Anti-botting systems, why GMs aren't enough

We have not received permission from CROW3 to share the quoted post.

That is most definitely something a robot would say. I don't believe you.

We have not received permission from Balanz to share the quoted post.

Depending on how many potential bots there could be on any given server, I doubt GMs would have the time to immediately respond to a bot PK to do that. And you definitely can't do that kind of thing preemptively cause bot determination is either too difficult or so easy that bot gets autobanned before it can even start farming.

Bots are a problem solved by the designer of the economy first, and the security second.

Without the first, it will never matter. In our current age, bots basically cannot be defeated.

At worst, you make 'writing a bot' more expensive or complicated. Or you make the bot less effective. Neither of these will meaningfully reduce botting (the people who write the expensive ones will just deploy more instances in order to get their money's worth, and the lack of competition from poorly written bots will make this easier for them).

The Security team can never tell us what they do to catch bots, because the bot coders will immediately work around it.

This is best left to the Senior Economy designer when they join the team.

We have not received permission from Vissox to share the quoted post.

In all arrogance, I, for one, know exactly how to fix these problems in most games. I could make some guesses for Ashes. But that would be 'me designing their economy for them', and I already offered the two main methods I know from that side.

Similarly, my security analyst knows quite a bit about how to handle the other side, but you wouldn't want her discussing that sort of thing on forums.

We have not received permission from Vissox to share the quoted post.

I will divulge one secret, technically, because it's the one that doesn't matter.

The best bot detection method is the one where the enforcement is inconsistent.

If it's 50/50 odds whether or not any given bot will be banned for an action on a given day, and the reason given is 'suspicious activity', chances are the bot has more than one 'suspicious activity' they engage in.
The botter doesn't know which of the things they do, is the problem. They therefore have to spend more time, and 'randomly' lose accounts.

It's slower, but blanket 'do this and get banned' can be decoded easily by counter-analysis, and once that is implemented properly, the arms race continues. The better method is to obfuscate everything. That's why you just hear 'we will be using multiple methods to contain and detect this behaviour'.

Most bots, especially in PvX games, only do meaningful HARM at very specific parts of the economy and the game. The more time a given 'bot station' invests before it gets junked, the 'better off' certain functions are. This doesn't apply to player reports of suspicious activity, just the autodetected ones.

But bots themselves, you will NEVER win if they know what you are doing, or even have an inkling what you are detecting them by. We're talking about things that detect changes in pixel colors on screen, and have random func responses to those pixel colour changes by calling the internal mouse-click functions. You can write these at home. The game itself is a Finite State Machine, just make your own bot be one too, and it will sometimes not be distinguishable from a human player for a very VERY long time.

You don't want to start an arms race with advanced bot programmers. Pick off people randomly, watch their account behaviours through GMs, etc. Never let them know you are 'on to them' or that 'X behaviour is definitely considered botting'. They'll just figure out how to mimic the most efficient or repetitive player instead, and make the detection draw closer to banning legitimate players. It's already in their best interest to look as much like regular players as possible, so 'watching a stream and then copying a streamer's play' is a good way to push the hand of the security team.

Or, the security team could just ban for 'suspicious activity' and never explain what exactly that means.