Using Behavior-based Classifier Algorithms to Combat Exploitive Hackers
Thursday, November 12th, 2009So, the phenomenally resourceful hacker/gold farmer community is quite the challenge. You’ve tried everything- chat filters, IP filters, email filters, captchas, mass banning of accounts… they always come back and within weeks it’s as if you had never done anything.
Ultimately, you have to go back to basics. What’s the real issue with hackers and exploitive gold farmers? It’s their behavior. They “break” the game, both immersion-wise as well as the economy. So, all you really care about is limiting that bad behavior. Really, you don’t care if they are in the game, even profiting from their activities… as long as their behavior is not beyond that somewhat fuzzy line of “appropriate and reasonable”. So, therein lies the answer. You have to target the behavior. After all, that’s what your GMs are doing when they patrol the servers.
The problem I’ve seen with most attempts at combating exploitive behaviors is that they end up figuratively building a wall. Walls only work when your enemies only walk on the ground and don’t dig under it, don’t utilize airplanes, don’t build ladders, and generally refrain from trying to solve the problem of the wall analytically. Dude, exploitive gold farmers and hackers have within their ranks some of the more intelligent and capable people in the world. In fact, I consider them a worthy adversary and deserving of honest-to-goodness respect.
The only possible “solution” will be in cleverly and aggressively building ever more general solutions to automatically classifying players based purely on their behavior. And this is something we can do. But it takes a lot of determination because it requires a lot of pieces, both technologically as well as inter-personally.
1. You need good hardware. Just go with the most bang for the buck. Focus on memory and lots of pretty fast, physically independent drives.
2. You need clever algorithms. Microsoft has a great start in this area, and it comes free with SQL Server- it’s called SQL Server Analysis Services. The 2008 versions are indeed better than previous ones.
3. You need some good TSQL skillz. This is fundamental. You can try to jump over this, but in the end you can’t get away from it.
4. You need some good organization of database tables as well as some good naming conventions (this is more important than it may initially seem, but you will be doing a lot of data shuffling, and tables and columns that have stupid-obvious names just feel good).
5. You need a good way to centralize large amounts of data. While you can directly query Production servers for the necessary data, extracting it all to a central server allows for a lot more possiblities, and you and your co-developers will learn all kinds of good stuff about your existing systems.
6. You need to have good friends working on the game itself. You will find all kinds of good things that need logging in order to allow for classifying player behavior.
7. You and your co-developers will have to figure out how best to streamline the process of identifying in-game events that need logging and then actually getting that logging set up. It’s never as easy as it first seems. If you can get this down, I guarantee it’s only a matter of time until the world is your oyster.
8. You will need to figure out how to best deliver polished reporting products. Again, Microsoft has done good stuff here, and it comes free with SQL Server. SQL Server Reporting Services will be your friend.
The pretty cool part about working on behavior-based classification systems is that you will really get to know your game well. That, and this stuff is pretty cool indeed.