UNIVERSITYOF FRIBOURG

BACHELOR THESIS

Data Preparation and Analysis in Support to Cheating Detection: The Case for Economic Momentum in CS:GO

Author: Supervisors: David Bucher Prof. Dr. Philippe Cudré-Mauroux Dr. Giuseppe Cuccu

August 18, 2019

eXascale Infolab Department of Informatics

Boulevard de Pérolles 90 • 1700 Fribourg • Switzerland phone +41 (26) 300 84 65 fax +41 (26) 300 97 31 [email protected] www3.unifr.ch/inf

iii

UNIVERSITY OF FRIBOURG Abstract

Faculty of Science and Medicine Department of Informatics

Bachelor

Data Preparation and Analysis in Support to Cheating Detection: The Case for Economic Momentum in CS:GO by David Bucher

In recent years, there has been an increasing amount of competition in the video game industry. More and more people play video games, more people watch stream- ers playing famous titles. This has evolved into competition - so called esports. With money to earn from video games, the temptation for players to cheat becomes bigger. The traditional tools to fight against cheaters in video game competitions are anti- cheat that can recognize cheat server or client side. But in the same time, cheating methods have also evolved in order to make their detection almost impossible. In this work we try to see how the understanding of a game mechanic can help to iden- tify potential cheaters. We focus on the first-person shooter Counter-Strike:Global Offensive and its "economy cycle". We collected a large amount of data from official league competitions and exhibit a standard for how the game looks from the specific point of view of the economy system. We computed the distribution of the different scenarii in a match (sequence of rounds won or lost by a team). This could in princi- ple serve as a basis to identify outliers as potential cheating suspects. The approach could be generalized to other mechanics and apply to other games.

Keywords: CS:GO, cheating detection, esports, game mechanics, data collecting, demo parser, crawler, pattern distribution

v

Contents

Abstract iii

1 Introduction1 1.1 Game Overview...... 1 1.2 Actors in the CS:GO Competition...... 3 1.3 Professional Scene...... 3 1.4 Thesis Structure...... 4 1.5 Contributions...... 4

2 Cheating5 2.1 Overview...... 5 2.2 Cheating Techniques...... 5 2.3 Current State...... 6

3 Economy9 3.1 Description...... 9 3.2 Earnings...... 10 3.3 Spendings...... 10 3.4 Strategical Implication...... 10 3.5 Visualization of the Economical Situation...... 11 3.6 Cheater and the Economy...... 11

4 Collecting the Data 13 4.1 Data Selection...... 13 4.2 Demo Parser...... 13 4.3 ESEA Crawler...... 14 4.4 Final Crawler Version...... 17

5 Analysis 19 5.1 Preface...... 19 5.1.1 Time Line...... 19 5.1.2 Overtime...... 19 5.2 Methods...... 20 5.2.1 Database Size...... 20 5.3 Experiences...... 20 5.3.1 Entropy...... 20 5.3.2 Pattern Distribution...... 20 5.3.3 Round and Game Win Rate...... 21 5.3.4 The Path of a Game...... 21 5.4 Analysis Conclusion...... 21 vi

6 Results 23 6.1 Experiences Results...... 23 6.1.1 Entropy...... 23 6.1.2 Pattern distribution...... 23 6.1.3 Round and game win rate...... 24 6.1.4 The path of a game...... 25 6.2 Results Conclusion...... 27

7 Conclusion 29 7.1 Conclusion...... 29 7.2 Future Work...... 29 vii

List of Figures

1.1 CT and T rounds win rate per maps: last 6 months, between top20 teams in offline events...... 1 1.2 "CS is way more than being good at shooting people" - Maniac, a swiss professional player...... 2

2.1 Vac and Game bans[17]...... 7 2.2 Personal experience data...... 7

4.1 Parser output example...... 14 4.2 Parser time running on a folder of 16 demos...... 14 4.3 ESEA making it hard to crawl...... 15 4.4 Traffic through the mitmproxy...... 17 4.5 Headless test result: missing plugins...... 18 4.6 Rate limited, but crawler loading a page with proxy...... 18

6.1 ESEA EU MDL 29...... 24 6.2 ESEA EU MDL 30...... 24 6.3 ESEA EU ADVANCED 29...... 25 6.4 ESEA EU ADVANCED 30...... 25 6.5 ESEA EU MAIN 29...... 25 6.6 Comparing game and round win rates...... 26 6.7 All five season considered at the same time, X axis is the number of round played, Y axis is the number of round won by the team that started as CT...... 26

1

Chapter 1

Introduction

1.1 Game Overview

Counter-Strike:Global Offensive, commonly designated as CS:GO, is a first person shooter video game in which two teams of five players face each other. One team acts as a Terrorist team (T), the other as the Counter Terrorist team (CT). The goal for the T is to plant a bomb (2 minutes for it), and then make sure it explodes (additional 40 seconds). The goal for the CT is to prevent it, by first defending the two bombsites and - when the bomb is planted - to defuse it. The match is played as a succession of short rounds scoring each 1 point. After the first 15 rounds, players switch their roles as CT and T. The first team to score 16 points wins the match. The players compete on a "map". A "map pool" consists of seven "official" map. On those square-shaped maps the T start on the top of the map, CT on the bottom. Those two area are called "spawn". The bombsites (A and B) are located on the left and right. When departing from their spawn, CTs always arrive first on the bombsite - we call this the defender’s advantage. For this reason most map favor the CT side. The team playing as CT have higher chances to win a round than the T as shown in Figure 1.1[2]. Outside of this four elements, maps have very different structures leading to various play styles on each of them. It is not rare to see a team win easly on one team against their opponent and then losing even more clearly on another map against the exact same opponent.

FIGURE 1.1: CT and T rounds win rate per maps: last 6 months, be- tween top20 teams in offline events

To decide whether a team starts on the CT or T side, they first play a "knife round" a fast played round without any weapon that does not count on the overall score, 2 Chapter 1. Introduction but allows the winner to decide his starting role. While Figure 1.1 may suggest that the team starting the game on the CT side have more chances to win the game, ithat is not the case. Competitive players and teams do indeed have a prefered starting side, but it is not always the statistically best one. Consider the extreme case where one side has a 100% to win, after 15 rounds, it is 15-0, teams change their role, and at the end of the second half the score is 15-15. In other words, to win a game you need to beat the odds. In competition we distinguish two types of match. Best of one (BO1) and best of three (BO3), refering to the amount of maps played bewteen the two teams to decide a winner. In a BO1, each team alternatively vetoes three maps, the remaining one is the one played for the match. In a typical BO3, each team vetoes first one map, then each "picks" one - meaning these two maps are being played - and then again ban each one map. The remaining map is used as a "decider" in case both team won on a map.

FIGURE 1.2: "CS is way more than being good at shooting people" - Maniac, a swiss professional player

Here we are just scratching the surface of the game, Figure 1.2 illustrate how complex the game is - which aspects enter into the equation when playing the game on a competitive level[3]. There are many different types of player with their own kind of impact, mastering specific aspect of the game. We will talk later about the "economy" aspect of the game, how it works, and its consequences, in a dedicated Section. We propose that this mechanics has a strong influence on how a match is played. 1.2. Actors in the CS:GO Competition 3

1.2 Actors in the CS:GO Competition

The game itself provides a matchmaking system where players can start a match with similar rules to the ones used in competition. It offers a ranking based on grad1 from “silver1” to “the global elite”. This is most regarded as the fun way to play the game. Faceit[4] is an independent platform offering its own matchmaking sys- tem - favored by competitors. It provide better server quality, an ELO2 based rank- ing allowing direct comparison between player, and comes with its own anti-cheat client. While it is regarded as the best ranking ladder, it is not suited for competition because it is “player-" and not "team-oriented". ESEA[5] is an other independent platform offering a service similar to Faceit, but is additionally involved in league organization all around the world. Every player can join the competition by register- ing as a team of at least 5 players in the “Open league” corresponding to his region (Europe, North America, etc). The promotion system offer the possibility to climb one’s way to the absolute top teams in the world in about a year. Division from bottom to top: Open, Intermediate, Main, Advanced, MDL, Pro League.

1.3 Professional Scene

CS:GO is a pioneer of esports3. Today it is one of the top10 games watched on Twitch and YouTube but when it comes to competition it shares the crown only with Dota2, League of Legends[6][7][8], and more recently Fortnite. Not only does the game have a lot of fans, the competition also involve a lot of money [9], with player making a living out of the game like professional athetes in regular sports. While in most games the path from casual to professional player consist mostly in getting better and improving his ranking, this does not hold in CS:GO. You are not regarded as a top player before you proved yourself in offline events, no matter how high you are ranked. This is partially due to how much the game is different when played on local network, but also because of the constant suspicion surrounding players about whether or not they use cheats. There is a huge segregation between professional players and the rest, they have a access to private ladder4 where it is really hard to get access. And the best teams in the world get all the invitation in top events and almost never have to play in open qualifiers. In the next Section we will talk more about the cheating problem. One things to keep in mind is: for the fans, whenever a new player enters the top competition, he is always looked first as a cheater, even some well established professionals remains suspect for the public. This kind of paranoia reflects the general experience the public has when playing the game, and a first measure on how big the problem is.

1Bottom to top: Silver 1, 2, 3, 4; silver elite; silver elite master; Gold Nova 1, 2, 3; Gold Nova Mas- ter; Master Guardian 1, 2; Master Guardian Elite; Distinguished Master Guardian; legendary Eagle; Legendary Eagle Master; Supreme Master First Class; Global Elite 2Inspired by chess ranking: player have a score. they win or lose an amout of point after each game depending on the score difference with the opponent 3Competition in video games, stands for: electronic sports 4restricted matchmaking system with its own ranking. FPL on Faceit, Rank S on ESEA 4 Chapter 1. Introduction

1.4 Thesis Structure

• Chapter 2: We talk about the cheater problem in the game. We make an estima- tion of the amount of cheaters. We also describe the way cheating is achieved, as well as the current methods to detect it in competitions.

• Chapter 3: We detail the economy mechanics of CS:GO. We give an intuition on why and how it shapes the game, and justify its study with the goal of detecting cheaters.

• Chapter 4: We show how we collected the data and the problems encoutered.

• Chapter 5: We present the analysis we conducted on our data. We justify the different tests we made by explaining how we expect the economy to impact the results.

• Chapter 6: We discuss the results of our test from Chapter 5.

• Chapter 7: We conclude the work and give direction to push the idea further.

1.5 Contributions

In this thesis a new idea (to the best of our knowledge, this has not been done before) is tested. The main contributions are:

• Economy analysis: We give a distribution law to explain how the game is im- pacted by the economy mechanic.

• Cheat versus cheater: Today, the focus is on reconizing a cheat software or hardware. We set a standard for how players/teams should look like from a game’s perspective and propose to study the deviation from it. We do not consider how the cheat exactly behave, but focus on who may be cheating.

• Use of .dem files: Most cheating detections are done live during the competi- tion. If a cheater is not identified during the game, he will never be punished for it. We work on what has been played, and suggest it may be possible to retrospectively identify games in which cheating has occured. 5

Chapter 2

Cheating

2.1 Overview

The Esports Integrity Coalition (ESIC) published their analysis of the “Threats to the integrity of esports” where it considers cheating to win, disabling opponent (DDOS for example), doping, match fixing and corruption among others as the main threats to video game competition [10]. In this work we focus on “cheating to win” at “high level”. Cheating generally consist in the use of a software or hardware that gives the player an unfair advantage that is not intended by the game. By "high level" we designate the category of players that are just below the professional scene, the ones that are close to making a living out of the game if they manage to dominate their peers. It is reasonable to think we will encounter cheaters at the level where one get highly rewarded for success, but on the other hand the task becomes harder since we are looking at extremely good players in their own - with or without cheat. Those players have also a lot to lose if caught cheating, not only it hurts their reputation but also put an end to their career. Therefore cheaters will use customized soft- ware/hardware to bypass any “hard detection” of a cheat running on a computer. The work I am presenting tries another approach where I have separated "legit" wins from suspicious one from the point of the in-game Economy mechanics. But first let us take a closer look on the problem.

2.2 Cheating Techniques

I have already mentioned that cheats exist as software or hardware, but since here we are not doing “hard detection”. Here, we are not so much concerned with how the cheat functions on a technical level, but rather with how it impacts the game. The cheat could run on a smartphone somehow connected to the player client, take the form of a graphic card or just be the first software found on Google - it does not matter to us. For the matter at hand, the only important thing to know is that there are two main strategies to take advantage over an opponent in the game. As in any FPS, the obvious way to win in CS:GO is by out shooting your enemies. This can be achieved by using automated aiming and/or triggerng, the so-called aimbot. Theses cheats were quite “obvious” because of the “instant flick and shoot” effect, where one can see a player aiming in a given direction suddenly turn around and kill the opponent behind him with a perfect shot.. Nowadays it became more sophisticated. Cheats include parameters such as reaction time and probability dis- tribution. Moreover, a specific area in which the cheat takes control can be defined around one’s crosshair. The cheat’s "sensitivity" can also be adjusted depending on how desperatly one needs to win. Even the movement of the crosshair controlled by the cheat emulates a human with a mouse, using vectorial curves. 6 Chapter 2. Cheating

Wallhack is the other common cheat. CS:GO is a game with incomplete informa- tion. One knows the opponent’s goals (plant the bomb, defend bombsite, defuse the bomb, kill the entire enemy team), but one does not know always where one’s ene- mies are, what weapons they are using. Collecting and processing information is a crucial part of the game, and taking decision on what one hears/sees has a big im- pact on who wins the round. At first wallhacks were basically cheats that made the walls in the game transparent so that one could simply see the enemy wherever they are. Today some versions make one’s crosshair move slightly towards the position of an enemy. An other approach is to change a variable of the game when someone is close so that only the cheater can understand what is happening. Some cheats help collecting information by the use of sounds, producing some kind of “beep” for specific events (an enemy entering a strategical spot on the map, for instance). Wallhack are not strict vision through walls anymore, but a general class of cheat allowing player to access information he would not normally. And good players not only know how and when to make good use of information, but also are capable to some extend to hide it, make it look like a potential scenario they were aware of, or just a lucky guess. These two techniques are by far the most standard way to cheat in competition. Other cheats like “speedhack, spinbot, ...” break the rules in a much obvious way and are mostly used by casual players at lower ranks. But aimbot and wallhack are not really different, like I pointed out, you can use the crosshair to collect informa- tion. In the context of the research, we consider a cheater as someone playing with information he should not have, and capable to out aim other players. He has the potential to win any round for his team, but is also concerned about not getting caught. So we are not looking for teams winning 16-0 with one star player making all the kills. We are looking for someone having an impact in difficult situations, in which a win results in a general advantage over the entire game.

2.3 Current State

It is hard to exactly quantify the amount of cheaters on CS:GO. Valve (the game developer) has its own anti cheat - VAC - integrated in the Steam platform, but since it supports many different games it is not possible to directly conclude the amount of bans related to cheat CS:GO. Here I try to give an idea on the current state by collecting indirects indicators, and correlating them with specifics events. Additionally to their anti-cheat, valve added an “overwatch system”[11][12] in the game. Players have the possibility to review an extract of demos from an other anonymous “suspect” - a player that was reported during a game for “cheating” by someone in the same match. After watching it they submit a decision whether they think the suspect was using “aim assistance”, “vision assistance”, “other cheat- such as speedhack” or had a “bad behavior " (like intentionally killing a teammate). This bans are strictly for CS:GO, but sadly not only against cheaters. On other weapon developed by Valve to fight cheaters is the VACnet[13], a deep learning system designed to review demos of games and submit suspect case to the overwatch system. While it does not directly ban players, it increase the chances a cheater get banned by demos review. As we can see in the Figure 2.1, there has been a bit more than 100’000 VAC bans per month between 2016 and 2019. But more interesting are the two spikes, the “overwatch peak” in December 2017 / January 2018 and the VAC peak in December 2.3. Current State 7

FIGURE 2.1: Vac and Game bans[17]

2018 / January 2019. The first one corresponds to the introduction of VACnet, the second one can be related to the game becoming free to play at the end of 2018[14]. This suggests that a high amount of bans are related to CS:GO. Based on this, we are facing about 1 million cheaters caught for about 15 millions unique monthly players.

FIGURE 2.2: Personal experience data

Additionally to this I provide data coming from my own account (thanks to the General Data Protection Regulation, and the Chrome browser extension “Ban checker for Steam”). Figure 2.2 is a screenshot from June 2018. As we can see more than 10% of the player I have met in game are now banned, and while we cannot guarantee it is on CS:GO, it reflects my experience of the game. When starting a match I expect that there will be someone cheating. This numbers only reflect what happens in the official matchmaking from the game developer, not the state of the competitive scene, and show only the cheaters caught. Valve seems to put a lot efforts to preserve their game and offer an enjoyable experience to casual players. On the other hand, Faceit and ESEA, have developed anti-cheat clients running on the personal computer of users. By scrolling their ban list, it seems like there is about 30 cheating bans per day on Faceit[15] (for millions of users), and about about 1 or 2 on ESEA[16]. Those numbers are small, especially for the competitive scene, where players pay a monthly subscription, and get prize 8 Chapter 2. Cheating reward. There is money to earn and one can make a name for oneself on those platforms. For obvious reasons both do not disclose the exact way their client works - a guess would be that they do some memory check and take a look at programs run- ning and behavior during the course of a match. However both have limited success, end let too many cheaters stay active for a long time. My understanding of the prob- lem suggest that their approach is not optimal. At high level cheaters use “private cheats” - cheats shared within a small group of “trusted players”. The limited num- ber of copies makes them harder to identify, and makes cheaters more confident they will not get caught. 9

Chapter 3

Economy

3.1 Description

The economy is a game mechanics that implements a momentum in the match - a continuity between the rounds. Each player has money, 800$ at the start. They can spend it to purchase better weapons/equipment/utility in order to increase their chances of success in the round. Players always spawn with a default pistol, but buying better weapons is key to win duels versus the enemies. Equipment looks like this:

1. Primary weapon: Rifles /submachine gun/shotgun/sniper

2. Secondary weapon: Pistol

3. Knife: A default weapon that allows you to take contact fight

4. Grenades: Up to 4 units- high explosive/flash grenade/incendiary/smoke grenade

5. Bombe One of the T carries the bomb for his team (randomly chosen player at the begin of each round)

6. Protection: Body armor and helmet increase the total damage a player can take

7. Defuse kit: Allows CT to defuse the bomb in 5 second instead of 10.

Primary and secondary weapons can be dropped on the ground, typically to give them to a teammate, or to upgrade after killing an enemy. Grenades serve the team strategy. Smoke grenades block the visibility for a moment, incendiary deny access to an area by setting it ablaze. Flash grenade offer the possibility to blind the enemy. The idea of the economy is to reward players with money they can either spend at the begin of a round or keep for future rounds. Every players receives money at the end of each round based on their performance and the result. The winner team gets extra money. This means that the winner of a round not only scores one more point in the final result, but also an advantage in the upcoming round. But it is not because you lost the first round of the game that it is already over. The losing team can save money until they consider that they have enough in order to purchase the equipment needed for their strategy. And the game is long enough to offer multple opportunities to come back: once you win one or two rounds, you will be the one with an advantage! 10 Chapter 3. Economy

3.2 Earnings

Each player of the winning team receives 3400$ for the round. The loser receives 1400$ + k· 500$, where 0 ≤ k ≤ 4 is the number of consecutive lost rounds. An additional 800$ is given to the terrorists if they managed to plant the bomb. Every player gets rewarded with a few hundreds dollars per kill made during the round.

3.3 Spendings

In general you want a equipment good enough to beat your enemies, which means at least equivalent weapons. A typical purchase (called a "buy" in the game) consists of an armor, a M4 assault riglfe for the CT, an AK47 for the T, and a few utilities. Which roughly translates into an investment of 4500$ to 5000$ for the CTs and 4000$ to 4500$ for the T. There is a minor difference in prices in some items that makes a “fair buy” for the T a bit cheaper.

3.4 Strategical Implication

Here is a short list of standard ways to invest money in a round.

• Good buy: When all five players of a team each spend about 4500$, invested in an armor, a rifle and a few grenades. Generally this buy gives enough re- sources to approach the round with one of the many different strategies the team practiced.

• Full buy: Similar to a good buy, but each player is stacked in utilities (items) and sometimes two players use heavy expensive weapons (like the AWP). Usually cost 5500$ or more per player.

• Eco: No money is invested at all. The team assume they do not have enough money and likely lose the round. It buys close to nothing (maybe one flash and smoke grenade just to try a trick) and will most likely have a good/full buy the next round.

• Force buy: When the team has not enough money (usually less than 2500$ per player) but on the other hand an eco round does not make sense, because it needs to win the round - or because it will not have enough money the next round for a good buy anyway. The team invests what it has. This can happen often after a win streak of close rounds, when the team won rounds but with not a lot of player surviving rounds, forcing them to reinvest all the win bonus every round, and thus not sparing money.

• Mix buy: When the economy is very different within the team. Some player are in force buy and other have a good/full buy. This can be the results of a first lost round after many wins, or in a long losing streak.

The game has some kind of 3-5 rounds cycle, in which one team has the momen- tum and wins rounds while the other tries to break the streak. To illustrate this let us consider the typical start of match. Team A wins the first, team B force buy in the second and lose again, then decides to do a full eco round, and lose again. It is now 3-0 for team A but both teams now have a good/full buy. Let’s say team B loose again, which makes it 4 rounds in a row they are losing, they each receive 2900$ 3.5. Visualization of the Economical Situation 11 and thus decides to eco. Next round they have a full buy (2900+3400$). If team B wins the 4th round, at 3-1 comes an extremely important round, where team B needs to confirm their previous win otherwise they will be “reset”. The economy reset is what happen when a team that was winning, lose a round (and gets 1400$), but had no money/weapons spared from previous rounds. This typically means the team is going to loose the two up coming rounds (one force buy and one eco).

3.5 Visualization of the Economical Situation

This section shows how someone can have an understanding of the current state by looking at what happened in the previous rounds. I note W for a round won, and L for a lost one - writing from the perspective of the team I describe the economical situation. The following sequence indicates likely scenarii from a posteriori.

• LLLWW: The team was losing, but manage to win and confirm. They are likely to win the next round because there is a high chance the opposite team is in an eco round.

• WLLLW: The team was going through a reset and managed to win previous round - the upcoming round is likely to be a good vs full buy round. They now need to confirm otherwise they risk again to be reset.

• WLWWW: The team lost a round, but managed to instantly reset the enemy teams and thus won two additional rounds after it.

• LLWLWWW: The team was losing many round, had to eco, then managed to win a good vs good buy round. But then lost and got reset. They have decided to force buy - won an unbalanced round they should have lost. Thanks to this they have reset the enemies and got the momentum.

• LWLWLWLW: Teams are trading round.s They are winning their force buy and losing their good buy. This is extremely rare because if a team is good enough to win a round at a disadvantage, chances are it is good enough to win with the economy advantage.

3.6 Cheater and the Economy

A cheater - by definition - wins games in unlikely scenarios. The idea of the thesis is that in games involving cheaters it is more likely to observe uncharacteristic se- quences of rounds results. For example the alternate sequence WLWLWL... Because of the momentum resulting from a win, cheaters can focus on only winning specific rounds with the help of a software/hardware and win the following ones thanks to the economy giving huge advantage in some situation. Typically winning the first round give two more rounds. In general, winning a round that resets the opponent’s economy almost always guarantees additional points (rounds won) - no matter how large the skill gap between the two teams is.

13

Chapter 4

Collecting the Data

4.1 Data Selection

In order to rewatch a match, the game produces server or client side demos (.dem files)[22]. These files contain all information to recreate the match as it was played. Basically it is a script of the action that need to be performed by the game and thus emulate a replay. A match typically last 45 minutes and .dem files are about 80MB. For the project I have focus on match played in ESEA leagues. The data are available directly on their website. The games are played between teams, so we can expect that they handle the economy as it, and not as five player buying by on their own. It is a competition with cash prize involved so the match are somewhat “seri- ous”. But more importantly the leagues being structured in divisions from amateur to pro level, we can expect most matches to be played between teams and players of comparable skill. A league season lasts for three months and consists of about 16 regular season games played in BO1, and playoff in BO3. I only considered regular season. There is “seven official maps” on which a match can be played on, and most of the team do not master all of the “map pool” - they do not have time to practice strategy for all maps and focus usually on 3-4 of them. Therefore in a BO3, it is common to see team “win on their map choice” simply because they know it better than their enemies. In a BO1, after teams veto each three maps, the left over is usually a good compromise between both team best maps. This choice is made in order to observe the most accurately how a game evolve between two teams of similar level.

4.2 Demo Parser

I first worked on how to get the rounds result out of a game. Before starting I knew it was possible to write a config file for the game client that would listen to specifics “events” and save it as a JSON file. This is not the way to do since we do not want to replay all the game one by one. After documenting myself on the subject I found that there exist plenty different open source parser library for CS:GO demos, including an official one provided by Valve[18]. I then started to read more about how the game works, studying[19] the different events handled. While it is easy to access the teams name, players ID, map, kill, weapon used etc, I did not found explicitly the targeted sequence. The approach I came with to produce it was to get the “round_end" event and the winner of it. Here we are only interesting in the winner of each rounds. Most libraries are complete and allow access to many different data. It is possible to get the position of a player at any time, the direction he is aiming at, his equipement, etc. One think to keep in mind before running statistical test, is that the demo is only a compressed 14 Chapter 4. Collecting the Data version of the actual match played1. Reaction time evaluation from a demo could be misleading. What we are extracting is accurate from the match perspective. Knowing how I would implement the parser made the choice between the dif- ferent libraries easier. I decided for the demoinfos-golang from markus-wa available on GitHub[20]. Despite I’ve never heard of the language before, the readability of the code, the quality of comments and the meaningful example of use provided[21] convinced me. After a few Youtube tutorial about golang, coding the parser was straight for- ward. It takes as input a demo or a folder, get the date of the file and the match number (from the file properties), the teams name, the starting side, the map and rounds results from the demo itself. The output is a CSV file, Figure 4.1 shows how it looks. Figure 4.2 shows the performance2 on a folder of 15 demos.

FIGURE 4.1: Parser output example

FIGURE 4.2: Parser time running on a folder of 16 demos

4.3 ESEA Crawler

Sadly play.esea.net does not provide direct link to download a full season and did not answer to any mails. For this reason I had to make a crawler. It was my first experience in that field. I found a pre existing ESEA[23] crawler designed to extract some statistics on match pages. I started my work on this program by doing some little modification in order to download demos. It is coded in Python using the Selenium and BeautifullSoup packages. The packages offer simple tool to access website, interact with it and process the source code in an intuitive way. The algorithm looks like this: It takes as input a league standing pages. For all team in the standing, go on team pages. For all match on the team page go on match page, on the match page download the .dem file if it is not already done. The idea was to make to program run on a machine form the university through ssh connection. The reason for this set up are: (1) memory space needed to store the targeted 10’000 demos. ( 2) The running time of the program. Both making it impossible on my own laptop. The biggest problem was not to adapt the code, it was intuitive and did not take too much time, both package being well documented with also lot of people using

1A match is played on on a 128 tickrate server, while a demo is about 16 to 32 tick 2Harware details: MacBook Air, Intel Core i7 1,7 GHz, 8Go memory 4.3. ESEA Crawler 15 them. The real challenge was to actually make it work: We had a program capable to crawl and get the data, but it was not capable of doing it for an entire division as it would end up rate limited before the task is done. The website is well protected against bot. To access the league standing I had to use a browser agent - a simple get(url) will redirect me on a “captcha” page. I opted for Google Chrome and the corresponding driver version. With this in place I was able to crawl through the league standing, all the team and match pages. The website also has rate limitation, typically after 40 demos my IP would end up temporay banned. Figure 4.3 illustrates the types of difficulties I had to deal with.

(A) Cloudfare protection

(B) Error 403 for ESEA website

(C) Captcha

FIGURE 4.3: ESEA making it hard to crawl

The solution looked simple at the time, make it run on a university remote ma- chine with a pause in between downloads. It did not work. The remote computer is not equipped with a screen and a graphical environment, forcing me to use the “headless mode” of Chrome driver. But this is detected by play.esea.net, and thus the program would simply be redirected again to a captcha test. After research I discovered that website have access to some browser informa- tion, and can do fingerprinting ban (identifying unique browser settings for users with malicious activity). But also website can send some challenge that browser can solve in order to verify the legitimacy of a request. 16 Chapter 4. Collecting the Data

It is at that moment that I encounter some ethical debate on forums whether web crawling can be associated with hacking. For me it is important to think about what I am doing. So here is my opinion on the subject. Computer science automates the process of information. Internet is the automated sharing of data, website is the automated availability of data, while crawler are automatized access to data. It would be a bit hypocrite to own a website and share information without allowing people to access it automatically. As long as I’m only accessing public information, and that I’m not damaging the website with abusing their traffic I do not consider crawling near hacking. The problem with the headless mode of Chrome is that, firstly in the request the agent is “headless”, has a screen size of 0, or no screen, and that it does not run javascript on pages. I found a full tutorial[24] on the topic and tied to apply the presented method: It considers a set of usual challenges and check up, and provide code to bypass it. The set up consist of making the traffic of the crawler firstly go throw an HTTP proxy that runs all the code before the actual agent. I’ve managed to apply this procedure on my laptop as well as on the university machine. Sadly it did not work. The problem is most likely related to the code handling the plugins length test that fail as we can see in Figure 4.5. I did not spend more time trying to fix it since I had another idea, but I want to point out that it was a very instructive approach that definitely teaches me a lot about internet, webpage process and related strategy. One thing to note is, as we can see in the Figure 4.4, the difference in traffic between what happen on my computer with a “normal chrome agent” and on the remote computer in headless mode - again probably the plugins length set to 0 suggesting to the website it may be a request from an undesired source. By curiosity I directly open some of those pages and some of them look indeed like browser test. Since my program was working in normal mode, why not just “give a screen” to the remote machine so it can run it without headless-mode. I have started to set up it using Xpra[25], but at that time ESEA changed their website, in particular they added new data to the match pages - including the rounds score. The crawler was still working, but this changes had a good impact. Now that the targeted data are directly available on the website, I do not need to download multiple terabytes of demos. Which means I can run it from my computer in a reasonable time, one season per night.The only remaining challenge from there was the Error 1015: Rate limited. The evaluation of the traffic coming from my program was the following. For top competition (division: main, advanced, MDL) there is about 100 teams per stand- ings, that each play 16 games in a regular season, which translate to approxima- tively 800 match page to visit, lets count large including the team pages, we are visiting 1000 pages per league extraction. So I have played with sleep time, target- ing an extraction in 1 to 8 hours. The interesting result is that I would always end up rate limited after approximatively 70-80 match pages visited - far from the full divi- sion season goal. My guess is that the Cloudfare bot management machine learning algorithm[26] is doing great, probably helped by the thousands (millions ?) of reg- ular users. A quick other try was made by using different “offline Browser” that would save a local version of the site for me, but after 3 different unsuccessful tries I moved to the classical “IP rotation” solution. After documenting myself on the internet about “massive crawling and scrap- ping” it became clear that the use of proxy server was a necessity. I have found many full tutorials[27] on how to set up rotating IP addresses. I was also able to find plenty free proxy addresses ready to use. Some of the proxy I got access to were not stable - sometimes they would be available sometimes not, some of them would just not work, be redirected to captcha test, password protected etc. The large amount of 4.4. Final Crawler Version 17

(A) Headless on the university machine

(B) Regular personal machine

FIGURE 4.4: Traffic through the mitmproxy different proxy adress, and their instability make it impossible to extract a "perfect working pool". We can see in Figure 4.6 the progress made with the use of a proxy pool.

4.4 Final Crawler Version

The algorithm used is very simple. From a league standing, get all the team, on each team page, visit every match page they have played. Process the match page to get all the useful information we are looking for. To run the program succesfully we use two strategies. Firstly we need a proxy pool, and we use an eseaSpider object that handle all the connection to the website. It has a counter to change the IP adress before it gets rate limited, it recognize different types of URL to adjust waiting time and the counter depending if a demo has been downloaded or not. Additionaly to this, because we know that some proxy will not be able to achieve the task, the program will stop in case of failure (bad proxy). But 18 Chapter 4. Collecting the Data

FIGURE 4.5: Headless test result: missing plugins

FIGURE 4.6: Rate limited, but crawler loading a page with proxy before stopping the work, the program save all the data in a CSV file, save as binary files the state of the proxy pool as well as the team and match page already visited. With this we can simply restart the program and it will continue its task without redoing what was already done. The program recognize different scenarios for match that have not been played, where advanced data are not yet available but the demo can be downloaded. It can also recognize matches that were overturn (winner of the game changed afterward) because of "malicious activity", this is often the case when one player was later found cheating in the game. In general the end CSV contains data for more than 85% of the games. Most of the remaining are games that were forfeited by one of the team. In terms of performances, the program can extract data from more than 200 match page in an hour3. As initialisation the only work needed is to provide a league stading URL and a "league name" used to create different folder and file for the sav- ing session.

3Harware details: MacBook Air, Intel Core i7 1,7 GHz, 8Go memory 19

Chapter 5

Analysis

5.1 Preface

5.1.1 Time Line Before starting any computation over the data, few things needs to be considered. The focus is put games played before the 13th March 2019[28] when a major change in the economy happened. Previously after winning a round the “loser counter” would be set to 0 (subsection earnings: k=0), after the patch, the counter is reduce by one (k=k-1) and is not bounded by four anymore. This update was released right after I started to work on my thesis, meaning there has not been enough time for players and team to figure out all the consequences and for a “meta to stabilize” (the set of economical strategy adopted by the players). The fear is that the "reset" effect of the economy disapear. Also I think this changes make the economical cycle less predictable, more chaotic to some extend, and may complicate the analysis. Another date to keep in mind is the 9th October 2018[29], at the begin of each half, both team start the game with the “loser counter” set to 1 (previously 0), this was made “with the goal of reducing the impact of a pistol round win on subsequent rounds”. Usually when a team wins the pistol round (the first round of an half, when both teams have no money), they would also win the two following ones (enemy being in eco/Force buy rounds). Which means that winning both pistol rounds would gave a 6 rounds lead (16 rounds for the win), an heavy advantage, specially in best of one matches. While this update could have had a big impact on the competition, I do not think it had a major one on the economical aspect of the game - 14 out of 15 rounds per half follow the exact same rules - and thus games before or after that date can be studied together. This is one of the reason I keep track of the date of every games in the data. This gives a window where approximatively two season where played on ESEA[30]. During this period there was one team live banned during a game for by the ESEA anti-cheat client[31], giving us a valuable reference for our analysis.

5.1.2 Overtime If the game is 15-15 after 30 rounds, overtime is played. It takes the form of a small match with two half of each 3 rounds, but since both teams start with 10000$ per player, they have enough money for a good buy every rounds. This means the economy has no real direct impact on what happens and thus it is hard to make a distinction between cheater and better team based on what happened during those rounds. “The game has no more memory ”. For this reason we look only at the first 30 rounds. 20 Chapter 5. Analysis

5.2 Methods

There are three different standards for this kind of data analysis: use Mathematica, R or Python. The choice of Python was made because it is a full programming lan- guage, easy to access and common. The work was made in a Jupyter Notebook in order to set up the data processing in a more flexible, but it also is a good way to share the results and the protocols all at once. I’ve used mostly four packages, standard for this kind of analysis: pandas, numpy, sklearn and matplotlib. These are powerful yet simple libraries to use. The analysis itself can be seen in two parts. Firstly, attempts to understand how a competitive game looks like, this for example the part where I tried to quantify the consequences of the economical cycle of CS:GO. It set a reference for what we ob- serve. Then the focus is shifted towards the detection of cheater. Since the approach does not really support the claim that someone was cheating, I’ve tried to identify suspect. Teams that play the games and have success not like the others, and for this to come up with multiple abnormal element to support it.

5.2.1 Database Size The data we are running the analysis on consists of games played in five different league around the transition from amateur to professional level. To be more specific we have study the following division in the ESEA European competition: MDL29, MDL30, Advanced29, Advanced30, Main29. Cumulated, this represent more than 2000 games, 4000 CSV entries. In general for the test we consider teams that have played over 13 games (maximum is 16 games played in a season).

5.3 Experiences

All the experiences in this work have been oriented towards understading the im- pact of the economy over the game proceedings.

5.3.1 Entropy Since the project is motivated by the idea that the economy implement some kind of memory, the first test to conduct is to try to measure by how much a round is impacted by the previous one. Since during the semester I was following a course about Information theory, it was natural to try to compute the Shannon entropy. This was done by recursively listing all the possible words of length 1, 2, 3, etc, built on the alphabet (W,L), compute their empiric distribution in the wlscore entry of the CSV files, and then apply the entropy formula.

n H(X) = − ∑ P(xi) logb P(xi) i

5.3.2 Pattern Distribution The ultimate goal is to see if the economy characterizes the game strong enough so that it can be used to identify cheaters. In order to see how the result of a round impact the following ones, we need to consider different substring of the score and extimate their distribution. We do this for every team with enough game played (13). The impact of the ecomomy on the game is estimated by the entropy test, what 5.4. Analysis Conclusion 21 we want to see here is if this impact is "uniform", if every team is impacted the same way. Since the amount of game played by each team is relatively low (at best 16 in one season) we have to consider small pattern - word of size 4 - so that we have enough data for the computation to be relevant. To increase the count of each pattern we allow overlapping substring: WWWWW contains two times WWWW.

5.3.3 Round and Game Win Rate One common symptom of cheater is that their win rate is higher than it should be. In the case of a game like CS:GO the match win rate can be compared to the round win rate. The intuition is that team with high match win rate have also high round win rate, while bad teams have both low round and match win rate. But maybe some teams have high match win rate with lower rounds/win rates?

5.3.4 The Path of a Game This test is less intuitive, and the best way to explain the reason of it, is to consider the game under other rules. Lets consider the game without the economic implica- tion, and consider a match played between two team of the exact same level, then each round has a probability of 50% to be won by one team. This form a basic ran- dom walk. We can look at the intermediate score after a few rounds and we should observe a Gaussian distribution centered around the draw. Now we know that the economy implement some kind of momentum, so we do not expect to see any Guas- sian distribution. But on the other hand the game last for many rounds, teams do not stop after the few first rounds. And it is not rare at all to see the team that was losing 0-3 win the game 16-10 for example. So if the economy momentum drives the score in one direction, maybe the reset mechanics allows the game to evolve back to a Gaussian. The idea behind the test is that maybe the game has some alternate phase where the intermediate score look like a Gaussian (the game is draw), or look like two hills (one for each team winning).

5.4 Analysis Conclusion

We used a Jupyter Notebook to run a set of test on the extracted data. The focus was on the score string consisting of W/L up to the 30 first character. We try to un- derstand how the win of a round influence the following ones (how the economy impact the game). The entropy computation is there to validate the approach, and indicate the size of the interesting patterns. The pattern distribution is a direct vi- sualisation of the impact of the economy as well as a first way to indentify outliers. The game path test may suggest where to look more exactly the pattern.

23

Chapter 6

Results

6.1 Experiences Results

6.1.1 Entropy The computation show that the more round we consider in our pattern the more the entropy drops (below 1). We could not compute a "limit value" because of the lack of data. Since we assume that games are played between teams of equivalent level, this shows that indeed the economy has a strong influence. The test showed that for words of length 4, the entropy drops already enough to compressed a 30 rounds match into a 29 binary string. We have one round of redundant information. An experimented player can make good assumption on what happend in a four round substring and also make some reasonable prediction about the upcoming rounds. With length 4, we are facing sixteen different patterns, which is easy to visualize. From the economy mechanics, in four rounds we are guaranteed to observe at least two "fair round" (good/full vs good/full buy). But the momentum is also apparent, since after losing a round you usually go throught a force and an eco round - with lower win rate. For thoses reason we studied the distribution of pattern of length 4. That being said, the test also showed that the entropy drops significantly be- tween words of length 4, 5 and 6 (more than 0.01 each times). And for words of length 6, the entropy is low enough to compress a 30 rounds game into a 28 binary string. On top of that the economy not only implement a three-round momentum but also offer a "reset" possibility which happen in a fourth and fifth rounds. That we can not realy hope to see in our pattern of length 4. Important to note is that the entropy drops even more when computing it for words of length 9, 10. This is understood as the effect of the lack of data inflating the real distribution.

6.1.2 Pattern distribution In Figures 6.1 to 6.5 the distribution is expressed not in terms of probability but by how much the probability of a pattern changes from the expected one if it was a uniform ditribution. A pattern for a team that has a value of 1,5 means that this pattern is 1,5 more likely than the average. The unifrom distribution would look like a straight line where every patterns take the value 1. We show here for each teams in their respective division the distribution of patterns of length 4 (as discuss in the previous entropy test). From the distribution, we observe that patterns containing three consecutive rounds won by the same team are more likely. This is the confirmation that the economy implements a momentum in the game. 24 Chapter 6. Results

We observe that the distribution looks similar for almost every team in every division. This is a powerful and promising result. We are truly observing the con- sequence of a game mechanics and not a meta emerging from teams playing at a specific time at a specific level. The pattern distribution is a constant in a competi- tive environement. The graphs are symmetric: this is expected since in the data each game is present from the winner and the loser perspective. It is not a perfect symmetry since the pattern are scaled by teams (we want to understand if the impact of the economy on each team), and that sometimes teams do not make the thirteen games threshold. One surprise is that the pattern WWWL is more likely than the pattern WWWW, after winning three round you have more chance to lose than win the upcoming one. This is an additional reason to study the distribution of pattern of bigger length, as this can be the result of the economy reset effect. This is also another evidence that the game could evolve in "phase" where each team dominates alternatively the other.

FIGURE 6.1: ESEA EU MDL 29

FIGURE 6.2: ESEA EU MDL 30

6.1.3 Round and game win rate In this test each dot represent a team by its round and game win rate during a season. We see in Figure 6.6 that it form a line as expected. What is interesting is that the ratio between theses to rates is not 1 for 1. A 40% rounds win translate in less than 20% game won. On the other hand, 60% round won is already good enough to put you at the absolute top of your division. This reinforces the idea that you do not need to win every round, but that the game has some extremely important rounds - for examples where both teams could end up reset if they lose it - and that cheating 6.1. Experiences Results 25

FIGURE 6.3: ESEA EU ADVANCED 29

FIGURE 6.4: ESEA EU ADVANCED 30

FIGURE 6.5: ESEA EU MAIN 29 in those occasional moments in the game leads to a bigger advantage in the match than the round itself.

6.1.4 The path of a game For this test we have a problem of data quantity. What we want is to understand how the intermediate score evolve during the game. While we are just counting how many time a score is present in the database, what we are actually estimating is the impact of all the possible substring leading to this score. The hypothesis (con- firmed by the pattern distribution test) is that those path are not of equiprobability. In other terms if we do not have enough data to have a good enough approximation of the distribution of all the different scenario leading to an intermediate score, the test is not concluding. We did the test for all the games collected (2000+ games), if 26 Chapter 6. Results

(A) ESEA EU MDL 29 (B) ESEA EU MDL 30

(C) ESEA EU ADVANCED 29 (D) ESEA EU ADVANCED 30

FIGURE 6.6: Comparing game and round win rates we want to see the intermediate score after 7 rounds, we have to consider all the 128 different scenarios played, which means for a uniform distribution we will count each of them approximatively twenty times. It becomes too ambitious to conclude anything for the intermediates scores after round 9,10, because this count drops be- low 5. Additionaly it is important to note that the entropy also showed its limits towards this pattern size.

FIGURE 6.7: All five season considered at the same time, X axis is the number of round played, Y axis is the number of round won by the team that started as CT

As one can see in the Figure 6.7, the result shows that after two rounds it is likely 6.2. Results Conclusion 27 that one of the team is winning 2-0. The draw, 1-1, is rare and thus we have nothing like a Gaussian. This is expected since the update mentioned in Section 5.1.1 Time line. Before this update, we would most likely have faced the same effect on the 3th round, with 3-0 and 0-3 being heavly represented. On the 7th rounds we can see that the score is concentrated around 3-4 in favor of the T. What happend in between is not very clear, but the graph seems to have some holes, some scores that the game avoid. With more data, it would be very intresting to see if this happens again later in the game. This test gives a strong indication on where to study the pattern distribution since the game is driven from specific score to other new specific score.

6.2 Results Conclusion

The tests show that the economy has an heavy impact on how the game is played. It also show that in order to have a complete understandings of the phenomen we need more data. But even when studying pattern of size 4, the distribution of possible scenario is specific - but standard at every level for every team. This gives high hopes that outlier from this perspective could be correlated with cheaters.

29

Chapter 7

Conclusion

7.1 Conclusion

In this work we considered CS:GO - a First Person Shooter where competition in- volves a lot of money. We introduced and estimated the cheating problem as well as the common used tools to counter it. We suggested that in theory the economy of this particular game could help to define how a match should look like from a statistical point of view. We ran different tests to confirm that this mechanic does indeed impact the game and that its effect is uniform across different skill level and at different time in the year. From our tests we were able to quatify the momentum implemented by the economy mechanics. We were able to observe the impact of an update on this mechanics. Our tests set a basis to understand what we should expect and hint that indeed it may be possible to identify cheaters from an statistical approach.

7.2 Future Work

Now that we understand better what a normal game looks like, we can try to find "abnormal" games, more specificly we can look out for team exhibiting different pat- tern distribution than the one expected. We can then compare it to known cheating teams, teams with players that have been banned in the past etc. The main benefit of this approach over then standard anti-cheat client that recognize cheat signature on the personal computer of the players, is that it is not a live detection, but an a poste- riori method. Games that have been played can still be overturn even if at that time the client did not detect the actual cheat used. The real power comes when compar- ing the analyzed data with a client listing the software/hardware used by the player at the time of the match, to see if we can identify new cheats by comparing teams with same economical behaviour.

31

Bibliography

[1] YouTube https://www.youtube.com/watch?v=OkoeWRJEsc4 CS:GO_RiGhT’s POV of "Inhuman Reactions"

[2] HLTV https://www.hltv.org/stats/maps?startDate=2019-01-01&endDate= 2019-07-01&matchType=Lan&rankingFilter=Top20 Map statistics 2019

[3] Mathieu "Maniac" Quiquerez https://twitter.com/maniac_csgo/status/1071354415779602433 CS:GO analyst and ex pro player

[4] Faceit https://www.faceit.com/en

[5] ESEA https://play.esea.net

[6] Newzoo https://newzoo.com/insights/rankings/top-games-twitch-youtube/ Most Watched Games on Twitch and YouTube

[7] Dexerto https://www.dexerto.com/esports/top-10-viewed-esports-events-of-2018-267145 Top 10 most viewed esports events of 2018 have been revealed

[8] Esportsobserver https://esportsobserver.com/twitch-viewership-2018-csgo/ Counter-Strike Twitch Viewership Up in 2018, Lead by Majors

[9] Esports Earnings https://www.esportsearnings.com/games Top Games Awarding Prize Money

[10] The Esports Integrity Coalition https://www.esportsintegrity.com/wp-content/uploads/2018/11/ esports-Threat-Assessment.pdf

[11] Counter-Strike Wiki https://counterstrike.fandom.com/wiki/Overwatch Overwatch article

[12] Counter-Strike Blog https://blog.counter-strike.net/index.php/overwatch Overwatch FAQ 32 BIBLIOGRAPHY

[13] PCGAMER https://www.pcgamer.com/vacnet-csgo/ VACnetarticle

[14] Counter-Strike Blog lhttps://blog.counter-strike.net/index.php/2018/12/21530/ Release Notes for 12/6/2018

[15] Faceit https://www.faceit.com/en/bans Banned list

[16] ESEA https://play.esea.net/index.php?s=support&d=ban_list&type=1 Banned list

[17] Steam data base Steambansstatistics,source:https://steamdb.info/stats/bans/ Latest Game and VACBans

[18] ValveSoftware https://github.com/ValveSoftware/csgo-demoinfo CS:GO demo parser

[19] AlliedModders Wiki https://wiki.alliedmods.net/Counter-Strike:_Global_Offensive_Events Counter-Strike:Global Offensive Events

[20] Markus-wa GitHub https://github.com/markus-wa/demoinfocs-golang CS:GO demo parser

[21] Markus-wa GitHub https://github.com/markus-wa/demoinfocs-golang/blob/master/examples/ print-events/print_events.go Print CS:GO events example

[22] ValveSoftware https://developer.valvesoftware.com/wiki/DEM_Format Demo Format

[23] Mike Yue GitHub https://github.com/Mike-Yue/esea-league-scraper ESEA league scraper

[24] Evan Sangaline https://intoli.com/blog/making-chrome-headless-undetectable/ MAKING CHROME HEADLESS UNDETECTABLE

[25] Xpra http://xpra.org Multi-platform screen and application forwarding system

[26] Cloudflare https://www.cloudflare.com/products/bot-management/ Cloudflare Bot Management BIBLIOGRAPHY 33

[27] ScrapeHero https://www.scrapehero.com/how-to-rotate-proxies-and-ip-addresses-using-python-3/ How To Rotate Proxies and IP Addresses using Python 3

[28] Counter-Strike Blog https://blog.counter-strike.net/index.php/2019/03/23488/ Release Notes for 3/13/2019

[29] Counter-Strike Blog https://blog.counter-strike.net/index.php/2018/10/21333/ Release Notes for 10/9/2018

[30] ESEA https://play.esea.net/index.php?s=league&d=standings ESEA league and standings

[31] ESEA https://blog.esea.net/esea-hardware-cheats/ Cat And Mouse - ESEA Anti-Cheat