Theory on Bannable Activity

[Rakurai]

There's been a lot of debate about what gets people banned, and I had have a theory on that.

I would bet that Blizzard's ban selection algorithm is more sophisticated than simply flagging people for rate of game creation, or length of time online, etc. Blizzard employs some very smart people; a classmate interned with them last summer and tells me that they employ plenty of MS and PhD degree holders.

I believe that a close analogy can be drawn to credit scores. Your credit score is totally based on your credit history, but it's not calculated in a simple way. You can't look at your credit history and calculate your score, you can only guess at it based on what you think is 'good'. In reality, a credit score is a measure of the likelihood of you defaulting on a loan, based on how your credit history compares to the credit histories of people who *do* default on loans.

Let's say, for example, that many people who paid off a car loan and bought a house within 6 months defaulted on those house loans. You would assume that a paid off car loan would be a good thing, but the credit bureau's statistics would show that there is more risk of default if you buy a house within month of paying off the car. In that case, paying off a car loan would be a negative factor in your credit score for 6 months. Credit scoring algorithms look for patterns of behavior that match up with people who eventually default on a loan, even if it is counterintuitive.

For an in-game example, let's say that Blizzard, via whatever data collection schemes they use, determines that many of the people they *know* are botting (through definite detectable means like memory hacking) will bot for 6 hours in a stretch, stop for 4, and repeat. Anyone matching that pattern will have their 'botting likelyhood score' raised because it fits the pattern of a botter. Another characteristic might be running Sarkoth over and over; since known botters tend to do that, it would make your profile fit more with a botter. Both of these are practices that real live players do, so neither is a good indication on its own.

Some patterns that might fit a botter profile would be not using chat, not having friends, laundering gold, efficient sarkoth runs, arreat core runs, multiple players from one IP, vmware, etc. Anything you can think of that a bot *might* do, even if legitimate players do it too. None of these practices are good indicators on their own, but the more your account's pattern of behavior fits the profile of a bot account, the more your botting score goes up. Get a high enough score, and you're likely to be the target of a ban wave.

Anyway, this is just a theory, but I think one thing is for certain: there is no one behavior that they look for to ban people on.

One final thought. Why doesn't Blizzard immediately ban every player who uses a known botting program? Why not ban on the first hint of memory hacking? Because they're collecting statistics for profiling players: since they know that the player is botting, it is more valuable to Blizzard to track their behavior so that they can compare other people's behavior to them.

Any thoughts on this?

[thedunlap]

Very likely. Paying off home = time from 0 to level 60 on a new account. But I don't necessarily believe that the wait time on banning is linked to building bot profiles. I believe it may be randomized (i.e. game theory). A random player confuses the hell out of the opponent and prevents the other player from figuring out what criteria is important or how a player is being caught by the other. However, it is equally believable that once an account is determined to be a botting account by some metric, then it is manually reviewed, and banning is delayed by some period of time to generate a botting/credit profile.

[LATM]

More than just gathering data for profiling, most people who cheat use more than a single cheat. Most people who bot have used many bots. By banning in waves it makes it impossible to know exactly what you were banned for using, which is incredibly valuable information.

Even though I was banned for using auto-it bots 24/7 for the last 4 Weeks, the first few weeks I was using d3advanced doing memory reading and writing, and while not a single person was banned for d3a, its impossible to know if we all weren't simply flagged to see what would happen to us later.

----

If I were blizzard, I would know to look for variable timings in the script. Changing a run between 20-30 seconds would be absolutely meaningless for how I would look.

If I were blizzard, I can think of so many different variables that identify botters from normal users, our behavior simply doesn't look anything like a normal user's data in any way shape or form. Even obscure things you wouldn't typically think of, no matter how variable you make your bots.

1.) we don't get achievements at normal rates because we don't actually play the game.
2.) even cycling between 10 different botting locations/quests/difficulties, we never do randomly generated quests because they aren't uniformly in the game
3.) the number of deaths we have is going to be incredibly smaller in proportion to real players who are actually progressing through the game, as the bots aren't designed to die.
4.) our gear looks different than normal players gear. I could find every single botter in the world by filtering for 250% GF and less than 20k health.
5.) a billion other things I don't even want to bother with typing.

[Dorado]

how bout the fact that my bot would create and leave 150 games an hour.

[thedunlap]

2 out of 4 DH bots of mine have greater than 25K HP. Successfully escaped that ban criteria

[welbewoll]

what you have written is plausible but think on this

for credit companies it is a life-and-death scenario to gauge peoples credit ratings, more than that they have a lot of already logged data available for statistical analysis and probably to some extent collective knowledge on a domain level

diablo 3 on the other hand is one game by one company no matter how big it may be and compared to credit ratings which are pretty stable, the data they have is
- highly dynamic and can thus change from bot to bot depending on the strategy, place, etc.
- they have tons of real-time stuff they have to evaluate
- botters hurt d3, they dont ruin it (blizzard themselves have ****ed up the game worse than botters ever could)

a credit card company in their evaluation of consumers has to walk through one of those hedge labyrinths, it pretty much stays the same all the time and they have to figure out the best way
blizzard in their evaluation of botters is in "the cube" from that horror movie, all kinds of shit could happen

and while, yes, it is probably more than just games/hour, you have to consider that by only checking games/hour they can already elimate 99% of the botters currently and at the very least buy themselves a week or two before the new generation of bots emerges in small steps; which is a big win for them for they not only stop the bots but also gain favor from the community be appearing active - i am sure everyone on the public forums is cheering (or on second thought complaining they did not do this earlier)

TL;DR
op is likely right to some extend at least as far as future bot recognition is concerned, but atm i think it really may be as simple (or little more sophisticated) as games/hour, because of the short time benefits bliz gets from this combined with how easy it is to implement this check

[nabiemi]

From some forum. They say if you put bot to rest for few seconds interval you will not be ban. No idea if it true. Can some one tell me please.

[TMichael]

TL;DR
op is likely right to some extend at least as far as future bot recognition is concerned, but atm i think it really may be as simple (or little more sophisticated) as games/hour, because of the short time benefits bliz gets from this combined with how easy it is to implement this check

I took me a while to track this down, but below is a link to an interview with two game security experts from almost two years ago. At one point, they say the analytics used in the industry are even more advanced than the tools Wall Street uses. It's an interesting interview.

Markeedragon Inteview - CTO of InterActive Media and Director Operations for Nickelodeon Kids & Family Virtual Worlds Group

TL;DR

Their tools are probably much more advanced than we might expect. And for Diablo III, with the RMAH in play, Blizzard will be using the very best of them.

[Rakurai]

Their tools are probably much more advanced than we might expect. And for Diablo III, with the RMAH in play, Blizzard will be using the very best of them.

I agree. Blizzard's cut of sales in the RMAH is directly tied to the value of the goods on there, and bots lower the value by flooding the market with gold and items. That, and a game economy monopolized by bots make normal players not want to bother with using it. Blizzard surely has plenty of interest in keeping bots under control (if not completely away), or at very least giving that impression to the normal players by having very public ban waves. Hence, of course, the ban wave that generates lots of controversy, and not instant bans.

[trendkilla254]

There's been a lot of debate about what gets people banned, and I had have a theory on that.

I would bet that Blizzard's ban selection algorithm is more sophisticated than simply flagging people for rate of game creation, or length of time online, etc. Blizzard employs some very smart people; a classmate interned with them last summer and tells me that they employ plenty of MS and PhD degree holders.

I believe that a close analogy can be drawn to credit scores. Your credit score is totally based on your credit history, but it's not calculated in a simple way. You can't look at your credit history and calculate your score, you can only guess at it based on what you think is 'good'. In reality, a credit score is a measure of the likelihood of you defaulting on a loan, based on how your credit history compares to the credit histories of people who *do* default on loans.

Let's say, for example, that many people who paid off a car loan and bought a house within 6 months defaulted on those house loans. You would assume that a paid off car loan would be a good thing, but the credit bureau's statistics would show that there is more risk of default if you buy a house within month of paying off the car. In that case, paying off a car loan would be a negative factor in your credit score for 6 months. Credit scoring algorithms look for patterns of behavior that match up with people who eventually default on a loan, even if it is counterintuitive.

For an in-game example, let's say that Blizzard, via whatever data collection schemes they use, determines that many of the people they *know* are botting (through definite detectable means like memory hacking) will bot for 6 hours in a stretch, stop for 4, and repeat. Anyone matching that pattern will have their 'botting likelyhood score' raised because it fits the pattern of a botter. Another characteristic might be running Sarkoth over and over; since known botters tend to do that, it would make your profile fit more with a botter. Both of these are practices that real live players do, so neither is a good indication on its own.

Some patterns that might fit a botter profile would be not using chat, not having friends, laundering gold, efficient sarkoth runs, arreat core runs, multiple players from one IP, vmware, etc. Anything you can think of that a bot *might* do, even if legitimate players do it too. None of these practices are good indicators on their own, but the more your account's pattern of behavior fits the profile of a bot account, the more your botting score goes up. Get a high enough score, and you're likely to be the target of a ban wave.

Anyway, this is just a theory, but I think one thing is for certain: there is no one behavior that they look for to ban people on.

One final thought. Why doesn't Blizzard immediately ban every player who uses a known botting program? Why not ban on the first hint of memory hacking? Because they're collecting statistics for profiling players: since they know that the player is botting, it is more valuable to Blizzard to track their behavior so that they can compare other people's behavior to them.

Any thoughts on this?

Retitle Thread "Hey Blizzard this is how to effectively ban us - oh and keep reading cause people will reply with awesome ideas on how to ban us all"