Identifying MMORPG Bots: A Traffic Analysis Approach By Kuan-Ta Chen, Jhih-Wei Jiang, Polly Huang, Hao- Hua Chu, Chin-Laung Lei, and Wen-Chin Chen Presented by Curtis Mirci

Why would anyone use a bot?

Why are bots a problem? Who’s used a bot? Macro’s and Scripting

Main methods used to detect Human Interaction Command Timing Trend of Traffic “Burstiness” Magnitude of Traffic “Burstiness” Sensitivity to Network Conditions

Human Interaction Using moderators or GMs to check Having trusted players tattle Problems?

Command Timing Bot programs have a certain timing thanks to their main loop. Two tests in here –Multimodality Test –Regularity Test What are they?

Command Timing Multimodality –Easy, use the Dip test! (mentioned in other papers.... ) Regularity –It’s a bot if the Fuller’s statistic is significant at 0.01

Trend of Traffic Burstiness What is Burstiness? –Packet count sent in successive periods Bots have smoother burstiness

Magnitude of Burstiness Uses a cross-point to display how smooth the traffic is Bot if smaller than 10 seconds This give a minimum false +

Reaction to Network Conditions Humans will slow down if the game does Bots won’t Human Bot

So what should we do? False+False-Correct Rate Timing?<5%>95% Burstiness Trend ?<5%>95% Burstiness Magnitude <5%?~75% Connection Reaction ???

Now that we know... How can we build a better bot? How can we defend against this better bot? Will the cycle ever end?