Bhop Detection Changes

[J-Tanzanite]

Just a place where we can discuss how to go about changing Bhop detections to be better and still be fast.

[J-Tanzanite]

Things to change / Requirements:

• Bhop bans can't be set to be permanent, and will be limited to tops 3-6 months, any suggestion as to what the limit should be?
• It should check how often a player can do perfect Bhops in a row, and take into account +jump ticks.
• • But be configurable, easy to understand and pre-defined with good settings.
• Warning in chat for Admins when it suspects a player is doing too many perfect Bhops.
• A "max bhops" ConVar, for those who wish more control.
• The new system still has to be fast at detecting cheaters, I have a general idea as to how to do this, but suggestions are welcome.

Something else of note, there is a Macro detector coming in version 1.7.0, which is disabled by default (Because many server owners don't mind Macros, and this should be Opt-In, instead of Opt-Out).
And the Bhop detector should take Macros into account...
Sadly, due to how cheats bypass SMAC's Bhop detector, we can't make this that easy to bypass...
Plus, I've seen cheaters who do 40+ +jump ticks on Bhop...
The reason I know they are cheating is because they also got Aimbot detections (Several), Anti-Aim (Pitch AA, Duckspeed), spinbot in demo recording, Aimlock detections and chat-clear detections... So it deffo wasn't just a macro xD

[J-Tanzanite]

10 bhops in a row is already rare enough, waiting for 10 warnings in 10mins is just too much

I agree, hence why I don't like it.

Seriously, you know it's unlikely to get 10 bhops in a row. Why do you want to wait that much time to ban?

To remove all doubt... But it's too slow, and it would take ages before someone gets banned.

---

I did consider dropping the ConVars and instead use commands, but I don't like the idea of hiding settings...
But considering this is something most server owners shouldn't touch in the first place... Perhaps it's fitting.

lilac_bhop could be used for the preset-configurations.

• 0 = Disabled.
• 1 = Low (Default perhaps), min = 6, max = 15, total = 3.
• 2 = Medium, min = 6, max = 17, total = 5.
• 3 = High, min = 7, max = 20, total = 5.
• 4 = Custom (Unlocks the command lilac_bhop_set command).

The negative values would mean the same thing, but be log-only.

Little unsure about these values, but since they are predefined configs for server owners to use, updating those through updates wouldn't break the third rule:

3. Updates MUST NOT BREAK PREVIOUS SYSTEMS. This is a requirement, I cannot make an update that breaks things (on purpose).

They wouldn't be breaking anything, just making things safer and accurate... So it's a nice idea.
I'd like to hear your idea on what the default preset values should be.

I think the command should work like this:
lilac_bhop_set <min | max | total> <value>
and not like:
lilac_bhop_set <min> <max> <total> <value> <value> <value>

This is because if you or a plugin wanna change a single setting and not change the others, you now have to remember each of the other settings, making changing anything a mess...
So setting the settings one by one is preferable.
Example:
lilac_bhop_set min 6
lilac_bhop_set max 20
lilac_bhop_set total 4

---

This system sounds way more simple and intuitive for server owners, props 2 u c:

[J-Tanzanite]

Ok, the previous comment is... Incorrect with the current 1.7.0 version. So here's how the new 1.7.0 system works:

Disclaimer: My keyboard is broken atm, so... You might see a few keys being pressed twice... Especially comma, semicolon, underscores and dashes... I'll get a new keyboard someday... Getting good keyboards in Norway is a pain ):

---

The ConVar "lilac__bhop" was changed, the minimum is -6 and the maximum is 6.
Negative values means "Log detections only, don't ban" (This is true for most cheat detection ConVars now).

0 = Disabled.
1 & 2 = Reserved/Placeholders, you can't pick these options, more on this later.
3 = Custom.
4 = Low.
5 = Medium (Default).
6 = High.

Each mode refer to how "aggressive" the Bhop check is, the higher it is, the faster it detects and bans cheaters, but also means it has a higher false positive rate.
The high mode is similar to the 1.6.X version, although slightly safer. It isn't recommended,, but it's there if people still want it (I don't).

1 & 2 are placed there so already existing configs don't break or suddenly begin acting really differently from what server owners expect.
If "lilac_bhop" is set to 1 or 2, it will tell you that those modes have been removed, and it will then set lilac_bhop to Medium.

Custom and Low modes have the same preset, except if you pick Custom, you can change your detection thresholds.
The Custom setting unlocks the command "lilac_bhop_set".

---

Here's how you'd use the command:
lilac_bhop_set
List of types are as follows:
min, ticks, max and total.

"Min" is the minimum consecutive perfect Bhops before it triggers a single detection.
I'll refer to these as "min-detections".
A "min-detection" expires after 10 minutes (This value is not set in stone, may change).

---

"Ticks" can be used to prevent min-detections from occurring.
It's a bit hard to explain, but it's a buffer.
Lets say you have the min set to 7, and the ticks set to 5.
The minimum jump ticks requires to do 7 bhops is - well - 7. And if ticks is set to 5, then the maximum jumpticks is 7+5 = 12.
This means that if you do 7 or more bhops and your jumpticks were higher or equal to 12, then you won't get a "min-detection".
You could use this to filter out legit spacebar presses, a lot of scroll (not all) and macros. Cheats tend to do 1 tick perfect inputs, and assuming no SMAC bypass is enabled, it should get a min-detection with ease.

If you want to account for SMAC bypasses, then you simply add the min value as well, like:
lilac_bhop_set min 7
lilac_bhop_set ticks 12
12 = 7 + 5. But when it checks for Min-detections, it will add the min value, so you're effectively doubling the jump ticks required, plus 5 as a buffer. Meaning the total buffer is 7+7+5 = 19.
I know this may be a little confusing at first, but it makes sense to make it this way.
Especially if you ONLY wanna ban for 7 bhops and 7 jumpticks, and ignore bhops with 8 or more jumpticks.
Which would be done like so:
lilac_bhop_set min 7
lilac_bhop_set ticks 0

If you want to disable the buffer entirely, you can do:
lilac_bhop_set ticks -1
This means it will not check jumpticks and check if you did "min" perfect consecutive bhops before giving a single min-detection.

---

"Max" means the maximum perfect consecutive Bhops done before doing an instant ban.
This value NEEDS to be high.
So lets say it was 15.
That means that on the 15'th perfect consecutive bhop, it will instantly ban the player.
Setting this value to 0 disables it, and it will only check for min-detections.

---

"total" is the total min-detections before banning.
This is pretty straight forward.
I noticed I made a little mistake in the pre-set configs, but I'll fix that soon :)

---

The default ban length for Bhop will remain as 1 month, I don't think I will change that.
Unless I get a good reason to do so.

---

When it comes to the preset values, they are as follows:

Low/Custom:

• min = 7.
• ticks = 7+5. // SMAC Bypass.
• max = 20.
• total = 5.

Medium:

• min = 7.
• ticks = -1. // Ignored, might change this to SMAC bypass, so legits are very unlikely to trigger... Although I think the "total"+"min = 7" more than enough covers legits.
• max = 15.
• total = 4.

High:

• min = 5.
• ticks = -1.
• max = 10.
• total = 2/4 (Fix coming soon. Props to you if you can spot what I refer to ;) )

These values may be changed in the future, these are just tmp values for now.

[azalty]

This seems pretty good, except the "high" setting which is still low in my opinion, setting it's "max" to 12 should do the trick though (also total = 2/3 seems low to me)

sad to see injection type detection leave with the default presets

As I already stated, imo ticks=min*2+.. is enough to catch legit people in my opinion, though I still need to do some statistics to get real numbers. Total = 5 is still really high, and setting it to 3 should still be accurate while being a lot more efficient

There doesn't seem to be an easy way to catch injection type bhops, normal frequent bhops ("min" cvar), and high amount of bhops ("max" cvar)

Trying to catch injection type bhops instantly (total = 1) would disable the other "min" and "total" approach

As I said, if you want accurate detections, you need a lot of testing and clearly LilAC is not a bhop AC but a general AC, and I think these new methods and configs are WAY better because the original did WAY too much false positives on Jailbreak/MG/... servers

Medium seems balanced. You COULD get 1 false positive in a year or so, but it's not a problem since as we said, it's probability versus efficiency, and server owners / admins know that it'll be accurate if it's a fishy or new account VS a veteran that is generally good at bhopping

[J-Tanzanite]

Firstly, nice name :D

Anyway, lets see if I've understood you correctly:

---

Regarding the High mode, fair. Max = 12 should be good.
When it comes to the total... Yeah that is low, perhaps 4 is low enough.
If admins wanna be "better safe than sorry" and overly paranoid, they could use the Custom mode and go bananas, I probably shouldn't enable such behavior through the High mode.

New High mode should be:

• min = 5.
• ticks = -1.
• max = 12.
• total = 3/4.

---

As I already stated, imo ticks=min*2+.. is enough to catch legit people in my opinion

I'm going to assume you're talking about the internal number, as the buffer already adds the "min" value as it's necessary.

Well yes&no&yes... This gets murky.
People when they use spacebar tend to have 3-4+ tick inputs, assuming the tickrate is 64+
High tickrates have less problems with this, because humans' input aren't tied to a tickrate, but time... Cheats on the other hand are tick-based (usually).
Tho it's not unusual that people also achieve 2-3 tick inputs with spacebar. And those people may get issues with the SMAC bypass compensation... But there isn't really a whole lot of leeway here, as SMAC bypass is sometimes hardcoded into cheats... Not all, ofc, but catching those are important as well...

Another thing is scrolling, which does perfect 1 tick inputs. And people who use scroll to bhop either do 2-3 scrolls when they approach the ground or spam it constantly.
The former can get issues with the SMAC bypass compensation in Lilac's "ticks". The latter far less so, as they mimic macros, which also just spam wildly and will thus have a high JumpTicks value.

Total = 5 is still really high, and setting it to 3 should still be accurate while being a lot more efficient

Agreed.
Since we're talking about the Low mode (I assume at least so), perhaps compensating for SMAC bypassing is... Well dumb.
It would make more sense for the Low mode to only catch the blatant cheaters which do near tick perfect inputs without SMAC bypassing.
So I guess the new Low mode should be:

• min = 7.
• ticks = 5. // NOT SMAC-Bypass compensated. This will ignore legits with 12 (7+5) or more jump ticks.
• max = 20. // Rare, but does happen on occation.
• total = 3.

---

I guess the Medium mode will be left unchanged for now?

---

One thing I do have to mention is Perfect Auto-Strafing.
Lilac used to detect those back when it was a private AC for my servers, but before release, I stripped Lilac of it (For a lot of reasons I've mentioned before).

It would be helpful to deal with those who also have SMAC Bypass in their Bhop.
And I think I've said in the past that in version 1.8.0 or so, I'll add it back.

I think that will have to wait a little further.
Version 1.7.0 is a big re-write and re-organization update, plus a few new misc features.
And I think once 1.7.0 is out, I'll just maintain version 1.7.0, fix issues and bugs as people report them, and have version 1.8.0 be mostly about optimizations and polish.

We'll see, the future is always uncertain.
But for now, 1.8.0 probably won't contain much interesting stuff.

[azalty]

Firstly, nice name :D

Ty :)

I'm going to assume you're talking about the internal number, as the buffer already adds the "min" value as it's necessary.

Well yes&no&yes... This gets murky.
People when they use spacebar tend to have 3-4+ tick inputs, assuming the tickrate is 64+

If I'm right, mouse wheel presses only do 1 tick input, and most of the time for a legit/good player they vary between 2/4, what I said is linked to this, I'm pretty sure spacebar presses last longer, and I should add this method to my AC as well to prevent false positives (as you said)

And as we're talking about odds, it is possible for someone to do in average 2 to 3 jump inputs per bhop with scrolling (as you said), yet again with the current settings it's CLEARLY not a problem. Triggering only one detection with this should still be pretty rare, and if total is 3, it's clearly enough.

I guess the Medium mode will be left unchanged for now?

Seems fine for me

One thing I do have to mention is Perfect Auto-Strafing.

Now, I don't know a thing about auto-strafing, and I'm not good at strafing either (not a KZ player at all 👀)
Would be good to get that as well, I could learn how to detect that :3