SRL Archive - Bot Information and Spottings

RSOF Link: http://services.runescape.com/m=forum/a=13/c=rQ9jd8I5x3A/sl=0/forums.ws?14,15,968,65539489

Hi Everyone,

I’d like to offer some commentary around recent bot bans so that everyone can clearly understand our position and have the full facts to hand regarding the current ban situation. Much of the discussion you may have read on social media and our own forums relates to a couple of specific recent situations. We’re not perfect, sometimes we do make mistakes as we’re human – thanks for letting us know to anyone who genuinely feels we’ve got it wrong, but generally, we want to keep as many players playing as possible – it’s as much against our interests as yours to ban players for no reason, and that’s what we try to do in an extremely complex game environment.

It was really unfortunate that we banned a particular player who wasn’t cheating at all. We’ve put that right of course and the player is happily back in game. In this case, the player was a very effective and highly productive RuneScape player – and their game play was so efficient that a member of staff interpreted the data our systems produced about the account as macro use. Now before you start thinking ‘well I’m efficient will I get banned’ – the context of this situation is that this account is one of only two other accounts that we have ever seen play so efficiently that they look like a bot, and we have been looking at this data for years now, so it really is incredibly unlikely that anyone will ever appear this way to us again. Naturally we are not happy with even that small risk though, so we have (for now) stopped applying manual staff bans so we can conduct a thorough review of our macro ban processes to ensure they are robust moving forward.

The other incident that is being discussed relates to a number of players complaining on our Forums and social media due to a recent mass ban for bot use. This ban was designed to specifically target bot users based on data and system analysis information that we collate on an ongoing basis and I can confirm that this wave of bans centred specifically on RSBot users. I should also add that we have banned, and will continue to ban, players for bot use both daily, and periodically. Some of those people banned may feel the ban is unfair because they may have only used RSBot once, or twice – RSBot, or the use of any other bot program, is against the Rules of RuneScape, and we will take action if players use them – even if only once or twice.

The accuracy of these recent bans is 100% - all those who were banned used RSBot – we checked them manually, and we remain confident that our detection systems are up to scratch. On other bot bans, just to be sure, every day we sample and verify a number of bans and we will continue to apply solid checking and analysis of our heuristics before deploying anything that can lead to a player being banned.

Finally, I wanted to touch on offence appeals – I’ve read a lot in the past few days about people finding it hard to appeal, not getting a response to their appeal and so on. The truth is I agree – our current offence appeal system is not fit for purpose and I have been working with some of the guys here at Jagex to get some changes to the offence system implemented. We openly discussed this in the Offence System Q&A back in October (Quick find code: 103-104-1-65498132). Right now I’m not 100% sure what any changed system will look like or when we may release it – but throughout the project (which we have been working on for some months now) I have retained some key principles that must exist in any new offence appeal system we use.

These are:

1. It must be clear whether an offence can be appealed or not
2. If an offence can be appealed – submitting an appeal must be a simple process
3. We must offer players more ways to explain their side of the story in any appeal that can be made
4. We must promptly review and answer every single offence appeal that is submitted

I hope that provides some context around the recent bans, what we are doing to make sure that bans remain accurate and also how we are looking to make things much better for those players who wish to appeal offences in the future.

Thanks for reading, and I hope this clarifies some questions.

Mod Kelvin
RuneScape Customer Services Manager

Thought this was interesting. But I do not think we should start relaxing now that manual bans have ceased temporarily. This suggests more to me that we're up against tougher systems in the future.

The 100% ban rate for RSBot bans seems to be scary accurate. The client must be easily detectable. Thank goodness that Simba allows original RS gameclient to be utilized.

that's really good to know :) (" only two other accounts that we have ever seen play so efficiently that they look like a bot")

if you have a hlf account, I found this thread kinda funny & sad at the same time =p (with the false positives) http://services.runescape.com/m=forum/a=13/c=uI1mR*AEvQk/sl=0/forums.ws?259,260,29,65537959,goto,1 259-260-29-65537959
gonna browse hlf some more later looking for mods talking about bots

I wonder if this applies to both versions of the game? In either case it can certainly be ruled out that their sole detector is detection of a 3rd party client but it certainly still could be a factor. But how are they certain that the bots they banned were specifically using RSBot rather than an alternative? How could they detect something specific like that?

From: Flight
I wonder if this applies to both versions of the game? In either case it can certainly be ruled out that their sole detector is detection of a 3rd party client but it certainly still could be a factor. But how are they certain that the bots they banned were specifically using RSBot rather than an alternative? How could they detect something specific like that?

They are openly targeting RSBot and detecting injection afaik

Either way, it seems plausible that they are using a big data approach, and a basic form of behavioral analysis, with later manual checking by their macro team.
I would assume every time the automatic system messes up, and the team catches it, they go and fix the problem, eventually building a smarter and better system overtime.

So I'm happy that I've been working on biometrics, it seems less like an overkill waste of time.

Although until we solve certain software detection issues, biometrics will be useless.

From: Clarity
Either way, it seems plausible that they are using a big data approach, and a basic form of behavioral analysis, with later manual checking by their macro team.
I would assume every time the automatic system messes up, and the team catches it, they go and fix the problem, eventually building a smarter and better system overtime.

So I'm happy that I've been working on biometrics, it seems less like an overkill waste of time.

Although until we solve certain software detection issues, biometrics will be useless.

What type of biometrics are you working on? I was planning to work on key presses biometrics because my bots talking between themselves got greater ban rates than those who didnt. So it could be the issue. Was thinking if it is worth time to invest or you already advanced in this?

This may mean that our emphasis on having break handling was understated. If they are indeed focusing on how "efficient" a person is, having random breaks and off-screen waiting may be more effective at throwing off the bot-watch than we had previously thought.

From: kozak94
The 100% ban rate for RSBot bans seems to be scary accurate.

From: Flight
How could they detect something specific like that?

The opinion over at powerbot is that they're just dropping RSBot's name. It's the most-used RS3 bot so obviously having the name in their ban message is going to scare people away from it.

I'm skeptical though, I'd like to see if the RSBot message is present after someone gets banned using Simba (quite a feat!)

From: KeepBotting
The opinion over at powerbot is that they're just dropping RSBot's name. It's the most-used RS3 bot so obviously having the name in their ban message is going to scare people away from it.

I'm skeptical though, I'd like to see if the RSBot message is present after someone gets banned using Simba (quite a feat!)

There's probably just something that can identify the client as RSBot, it doesn't make sense for them to guess the client when they could just not mention which client it was if they don't know.

From: cosmasjdz
What type of biometrics are you working on? I was planning to work on key presses biometrics because my bots talking between themselves got greater ban rates than those who didnt. So it could be the issue. Was thinking if it is worth time to invest or you already advanced in this?

Mouse & keyboard. Going to be released alongside dungeoneering hopefully because I'd like to see that script ban-free.

From: 3Garrett3
This may mean that our emphasis on having break handling was understated. If they are indeed focusing on how "efficient" a person is, having random breaks and off-screen waiting may be more effective at throwing off the bot-watch than we had previously thought.

I think the real problem is our scripting style, which is posing a challenge for me as I try to make biometrics a backwards-compatible include.

We need to move away from a firmly procedural/ordered scripting style, because humans don't work that way. I suspect watching these "super-efficient" people made them look like they were following some sort of mainloop, perhaps with some variance that wasn't enough for their human threshold. Eventually, if Jagex cares enough, all pseudorandom variance (our primary antiban strategy as of now) can be figured out via big data, especially if we are posting source code.

I think RSBot and others are multithreaded, so they don't have the single thread problem which makes us look incredibly inhuman. For instance, humans are easily able to see whether an NPC has moved from its old location while moving the mouse. We are able to do color searches with our eyes as we type and move the mouse, etc.

Not that I think Jagex is looking very closely here (yet), but it certainly doesn't help us.

State-based/goal-based/priority-based styles seem better, far more adaptive and reactive. This gives two benefits - we look more human, and do things faster.

From: BMWxi
There's probably just something that can identify the client as RSBot, it doesn't make sense for them to guess the client when they could just not mention which client it was if they don't know.

That makes perfect sense though. 85% of (RS3) bot users are using RSBot. When they see RSBot mentioned by name, they go "zOMG CLIENT IS DETECT!!1!1!!one!111" and quit using it.

It's a scare tactic - I highly doubt they're actually identifying these users as using RSBot specifically.

i remember mod ronans stream of banning,
they were checking the account through something
then they confirm that it was a bot, then open the
account in their rs database to check maybe statistics
bank and total wealth. thats in osrs and i think
same is applied for rs3 bans. ive only been banned once
and thats because it got stuck in an infinite loop.

From: KeepBotting
That makes perfect sense though. 85% of (RS3) bot users are using RSBot. When they see RSBot mentioned by name, they go "zOMG CLIENT IS DETECT!!1!1!!one!111" and quit using it.

It's a scare tactic - I highly doubt they're actually identifying these users as using RSBot specifically.

Yeah, but all it takes is one person not using RSBot to be given the message and then everyone knows that Jagex is just guessing. That would have the opposite effect of a scare tactic I think.

From: BMWxi
Yeah, but all it takes is one person not using RSBot to be given the message and then everyone knows that Jagex is just guessing. That would have the opposite effect of a scare tactic I think.

The exposure of "detecting" bots and saying so in their ban messages > The exposure of Jagex's bluff being called on some forum somewhere

From: KeepBotting
I'm skeptical though, I'd like to see if the RSBot message is present after someone gets banned using Simba (quite a feat!)

@No Lifer and I are seeing about conducting an experiment where we run terrible scripts under various conditions, and wait and see what happens.

From: 3Garrett3
This may mean that our emphasis on having break handling was understated. If they are indeed focusing on how "efficient" a person is, having random breaks and off-screen waiting may be more effective at throwing off the bot-watch than we had previously thought.

An anti ban system isn't as good as an anti ban case with an off-screen handler; vice versa. I find I do this a lot more than I originally thought legitimately playing.

From: Clarity
@No Lifer and I are seeing about conducting an experiment where we run terrible scripts under various conditions, and wait and see what happens.

Tried this. jagex doesnt ban because of 1 problem unless you make good money. Now 2nd week running STATIC clicks iron power miner and another runeminer, lost 3 runeminers no iron powerminers :) Also week or so working on fastest tree cutting competition. Quess what? using static clicks with no variations no ban yet. My theory is jagex doesnt ban atleast for a while untill they suffer from that behaviour much because they dont wana give you a confirmation of whats wrong. well unless you stuck in a loop :). But for example dragon scripts who survived 90mins they were talking between and maybe got some bad blindwalk in my eyes thats 2 things and they ban imediately. Now running test accounts with no talking, different walking methods, more gauss waits and so far so good again close to 3 weeks lifespan. My most pesimistic idea was jagex finds our accounts on login…I mean using biometrics while logging in, so to avoid this we need add biometrics in key typing and shorten passwords and usernames too and not to talk in game at all unless necesarry or unless we have good biometrics. Id like to test drags bots with good biometric talking. Regardless if they look biometrics for typing yet they will look for in the future for sure so next step is biometrics. With biometrics and multithreading i think bots would be actually undetectable using statistical methods. The only way would be to look for processes, which i doubt jagex will use or no one would play rs cause of privacy issues.

Well i think i'll try and get a temp ban quashed under the guise that I was "wrongly banned" ;)

In this case, the player was a very effective and highly productive RuneScape player – and their game play was so efficient that a member of staff interpreted the data our systems produced about the account as macro use. Now before you start thinking ‘well I’m efficient will I get banned’ – the context of this situation is that this account is one of only two other accounts that we have ever seen play so efficiently that they look like a bot, and we have been looking at this data for years now, so it really is incredibly unlikely that anyone will ever appear this way to us again.

My analysis is such: "very effective" describes the efficiency (xp/gp gained divided by total time spent), and "highly productive" describes the degree of "xp waste" (time spent lollygagging divided by total time spent).

Relating this to the case of High-Alching, it's not nearly unthinkable that a human player would be capable of clicking one pixel for over an hour at a relatively constant rate, that rate aside, the xp/gp gain would be quite near if not equal to the the maximum efficiency as a result of cast-queuing. (1200 alchs per hour) I used to just watch tv with a laptop next to me and spam click the left click button, or so the story goes.

So that would be an example of "very effective and highly productive" game play that is humanly possible, and I don't think anyone really get's banned for alching unless they go about it in a bot way, meaning, actually moving the mouse. (or for 12+ hours)

But, take a different task, perhaps one that requires banking and walking and suddenly it becomes extremely difficult to keep up with the "stamina" of "inhumanely efficient" bots. And my guess is this guy managed to keep pace with that for some extended period of time, 4+ hours and suddenly he becomes one of the few accounts over the years, bots included, to actually have had a near 0% "time-waste". Most bots can't keep up, all you need is a wait time while finding a banker and you are falling behind.

So Jagex might have thought that this was some overzealous botter that they were going to punish for coming so close to the maximum efficiency. As they say, only 3 (or two? fix logix jegeggs pl0x) legit players have ever come so close, so this really is a seldom occurrence.

In summary, I don't think there is much to worry about. Just keep botting. And try and not be Icarus.

This ban was designed to specifically target bot users based on data and system analysis information that we collate on an ongoing basis.

+1 to their public relations team for the ambiguity in that statement. Systems analysis could either mean they monitor the system their client runs on.. OR that they monitor the data their system produces. But why use "both data and system analysis" if they meant the same thing? :l

From: 3Garrett3
This may mean that our emphasis on having break handling was understated. If they are indeed focusing on how "efficient" a person is, having random breaks and off-screen waiting may be more effective at throwing off the bot-watch than we had previously thought.

I'd like to take a minute to shine some good ol' moonlight on this post.
All my scripts goes "AFK" outside the client. If I'm fletching, as soon as I'm done clicking -> Mouse off screen

From: Fitta
I'd like to take a minute to shine some good ol' moonlight on this post.
All my scripts goes "AFK" outside the client. If I'm fletching, as soon as I'm done clicking -> Mouse off screen

Remembered my first script, it was chocolate dust grinder, made first bond by that. Also tried to make arrowshafts too. It was soo awfull, porly scripted, fixed waits, poor antirandom, mostly out of screen. When i think over again i have no idea why i am still not banned on that account….

From: cosmasjdz
Remembered my first script, it was chocolate dust grinder, made first bond by that. Also tried to make arrowshafts too. It was soo awfull, porly scripted, fixed waits, poor antirandom, mostly out of screen. When i think over again i have no idea why i am still not banned on that account….

To me it looks like they're watching some "locations" or skills or something like that.
Cus I can run some scripts without a decent antiban for months without getting banned and with other scripts like a nature rune crafter I get banned within 6 hours (without a decent antiban) .

That's interesting, though they can't keep up with smart hey ;)

From: Zen Win
That's interesting, though they can't keep up with smart hey ;)

SMART and Simba can be detected.

From: Justin
SMART and Simba can be detected.

I thought it was undetectable.

From: FANDANGO1
I thought it was undetectable.

no.

From: hoodz
no.

Is it detectable atm? Because noone's getting banned.

From: FANDANGO1
Is it detectable atm? Because noone's getting banned.

You can probably look at some posts by Brandon how how both Simba and SMART can be detected, but clearly they're (currently) not being detected or if they are nothing comes from it. Simply playing RS via SMART while Simba is running won't get you banned (again, currently).

From: Flight
You can probably look at some posts by Brandon how how both Simba and SMART can be detected, but clearly they're (currently) not being detected or if they are nothing comes from it. Simply playing RS via SMART while Simba is running won't get you banned (again, currently).

I never thought simba would be unsafe.

From: Flight
You can probably look at some posts by Brandon how how both Simba and SMART can be detected, but clearly they're (currently) not being detected or if they are nothing comes from it. Simply playing RS via SMART while Simba is running won't get you banned (again, currently).

Has it ever been detected?

Tbh I feel like RS3 needs another mass ban. At green/blue/frost dragons and black demons it is kind of sickening how many there are now compared to the summer. When I'm in the wild for warbands, on the way back from camp there's always at least 3-4 green dragon bots that I would kill if I wasn't level 138… I've had bots try to even crash me on a slayer task like what the balls.

From: J_R
Tbh I feel like RS3 needs another mass ban. At green/blue/frost dragons and black demons it is kind of sickening how many there are now compared to the summer. When I'm in the wild for warbands, on the way back from camp there's always at least 3-4 green dragon bots that I would kill if I wasn't level 138… I've had bots try to even crash me on a slayer task like what the balls.

I want to know how many players on runescape are genuine. I wouldn't be surprised if rs is 80% bots 20% humans lol