Easy way to detect bots - don't do this scripters

[Reveance]

This post is mostly intented for scripters I suppose.

So anways I just started scripting again after a long break, and thought of the following while making my script:

If Jagex can monitor mouse movements, what would be the easiest way to detect bots? For instance take magic; high alching. Thinking about making a script like that I'm sure I would have used sleep(random(min, max)) between mouse clicks until now. Let's take sleep(random(500, 700)) and see what Jagex would see if they're monitoring the time between the clicks for let's say 10k alchs, by using this snippet:

int[] numbers = new int[750];

for (int i = 0; i < 10000; i++) {
	numbers[MethodProvider.random(500, 700) - 1]++;
}

int i = 0;
for (int n : numbers) {
	if (i++ < 450) {
		continue;
	}

	System.out.println("" + i + ", " + n + "");
}

Entering the output in a scatter plot produces the following data visualisation:

I'm sure that you would realize that no human could ever hit so perfectly random between 500 and 700, but never go below or past those respectively.

So I started digging into this and found out there is a common method which is used for this sort of thing, called standard deviation. It turns out that OSBot already has this in their API at MethodProvider#gRandom, so you can already use this. I had already made my own snippet for it though:

public static void main(String[] args) {
	int[] numbers = new int[750];

	for (int i = 0; i < 10000; i++) {
		numbers[rand(500, 700) - 1]++;
	}

	int i = 0;
	for (int n : numbers) {
		if (i++ < 450) {
			continue;
		}

		System.out.println("" + i + ", " + n + "");
	}
}

public static int rand(int min, int max) {
	return rand(min, max, (max - min) / 8);
}

public static int rand(int min, int max, int deviation) {
	Random r = new Random();
	int avg = min + ((max - min) / 2);
	int rand;
	do {
		double val = r.nextGaussian() * deviation + avg;
		rand = (int) Math.round(val);
	} while (rand < min || rand > max);
	return rand;
}

Now, running the output data through the same scatter plot produces the following image:

Which doesn't drop off to zero without ever hitting one past it. It is important to note that when using this, you might want to make your intervals wider...it is kinda unlikely that you'd be as accurate as the above plot. For example 300, 900 produces this, which is what I think would be a lot more human like:

Anyways, you do not always need to use this but I strongly recommend it for scripts that use repetitive clicking and such, because it seems very easy to detect botters from Jagex's side if you use regular sleeps in some cases. Thought I'd share since I had never seen sleep used with such a random distribution before and it may prevent some bans

Goodluck & hf :p

 

Edited March 7, 2017 by Reveance

[wwwat]

Never thought of this, seems quite interesting!

[Qubit]

I would like to see someone record their clicks and times and see if it comes out to a normal distribution at all and its level of kurtosis or skewedness...

[The Undefeated]

You did some great job working this out.

 

[Reveance]

4 minutes ago, Qubit said:

I would like to see someone record their clicks and times and see if it comes out to a normal distribution at all and its level of kurtosis or skewedness...

Good idea! I already have something like this set up so will get to this now, it might be biased a little bit though since I'm gonna be paying attention to how I click. I think ultimately it would be best to let your clicks be randomized out of a collection of mouse click intervals created by yourself. 

Edited March 7, 2017 by Reveance

[Bamboozled]

Thank you for providing visuals!

[Swizzbeat]

gz you discovered what most bots have had implemented since 2010

[Juggles]

Interesting read. Will look into this

[Reveance]

21 minutes ago, Swizzbeat said:

gz you discovered what most bots have had implemented since 2010

Well apparently a lot of scripts haven't implemented this as I hadn't yet seen any script that did yet. Like I said the reason for posting this is that it may help improve some scripts. Even if bots have this implemented, what use is it if it's not being used by the main thing the bots do - run scripts. But gz on commenting even more 'useless shit'.

 

36 minutes ago, Qubit said:

I would like to see someone record their clicks and times and see if it comes out to a normal distribution at all and its level of kurtosis or skewedness...

I collected 500 clicks, and filtered out the non existent values since there were still way too many 0's. But you can see some kind of shape :p

Edited March 7, 2017 by Reveance

[Token]

There are about 15 different distributions that produce interesting results if this is what you are looking for, but everyone's been using this for at least 10 years. OSBot is probably only using 1 of them but you can also look into Exponential, Gamma, Beta, Student, Chi Squared, Fisher, Normal and Standard distributions. Jagex does not perform any analysis of mouse data even if they collect it (since ~2013, they apparently did before) because it's too easy to counter. Machine learning will always produce 100% human like results which not even google can detect with the best programmers in the world, however machine learning is something which is quite out of reach for pretty much everyone who writes code for runescape bots.

[Reveance]

2 minutes ago, Token said:

There are about 15 different distributions that produce interesting results if this is what you are looking for, but everyone's been using this for at least 10 years. OSBot is probably only using 1 of them but you can also look into Exponential, Gamma, Beta, Student, Chi Squared, Fisher, Normal and Standard distributions. Jagex does not perform any analysis of mouse data even if they collect it (since ~2013, they apparently did before) because it's too easy to counter. Machine learning will always produce 100% human like results which not even google can detect with the best programmers in the world, however machine learning is something which is quite out of reach for pretty much everyone who writes code for runescape bots.

Thank you for all the distributions, I'll look into them. I didn't know that Jagex doesn't collect mouse data anymore, however this isn't necessarily only mouse data. The actions that are executed on the server (in this case for example alching) would still get executed with roughly the same timings, with some random delay due to the connection. You don't think that that is somehow involved in their antibot system? It seems silly to throw something like that away because it's easy to counter. Machine learning is interesting stuff yeah, would someday like to dive into that when I've got lots of spare time :'D

[Swizzbeat]

2 hours ago, Reveance said:

Well apparently a lot of scripts haven't implemented this as I hadn't yet seen any script that did yet. Like I said the reason for posting this is that it may help improve some scripts. Even if bots have this implemented, what use is it if it's not being used by the main thing the bots do - run scripts. But gz on commenting even more 'useless shit'.

I'm saying gaussian distribution has been used within bots for awhile now. Since I don't see the ban rate getting this form of randomization is literally useless.

[Simple79001]

Interesting read

[Page27]

Good stuff, I'm actually working on making a thread on this very topic ill be posting in the tutorials section.

[Adept]

What about the impact on resources? Will frequent use of gRandom instead of random lead to a drastic increase in CPU usage due to more computations?