[Plugin] Aimbot detector using Artifical Intelligence

[Yashas]

AntiAimbot

Version: E1 (experimental version)

DISCLAIMER:
- the plugin is still experimental and has undergone rigorous testing on artificial servers but hasn't been tested on a real server with a large player base
- works for M4/AK47/MP5 only

AntiAimbot is an aimbot detector which uses a combination of empirical methods and artificial intelligence to accurately identify players using any form of aim assist. Empirical methods such as high ratio on moving players are used to efficiently suspect players of using aimbot. The samples of players suspected of using aim assist tools are forwarded to a combination of AI machinery consisting of mainly a neural network and a support vector machine for further detailed analysis. The AI machinery investigates the samples and decides if the feat achieved is humanly possible or not by "probably" (they are all black boxes) analyzing how quickly the aim moves, how synchronized the aim was with the motion of the victim, how fast the player reacts to changes and many such features.

The latest version is significantly more accurate than the version used in the vdeio.

[Video: https://www.youtube.com/watch?v=BUl2NU3YRxw]

Overview:

The entire process can be divided into two sections based on the type of used: empirical methods and artificial intelligence methods. The empirical methods are used to quickly suspect the possibility of an aim assist software being used while the artificial intelligence based methods are used to analyze the suspected samples more rigorously.

The AI-based detectors are trained to identify possible use of aim assist accurately when possible, i.e. they give negatives when they aren't sure. Given enough time, they will mostly detect the use of aim assist.

The submitted vectors go through a lot of stages.

stages of data flow:

data collection: a script collects shot vectors
pre-filter: carries out checks to eliminate unreliable shot vectors
transform: transforms shot vectors to a form suitable for feature extraction
pooling: pool together a variable number of transformed vectors to form a complete sample
extract features: extract features from the vector pool
post-filter: carry out basic empirical checks on the sample to check reliability and possible use of aim-assist; if suspicious, forward it to the AI machinery
detectors: run through different detectors and average the result


Some of the pre-filter conditions are:
- must use a M4/AK47/MP5 (other weapons are disabled because of their unreliability)
- the victim must be moving
- and many more

If a shot fails any of these conditions, the entire running pool is rejected and starts afresh.

After pooling many shots together, it goes through another filter. The filter decides if there is enough information that can be extracted from the pool; if not, it continues to collect more shot. Once there is enough useful information, it checks for reliability and estimates the use of aimbot, for example, by checking the pool's ratio (required to be high for last X number of shots where X is between 7 and 20).

It's only after this step the sample is said to be fully complete. This is when `submit_vector` returns 1. This sample is put in a queue for processing. The detectors are running in different threads. They pick a sample from the input queue, investigate it, dump it to the output queue. In the server's next tick cycle, results are pulled out of the output queue and the callback is triggered for each sample.

Hence, the callback is triggered only when there was enough suspicion and after it was processed by the AI machinery.

TL;DR:
- callback is triggered only when there is some suspicion, i.e. when the empirical methods suggest the use of aimbot
* however, the AI machinery can reverse the decision and say this may not have been an aimbot
- it's difficult to get the callback triggered without using an aimbot because most samples are rejected empirical methods
- callback is triggered every minute or so when an aimbot is used
* the callback being triggered does not imply that aimbot was used; you need to check the probabilities

Usage:

building plugin from source (Linux):

1. install gcc-8, g, gcc-8-multilib, g8-multilib, cmake
   
2. clone the sampml repository
   
3. change directory to `examples/anti-aimbot/plugin`
   
4. create and enter `build` directory
   
5. generate build files using `cmake .. -DCMAKE_BUILD_TYPE=Release -DCMAKE_C_COMPILER=gcc-8 -DCMAKE_CXX_COMPILER=g8`
   
6. build plugin using `cmake --build . -- -j <number of threads>`
   

building plugin from source (Windows):

1. clone the sampml repository
   
2. open `examples/anti-aimbot/plugin` directory in Visual Studio 2017
   
3. click on CMake->Build
   

installing:

1. move the plugin binary to the `plugins` directory
   
2. create a new directory `anti-aimbot` in the `plugins` directory
   
3. create a new directory `models` in `plugins/anti-aimbot` directory
   
4. copy three model files from `examples/anti-aimbot/training/models` to the models folder
   
5. [optional] create config.cfg in the `anti-aimbot` directory
   

configuring the plugin:
thread_pool_size: number of threads that can be used for detectors (default: 4)
rf_model_file: random forest model file (default: plugins/anti-aimbot/models/rf_classifier.dat)
svm_model_file: svm model file (default: plugins/anti-aimbot/models/svm_classifier.dat)
dnn_model_file: dnn model file (default: plugins/anti-aimbot/models/dnn_classifier.dat)

Example `config.cfg`:

Code:

thread_pool_size 2
dnn_model_file plugins/anti-aimbot/models/dnn2_classifier.dat

submitting a shot vector:

Code:

stock CollectDataOPWS(data[E_SHOT_VECTOR], playerid, weaponid, hittype, hitid, Float:fX, Float:fY, Float:fZ)
native submit_vector(playerid, data[E_SHOT_VECTOR]);

Code:

#include <aimbot_dc.inc>
public OnPlayerWeaponShot(playerid, weaponid, hittype, hitid, Float:fX, Float:fY, Float:fZ)
{
??????? new data[E_SHOT_VECTOR];
??????? CollectDataOPWS(data, playerid, weaponid, hittype, hitid, fX, fY, fZ);
?? ?submit_vector(playerid, data);
??? ?return 1;
}

obtaining results:

Code:

forward OnPlayerSuspectedForAimbot(playerid, Float:probabilities[3], time[3]);

Code:

#include <aimbot_dc.inc>
public OnPlayerSuspectedForAimbot(playerid, Float:probabilities[3], time[3])
{
??? /* results are sent after a few seconds; hence, check if the player is still connected */
??? if(!IsPlayerConnected(playerid))
??????? return 1;

??? static enum {
??????? COLOR_RED = 0xFF0000FF,
??????? COLOR_GREEN = 0x00FF00FF,
??? };

??? new str[144], name[MAX_PLAYER_NAME];
??? GetPlayerName(playerid, name, sizeof(name));

??? /*
??? ** there are three independent detectors
??? ** - random forest
??? ** - support vector machine
??? ** - deep neural network
??? **
??? ** `probabilities` contains the outputs of the detectors in the aforementioned order
??? ** `time` contains the CPU microseconds used by each of the detectors in the aforementioned order
??? **
??? ** the average of the probabilities can be used to get an overall estimate
??? ** choose a cutoff above which the result is considered to be an aimbot sample
??? ** the code below sends a message for all samples
??? */?? ?

??? const Float:cutoff = 0.6;
??? new Float:avg = (probabilities[0]  probabilities[1]  probabilities[2])/3;

??? format(str, sizeof(str), "%s(%d) >> RF: %.2f (%dus) SVM: %.2f (%dus), DNN: %.2f (%dus)",
?? ? ?? ??? ??? ??? ??? ??? ?name, playerid,
?? ? ?? ??? ??? ??? ??? ??? ?probabilities[0], time[0],
?? ? ?? ??? ??? ??? ??? ??? ?probabilities[1], time[1],
?? ? ??? ??? ??? ??? ??? ??? ?probabilities[2], time[2]);
?? ? ??? ??? ??? ??? ??? ??? ?
??? new color = ((avg > cutoff) ? COLOR_RED : COLOR_GREEN);
??? SendClientMessageToAll(color, str);
?? ?
??? format(str, sizeof(str), "Average: %.2f (%s)", avg, ((avg > cutoff) ? ("MOSTLY USING AIMBOT") : ("MAY NOT BE USING AIMBOT")));
??? SendClientMessageToAll(color, str);
}

Links:
GitHub Repository

Contributing & Support Requests
discord server for:
- research & development
- support requests
- contributing

Looking for people to test the plugin on real servers and provide feedback. Only three skin aimbots were used for training and hence the detectors might fail for specific cases which I expect to be reported. You can get the training summary on Travis or AppVeyor.

Credits:
Over dozen people were involved in testing an collecting data. I'd like to mention the top contributors:

1. Helium
   
2. Variable/H2O
   
3. Luzziz