 600) and botting for 18 hours straight with accounts that lasted for 4 months or longer.
There are botters who bot their main accounts, and they basically have only expirience with one account, and there are people that lost hundreds or thousands of accounts, the second group does not talk about it that much, because its calculated risk, and they only lose a couple of $ which they already earned.
Also in the most cases, someone who has a subscription for over 2 years will never recieve a permaban which wont be changed with a ticket.
I for example never botted my main, but bought gametime with gold it was 7k per month, and recieved D3 for an annual subscription, as they realized it was chinese stolen CC money used for RAF they only removed the gametime without any concequences, and i am sure that having me paying the subscriptions since 2005 has something to do with it.

 

[rk53]

True, I wouldn't be surprised at all to learn that they have an internal policy build around maximizing income. Massive banwaves must be very costly for them, which explains why they tend to advertise publicly when they do one. The cost of the bans can be seen as an investment in terms of PR.

But I wasn't talking about the actual bans, I was mostly talking about the detection methods, or the "flagging" methods. Before an account is even manually investigated, surely it has to be flagged, either automatically or manually through player reports. I was just speculating on the methods used for automatic detection and what we can do to play around them.

 

[Aion]

rk53, very valid point here!

Some people here use the randomization gameplay since years, which actually help us delay the bans sometimes with quite a months or years!

 

[Keanu]

No. Just because they don't give so much fucks as you think.
No. Because there is no such thing as normal player behavior. People are unpredictable.

 

[rk53]

No. Just because they don't give so much fucks as you think.
No. Because there is no such thing as normal player behavior. People are unpredictable.

But bots are! and that's the point. It's a matter of repetitive/predictable activity pattern vs unpredictable activity pattern.

And I wouldn't be so sure about them not giving a fuck. People are still getting banned right?


Edit: I've been reading all day on the topic. This publication describes exactly what I had in mind.
Also, some people claim it's possible to detect a bot within 12 minutes of farming by analyzing the paths.

Others claim their can detect bots by analyzing the network trafic or the player's rotation, but I'm skeptical this is applicable to HB, as the WoW environment is full of randomness which the bot has to react to.

My conclusion, top 3 ban sources:
1) Player reports
2) A single repetitive activity (only gathering, BG, dungeons or AH)
3) A repetitive path (which is why gathering and pick pocketing seem to be the top 2 sources of bans)