Server-Side Bot Detection in Massively Multiplayer Online Games
Total Page：16
File Type：pdf, Size：1020Kb
Securing Online Games Server-Side Bot Detection in Massively Multiplayer Online Games One of the greatest threats that massively multiplayer online games face today is a form of cheating called botting. The authors propose an automated approach that detects bots on the server side based on character activity and is completely transparent to end users. assively multiplayer online games levels. Not surprisingly, privacy (MMOGs) have soared in popularity in issues have also emerged.3 the past few years, with a rapidly grow- We propose a novel approach that relies solely on a STEFAN ing user base and game studios pouring server-side analysis of character (or avatar) behavior to MITTERHOFER Mtens of millions of dollars into developing their next expose bots and avoid many of the drawbacks found in AND CHRI S TIAN big title. The market leader alone—Blizzard Enter- client-side solutions. To this end, we exploit an intrin- PLATZER tainment’s World of Warcraft (WoW)—surpassed sic bot feature—namely, the fact that it’s controlled Vienna 11.5 million subscribers in December 2008, raking by a script that automates a specific sequence of con- University in an estimated US$150 million in subscription fees stantly repeated actions. We focus specifically on the of Technology per month. With such amounts of money at stake, game character’s movement by extracting waypoints it’s not surprising that game companies want to keep that describe the traveled path and finding repeated CHRI S TOP HER their paying customers satisfied and threats to their patterns in the route taken. (Here, a route is the course KRUEGEL revenue base at bay. One of these threats is botting, a of movement that a character performs in the game University of form of cheating1 in which players use a program that world, and a path is a sequence of locations that the California, can play the game with a minimum of (or sometimes character visits; a route can follow the same path sev- Santa Barbara even zero) human interaction. eral times over.) We implemented and evaluated our To the best of our knowledge, the only automated approach in WoW. ENGIN KIRDA tool against bot programs is the Warden, an applica- Eurecom, tion that monitors WoW.2 The Warden runs on a How Bots Work Sophia player’s computer while he or she plays WoW and Players gravitate to bots because parts of a game can Antipolis, checks for suspicious programs such as debuggers be inherently repetitive or boring. In particular, a France or bots. It reports back to Blizzard, and any viola- player might need to kill large numbers of enemies to tions result in temporary or permanent account bans. gain experience points and earn gold (a process called However, the Warden has several shortcomings: it farming in the gaming community), which is often re- can perform signature checks only for known pro- quired to improve the character and progress further grams, which means it’s always a step behind bot in the game. Running a farming bot means that the writers, and it runs on the client’s computer, which is character reaps experience points and gold without completely out of Blizzard’s control. This ultimately the player investing any time in the game, as the bot means that its results can’t be trusted. Additional- can reap those rewards very efficiently 24 hours a day, ly, players have already created some simple work- without fatigue or boredom. arounds, such as starting the game in guest mode on Interestingly, players don’t use bots just to improve an administrator account, which prevents the War- their own characters. There’s a booming market for den from accessing the processes at higher privilege points, gold, and fully realized characters on the Inter- MAY/JUNE 2009 ■ 1540-7993/09/$25.00 © 2009 IEEE ■ COPUBLISHED BY THE IEEE CompuTER anD ReLiaBILITY SocieTieS 29 Securing Online Games net for those people who don’t want to go through the because, based on map files, the game engine decides hassle of obtaining them through hours of playtime. on the fly if the current step is possible or if an ob- According to some estimates,4 up to 400,000 people stacle is large enough to block the character. Hence, in China work as gold farmers for MMOGs, gathering the bot program would need to re-implement parts of gold and other in-game items and building up charac- the game engine and use a sophisticated route-finding ters for the sole purpose of selling them online. Obvi- algorithm to calculate a sensible movement route in ously, bots are even cheaper than human labor, making advance. To avoid this problem, the player usually them the ideal tool for manipulating the game. “teaches” the bot a certain path by running it him- or Botting’s impact on a game can be substantial. In herself, with the bot recording waypoints that it will particular, it can lead to significant levels of inflation follow later to replicate the path. in the game economy because bots can, for example, Another way of getting information about the create unusual amounts of gold by perpetually slay- game’s surroundings that works particularly well in ing monsters. This large amount of circulating gold in WoW is to write an add-on for the game’s scripting turn increases prices for items to the point where hon- engine (which offers a limited API to query game in- est players can’t afford them anymore, affecting their formation). Although the add-on can gather the de- motivation to play at all and, ultimately, the game sired information with this method, it isn’t possible to company’s revenue. The Lineage game series suffered control the game through the API. Thus, the add-on from this snowball effect.5 outputs the information to the user interface by color- Considering botting’s negative impact, it’s not sur- encoding certain pixels. A desktop automation script- prising that online game providers usually forbid its use ing environment such as AutoIt (www.autoitscript. or try to keep it at a minimum in their games. How- com/autoit3/) then reads and decodes these pixels, ever, it’s difficult to recognize bots because they typi- decides the necessary actions, and communicates cally obey game rules. When game providers take any them to the game client. action to detect bots in their virtual worlds, it’s usually through human interaction—essentially, a mechanism Our Analysis Mechanism that lets players report suspicious characters. When a Contrary to human players, who roam freely in a virtual player reports a suspicious character, a game modera- world, bots follow a prescribed or previously recorded tor approaches the character in-game and tries to start list of waypoints. This suggests that although a human a conversation, thus checking to see if a human is at player’s movements drawn on a two- dimensional map the keyboard. However, this method is inefficient and (a movement graph) will look more or less random, doesn’t scale well for worlds with tens or hundreds of such a graph produced by a bot will show that it takes thousands of simultaneously online characters. certain paths repeatedly. Bots usually follow paths A more appropriate way to automatically detect more or less exactly, but they sometimes leave them bots is to focus on the server side, not the client side. to attack a monster or collect loot from a slain enemy. Bots usually move around virtual worlds, killing non- These small irregularities increase the difficulty of de- player mobile entities (mobs). To achieve this, a player tecting them through movement analysis. must specify a certain script that determines which From looking at a movement graph, it’s often actions the character chooses. Depending on the game straightforward for humans to recognize repeated situation, this can include the sequence of spells to cast movement patterns, but this solution doesn’t scale to in combat, under which circumstances the character large populations of players. Our approach automati- heals itself, and whether it picks up loot from enemy cally detects if a bot is in control. To accomplish this, corpses. The player additionally sets a path that the bot it first processes and transforms a character’s move- should follow and the enemies it should attack. ment data before it interprets the results of these steps To execute a script, a bot must first collect infor- to expose bots. mation about its surroundings in the virtual world and then react to that data by sending commands to the Collecting Data and Building a Route game. Humans simply look at the computer screen to When a player moves his or her character in a virtual determine trees, mountains, and mobs, but bots must world, the game client regularly sends packets with apply different methods to collect this information; new coordinates to the server. Hence, the movement currently, the most common way is through memory coordinates are readily available on the server side. We reading. Similar to a debugger, the bot program hooks log the character’s movement and use this game trace into the running game process and reads the list of as the basis of our detection approach. mobs and their locations directly from their represen- In the first processing step of our approach, we re- tation inside the game’s memory. construct the route that the character took in the game Although this works well for mobs, it isn’t feasible world simply by connecting the coordinate dots that to obtain the necessary terrain information this way arrive at the server.