SRL Archive - Discussions and Debates

Paper on biometric authentication: http://www.cs.wm.edu/~hnw/paper/ccs11.pdf

TL;DR of the paper:

- They use a program called RUI to record user mouse activity, which is saved into a log file
- This log file is analyzed (pre-processing) to determine specific point and click events
- Use a classification system (SVM) to classify different profiles
- Decision making occurs to determine an impostor or actual user

When analyzing the raw mouse movement data, they calculate the following items:

- Direction: Angle X, the angle between line AB and the horizontal.
- Angle of curvature: Angle Y, or angle ABC.
- Curvature distance: Ratio of line AC to the line perpendicular to AC going to B.

Relevant paragraph:

I wonder if Jagex may be venturing towards a system like this, if not already there. At this time, antiban in our scripts is based on randomization, and at the moment I'm a personal fan of using gauss/normal distribution because I think total randomness isn't humanlike, and gauss is closer to following a trend.

But even with gaussian formulas, right now everything is 'random' in a very defined way that ultimately is detectable, especially if our community style is posting script code publicly.

But neither is any kind of distribution or blanket mathematical model. Our mouse functions look amazingly humanlike, but I suspect this is not what Jagex is tracking. Players have their own individual ways of handling computers, and this paper claims that these two most useful variables are direction and angle of curvature, as they do not change in relation to situational factors like screen size, how big the user's mouse pad is, et cetera. This data is then applied to a SVM (I don't know much about this) which according to them is used to distinguish individual users from each other.

Can we reverse engineer this for the 'perfect antiban'?

So, let's say we wrote a mouse movement recorder, something like this…

{...}
function mouseLocation: String;
var
  x, y: Integer;
begin
  getmousepos(x, y);
  result := ('(' + ToStr(x) + ',' + ToStr(y) + ')');
end;

function mouseAction: String;
var
  x, y: Integer;
begin
  if not isMouseButtonDown(1) and not isMouseButtonDown(0) then result := ('MOUSE_MOVING');
  if isMouseButtonDown(1) then result := ('MOUSE_LEFT');
  if isMouseButtonDown(0) then result := ('MOUSE_RIGHT');
end;

procedure mainLoop;
begin
  ClarityDebug(ToStr(timer.getTime) + ' | ' + mouseAction + ' | ' + mouseLocation);
end;
{...}

Which had an output just like RUI (edit: would probably also want to add a MOUSE_IDLE):

== ClarityDebug == | 262468031 | MOUSE_RIGHT | (1201,500)
== ClarityDebug == | 262468031 | MOUSE_RIGHT | (1201,500)
== ClarityDebug == | 262468047 | MOUSE_RIGHT | (1201,500)
== ClarityDebug == | 262468047 | MOUSE_RIGHT | (1201,500)
== ClarityDebug == | 262468047 | MOUSE_RIGHT | (1201,500)
== ClarityDebug == | 262468062 | MOUSE_RIGHT | (1201,500)
== ClarityDebug == | 262468062 | MOUSE_RIGHT | (1201,500)
== ClarityDebug == | 262468109 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468328 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468328 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468343 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468343 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468343 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468359 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468359 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468359 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468359 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468390 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468421 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468437 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468452 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468452 | MOUSE_LEFT | (1201,500)
== ClarityDebug == | 262468452 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468468 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468515 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468530 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468562 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468562 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468562 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468562 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468562 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468577 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468577 | MOUSE_MOVING | (1201,500)
== ClarityDebug == | 262468608 | MOUSE_MOVING | (1191,500)
== ClarityDebug == | 262468640 | MOUSE_MOVING | (1144,500)
== ClarityDebug == | 262468671 | MOUSE_MOVING | (1107,500)
== ClarityDebug == | 262468671 | MOUSE_MOVING | (1087,500)
== ClarityDebug == | 262468671 | MOUSE_MOVING | (1087,500)
== ClarityDebug == | 262468671 | MOUSE_MOVING | (1010,500)
== ClarityDebug == | 262468671 | MOUSE_MOVING | (1010,500)
== ClarityDebug == | 262468702 | MOUSE_MOVING | (701,400)
== ClarityDebug == | 262468733 | MOUSE_MOVING | (596,347)
== ClarityDebug == | 262468749 | MOUSE_MOVING | (449,263)
== ClarityDebug == | 262468764 | MOUSE_MOVING | (394,229)
== ClarityDebug == | 262468764 | MOUSE_MOVING | (394,229)
== ClarityDebug == | 262468764 | MOUSE_MOVING | (394,229)
== ClarityDebug == | 262468780 | MOUSE_MOVING | (368,213)
== ClarityDebug == | 262468780 | MOUSE_MOVING | (335,191)
== ClarityDebug == | 262468811 | MOUSE_MOVING | (319,182)
== ClarityDebug == | 262468827 | MOUSE_MOVING | (297,171)
== ClarityDebug == | 262468858 | MOUSE_MOVING | (277,159)
== ClarityDebug == | 262468858 | MOUSE_MOVING | (275,157)
== ClarityDebug == | 262468874 | MOUSE_MOVING | (273,156)
== ClarityDebug == | 262468874 | MOUSE_MOVING | (273,156)
== ClarityDebug == | 262468905 | MOUSE_MOVING | (271,149)
== ClarityDebug == | 262468936 | MOUSE_MOVING | (286,139)
== ClarityDebug == | 262468952 | MOUSE_MOVING | (299,133)
== ClarityDebug == | 262468983 | MOUSE_MOVING | (308,129)
== ClarityDebug == | 262468983 | MOUSE_MOVING | (309,128)
== ClarityDebug == | 262468998 | MOUSE_MOVING | (309,128)
== ClarityDebug == | 262469014 | MOUSE_MOVING | (311,127)
== ClarityDebug == | 262469045 | MOUSE_MOVING | (312,126)
== ClarityDebug == | 262469061 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469092 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469092 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469092 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469092 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469108 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469108 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469139 | MOUSE_MOVING | (313,126)
== ClarityDebug == | 262469154 | MOUSE_MOVING | (312,125)
== ClarityDebug == | 262469154 | MOUSE_MOVING | (312,125)
== ClarityDebug == | 262469170 | MOUSE_MOVING | (310,125)
== ClarityDebug == | 262469170 | MOUSE_MOVING | (309,125)
== ClarityDebug == | 262469186 | MOUSE_MOVING | (307,125)
== ClarityDebug == | 262469186 | MOUSE_MOVING | (307,125)
== ClarityDebug == | 262469186 | MOUSE_MOVING | (307,125)
== ClarityDebug == | 262469217 | MOUSE_MOVING | (302,123)
== ClarityDebug == | 262469248 | MOUSE_MOVING | (299,123)
== ClarityDebug == | 262469264 | MOUSE_MOVING | (296,123)
== ClarityDebug == | 262469264 | MOUSE_MOVING | (296,123)
== ClarityDebug == | 262469264 | MOUSE_MOVING | (296,123)
== ClarityDebug == | 262469264 | MOUSE_MOVING | (296,123)
== ClarityDebug == | 262469279 | MOUSE_MOVING | (296,123)
== ClarityDebug == | 262469279 | MOUSE_LEFT | (295,123)
== ClarityDebug == | 262469357 | MOUSE_LEFT | (295,123)

And we came up with a way to analyze this activity relative to RuneScape, adding in behavior analysis for interacting with certain game elements (choose option, banking, mousing objects, attacking objects, interacting with items, opening tabs)…frequency of distraction/mouse off client, etc…could we create user-specific profiles for use in scripts?

Result of a biometrics script:

Success, your unique antiban profile has been generated after one hour of recorded play!
Antiban User ID: Clarity

Put into a script:

antiban.setupProfile('Clarity');

Or, it could just generate a bunch of constants that could be interpreted by the antiban include.

With this kind of addition, antiban is truly player-specific to their playstyle and behavior. Also, antiban is no longer defined so clearly in the publicly posted script for easy interpretation.
I have no idea how easy or difficult this would be as I don't quite understand the math yet, but I may figure it out after some more googling. I found this very interesting though and think it would be cool to achieve for SRL.

That seems like a cool idea and seems to be similar to what @The Mayor has been working on with unique player profiles. But, in simba, once you have all that data saved, what function are you planning on making/using to make the mouse movements correlate to the recorded data?

I do believe OSbot is implementing this..

Sounds like some complicated RiD bulls*** :)

TBH I don't think Jagex is going this far..

Yeah this idea has been around for a really long time but no one's actually followed through on it. The last I heard RiD was wanting to implement the same thing in his bot, but who knows if he will or not. I've also planned in the past to add such a profile'er to AeroLib that will determine a user's mouse movements (including speed & accuracy), waiting time between actions, style of typing & chatting, how often (and long) the user takes a break, and so fourth…

If you work towards this and make some progress do keep us updated, it's a neat concept.

From: Officer Barbrady
Sounds like some complicated RiD bulls*** :)

TBH I don't think Jagex is going this far..

Even if they aren't I don't think it would hurt to have this implemented once they inevitably do. I think our antiban atm represents human individual activity very well (MOUSE_HUMAN, etc) but not overall activity accurately which is a potential vulnerability.

One thing that I've noticed is that script mouse movements are always better than my mouse movements. Even MOUSE_HUMAN and MOUSE_BREAK are better than mine. Sure, they're closer to what I do than normal script controlled mouse movements, but they still are far more efficient at moving to small points than I will ever be.

Maybe I just suck at using mice and nubmice(though I prefer nubmice to laptop track pads), but it's something that I noticed when I played the game legit for a bit to test.

From: BMWxi
One thing that I've noticed is that script mouse movements are always better than my mouse movements. Even MOUSE_HUMAN and MOUSE_BREAK are better than mine. Sure, they're closer to what I do than normal script controlled mouse movements, but they still are far more efficient at moving to small points than I will ever be.

Maybe I just suck at using mice and nubmice(though I prefer nubmice to laptop track pads), but it's something that I noticed when I played the game legit for a bit to test.

Totally fits my situation as well, when I'm training for real (if ever) I fumble so much and misclick, so then it looks incredibly strange when I suddenly transform into a hiscore efficiency machine with ridiculous actions per minute, and then revert back to being incompetent.

That said, I've had no trouble with bans, but I've also never done any goldfarming, just botting for personal skill XP gain or light money gain. But I fear this luck may eventually run out when Jagex gets around to actually cracking down, if ever. Better safe than sorry.

I realize the possible usefulness of this, but i believe as discussed before by… Ashaman or Sin (i think it was Sin…) The amount of data required to store just one user's click preference (duration, location, speed, etc) would be very very large… and that jagex didnt 1)have the manpower (or even computer) to analyse it and 2) didnt have the storage capabilities to ensure all this data would be saved.

Now… RS3/EOC/whatver botwatch was a different story…
in the case of their QBD watch, that was a small, isolated area where they knew there were bots running in the location… and by bots, i mean thousands of accounts bringing in thousands of dollars to people from some RWT stuff.

So as long as you arent in a 'botwatch' area, you should be fine with/without any sort of 'pure randomness/human error' in your mouse/script/antiban…

but eh. i could be wrong.

From: Turpinator
I realize the possible usefulness of this, but i believe as discussed before by… Ashaman or Sin (i think it was Sin…) The amount of data required to store just one user's click preference (duration, location, speed, etc) would be very very large… and that jagex didnt 1)have the manpower (or even computer) to analyse it and 2) didnt have the storage capabilities to ensure all this data would be saved.

Actually, it's not that large or complex or expensive to do.

If you're interested about the data side of things, you can read about it in my post from exactly a year ago. The numbers are a bit outdated, and I could probably come up with a more elegant solution as the one there is pretty crude, but it should demonstrate the point sufficiently.

From: core
Actually, it's not that large or complex or expensive to do.

If you're interested about the data side of things, you can read about it in my post from exactly a year ago. The numbers are a bit outdated, and I could probably come up with a more elegant solution as the one there is pretty crude, but it should demonstrate the point sufficiently.

Wow, that was a comprehensive and interesting read. All the more motivation to actually see about creating this system. Although, I don't want to overlap any work that has already been done. @The Mayor, what have you been up to with this?

From: Clarity
Wow, that was a comprehensive and interesting read. All the more motivation to actually see about creating this system. Although, I don't want to overlap any work that has already been done. @The Mayor, what have you been up to with this?

I was working on this, but it was specifically for my Taverley Plank Banker script, and isn't directly transferable into another script. If this was something that was inside the include that would be cool.

I think before trying to record, save and use a player profile, you have to think about what variables actually make up a player's profile, and which of them can be manipulated. I'm not just talking about mouseSpeed and waits, but about new variables which you create. For example, in my script my bots talked to each other in the clan chat. A random integer var called angerLevel could be used to manipulate a bot's responses in a way that would make it seem angry, and it might be more inclined to spam click the sh*t out of stuff. Another example is a var called tiredness which would be based on current playtime/time of day, and would govern typing speed/mouse speed/reaction speed etc. Different player profiles might be more susceptible to the effects of tiredness. The more of these variables which contribute to the make up of a profile the better.

In saying that it's not just about player profiles, you have to try and make every single action in your script random. Every time you do something as simple as makeCompass('N') it should (1) have a random chance of actually happening (if the script can continue functioning without it) and (2) if it does happen, be random within a range. The randomness can be governed by the player profile.

I definitely think this is the right direction to move toward. Planking at Taverley is an activity which is under botwatch surveillance (PB = ban in < 1 hour). I ran my script which there features for about 5 days on 3 accounts without a ban, before I got too busy to farm.

Yeah, that was exactly my line of thinking. Behavioral traits and states of mind, rather than mathematical variables. Of course those human characteristics would ultimately have to translate into mathematical processes, but that comes later. I guess I am going to start with the bare basic recording process with that in mind and then modify it to suit the outputs we decide we want.

I agree, I think it is just a matter of time before this level of antiban becomes necessary in scripts. I'm always uncomfortable that it is almost too easy to look at a simba script and then tell who is using it. Aka Jagex gets a copy of barrows script, now all they have to do is scan for people who waited for gaussRangeInt(x, y) …etc. Idk if they can be bothered to do that, but if they ultimately wanted to surely they could?

However if x, y is defined by something outside the script then that no longer is a vulnerability.

Reviving this discussion, because is it just me or have bans been occurring far more recently? Or perhaps people have been increasingly careless.
I'd like to get somewhere with this, @Flight you said you might want to work on it as well.

If we end up achieving biometric antiban, the only thing to worry about would be human realistic botting times…which is totally up to the user. Jagex would be unable to do anything no matter how advanced their Botwatch systems.

From: Clarity
Reviving this discussion, because is it just me or have bans been occurring far more recently? Or perhaps people have been increasingly careless.
I'd like to get somewhere with this, @Flight you said you might want to work on it as well.

If we end up achieving biometric antiban, the only thing to worry about would be human realistic botting times…which is totally up to the user. Jagex would be unable to do anything no matter how advanced their Botwatch systems.

Until they start detecting SMART but I mean the user could always use the real client… but that sucks lol

I am going to be working on a include of variables that can be added to a script, such as the mentioned tiredness, laziness, anger ect.. They will be implemented in the beginning of the script (anger etc,) whereas tiredness will go by the amount of playtime and activity, so it will be a two factor calculation. Time of day * activity level ( chopping wood = 1, QBD = 10) then that will manipulate the mouse movement randomness, speed and pixel accuracy ect.. I will post a progress thread when I get some stuff done on it. I would like to make it so it works with current mouse movement variables, that way I will not have to rewrite them with my variables in them.

From: King
I am going to be working on a include of variables that can be added to a script, such as the mentioned tiredness, laziness, anger ect.. They will be implemented in the beginning of the script (anger etc,) whereas tiredness will go by the amount of playtime and activity, so it will be a two factor calculation. Time of day * activity level ( chopping wood = 1, QBD = 10) then that will manipulate the mouse movement randomness, speed and pixel accuracy ect.. I will post a progress thread when I get some stuff done on it. I would like to make it so it works with current mouse movement variables, that way I will not have to rewrite them with my variables in them.

What does the anger variable change?

From: BMWxi
What does the anger variable change?

Pretty much what the @The Mayor suggested, I am going to make it spam click, click faster, possibly say angry things to people, make it less accurate, make the mouse move faster and more random.

@Clarity, I know that it keeps being brought up (and I especially keep bugging you about it :p), but I'd just like to know a couple of things that I haven't actually had clarified yet (pun so intended).

1. How exactly are you going to "release" your biometrics? Is it going to be an include that can be used in other scripts?
2. Do your biometrics include other human elements like minibreaks for social media checks, IRC chatting, etc? Basically, micro tasks that would be completed off screen that would be simulated via mousing off of the client.

I ask because I've been trying to think of ways to create the most human antiban possible (which seems to also be your goal) by simulating everything that a human does while using their computer that would be unintentionally sent to the RuneScape client (such as alt-tab, mistakenly typing something in RS instead of IRC, etc).

From: Incurable
@Clarity, I know that it keeps being brought up (and I especially keep bugging you about it :p), but I'd just like to know a couple of things that I haven't actually had clarified yet (pun so intended).

1. How exactly are you going to "release" your biometrics? Is it going to be an include that can be used in other scripts?
2. Do your biometrics include other human elements like minibreaks for social media checks, IRC chatting, etc? Basically, micro tasks that would be completed off screen that would be simulated via mousing off of the client.

I ask because I've been trying to think of ways to create the most human antiban possible (which seems to also be your goal) by simulating everything that a human does while using their computer that would be unintentionally sent to the RuneScape client (such as alt-tab, mistakenly typing something in RS instead of IRC, etc).

1. At the moment, there are three parts: one is the script that records and saves a log of your mouse movement and keyboard activity. The second is the script that takes that log and calculates biometric constants based on your behavior. The third is the include of biometric functions that uses those constants.

2. Yes, you can see some mini-examples of this in my mud runes script, although FYI, smart already spoofs Alt-Tab whenever you press the enable or disable SMART button, so a duplication of this might look strange.

Mouse movement calculation variables/elements:

X, Y
Path distance from origin
Angle of path tangent to X-axis
Curvature
Derivative of curvature in order to space
X/Y/T vectors
Horizontal velocity
Vertical velocity
Tangential velocity
Tangential acceleration
Tangential jerk
Angular velocity

As the paper suggests that was initially linked in the OP, if the math is done properly, variables like screen resolution and potential mousepad size do not have to be taken into account. It also would be unrealistic for Jagex to implement a system that harshly bans after seeing only a few inconsistent movements. Current biometric security software have a threshold to avoid false negatives or positives.

Human flaws and/or tendencies:

Impatience
Forgetfulness
Proximal Activity
Irrational Short-cutting
Inaccuracy
Predictive Errors
Progressive Goals & Strategy
Reaction Time

Multi-threading is required for some of them, so I'm trying to work out ways of pseudo-multithreading while we wait for devs to make Simba functions threadsafe for libthread.dll

Initially it will be an include and those scripts, but I'm working on a paper than proposes a design for its direct implementation into Simba. Biometrics overall are somewhat useless if Simba remains detectable as a software to Jagex.
But not until my vacation is over! :)

From: Clarity
-snip-

That is incredibly exciting, I can't wait to see it come to fruition! I doubt it, but if there's absolutely anything I can do to help, let me know. :D

As for alt-tabbing, how often do you disable/enable SMART anyway? Once a script is running, mousing off of the client doesn't remove focus from RuneScape, and doing something like sending a key will still work. If you were actually mousing off client to use something like Facebook, you would change mouse focus to your browser or another tab as opposed to RuneScape and wouldn't be able to send keystrokes. I would like to use alt-tab as a way to remove focus from the game and regain focus by clicking on RuneScape, just as you would during regular human-computer interaction.

From: Incurable
That is incredibly exciting, I can't wait to see it come to fruition! I doubt it, but if there's absolutely anything I can do to help, let me know. :D

As for alt-tabbing, how often do you disable/enable SMART anyway? Once a script is running, mousing off of the client doesn't remove focus from RuneScape, and doing something like sending a key will still work. If you were actually mousing off client to use something like Facebook, you would change mouse focus to your browser or another tab as opposed to RuneScape and wouldn't be able to send keystrokes. I would like to use alt-tab as a way to remove focus from the game and regain focus by clicking on RuneScape, just as you would during regular human-computer interaction.

I realize now that my comment about Alt-Tab made no sense.

@King, good luck with your version! Let me know if you have any questions :)

From: Clarity
I realize now that my comment about Alt-Tab made no sense.

@King, good luck with your version! Let me know if you have any questions :)

Definitely will, it has been put on hold until finals are done on the 14th of December! Then I will have 3 weeks of coding >;)