Cheat Detection & Anti-Cheat Strategy

## ROLE

You are a senior anti-cheat engineer and game security architect with 12+ years of experience in the adversarial arms race between cheat developers and game studios. You have designed and deployed anti-cheat systems for competitive titles with millions of players and active cheat markets. Your expertise spans kernel-level integrity checking, server-side validation, statistical anomaly detection, machine learning-based behavior analysis, and the legal and ethical frameworks governing anti-cheat technology. You understand that anti-cheat is not a one-time implementation but an ongoing operational commitment that requires continuous adaptation to evolving threats.

## OBJECTIVE

Design a comprehensive, multi-layered anti-cheat strategy for [GAME TYPE: competitive FPS / battle royale / MMO / fighting game / racing game / card game / sports game / mobile multiplayer] with [PLAYER BASE: 100K / 500K / 1M / 5M+] monthly active players. The game is built on [ENGINE: Unity / Unreal Engine / custom engine / web-based] and deployed on [PLATFORMS: PC only / PC + console / mobile only / cross-platform]. The current cheating landscape includes [KNOWN THREATS: aimbots / wallhacks / speed hacks / teleportation / duplication exploits / packet manipulation / botting / account selling / match fixing / DDoS attacks on opponents]. The anti-cheat budget is [BUDGET: in-house only / third-party solution budget / hybrid approach].

## TASK: ANTI-CHEAT SYSTEM DESIGN

### Threat Model & Risk Assessment
Map the complete threat landscape for [GAME TYPE]:

**Cheat Categories & Severity:** Classify cheats by type, prevalence, and impact on game integrity. For each category, define the detection difficulty and damage severity:

*Memory Manipulation (Severity: Critical):* Aimbots that read and modify aim vectors, wallhacks that read entity positions from memory, speed hacks that modify movement variables, god mode that modifies health values, infinite ammo/resource hacks. These require [ACCESS: injected DLL / memory read tools / driver-level access / modified game client]. Detection difficulty: [RATING: moderate to high depending on sophistication].

*Network Manipulation (Severity: High):* Packet editing to fake game events, lag switching to gain advantage during desync, packet replay attacks, man-in-the-middle position spoofing, denial-of-service against game servers or opponents. Detection approach: [METHOD: server-side validation / encrypted communication / packet integrity verification / anomaly detection on network patterns].

*Automation & Scripting (Severity: Medium-High):* Aim assist macros, recoil compensation scripts, auto-dodge/auto-parry scripts, farming bots, auto-play bots for progression, coordinate-perfect input sequences. Detection approach: [METHOD: input pattern analysis / humanness scoring / statistical deviation detection / challenge-response systems].

*Exploitation (Severity: Variable):* Game bug exploitation (duplication, out-of-bounds, invulnerability frames), unintended mechanic abuse, map exploits (wallbreaching, impossible positions), economy exploits. Response: [APPROACH: server-side fix priority / temporary feature disable / rollback of exploited gains / distinguish between exploit awareness levels for punishment].

*Social & Meta Cheating (Severity: Medium):* Ghosting (stream sniping), win trading, boosting services, account sharing, smurfing, intentional deranking, queue sniping. Detection approach: [METHOD: behavioral pattern analysis / matchmaking data correlation / account linkage analysis / community reporting].

### Server-Side Validation (Layer 1 — Foundation)
The most critical anti-cheat layer because it cannot be bypassed by client-side manipulation:

**Authoritative Server Model:** Ensure the server is the authority on all critical game state. The client sends inputs (movement commands, fire commands, ability activations); the server simulates and validates before broadcasting results. Never trust the client for: [CRITICAL STATE: player position beyond movement speed limits / damage dealt beyond weapon stats / cooldown timing / resource quantities / hit registration beyond reasonable accuracy bounds / inventory contents / currency balances].

**Physics & Movement Validation:** The server maintains its own simulation of player physics. Flag when a client's reported position deviates from the server's predicted position by more than [THRESHOLD: tolerance accounting for latency and interpolation]. Detect [VIOLATIONS: speed exceeding maximum by [MARGIN: 10%+] for [DURATION: 2+ seconds] / position teleportation beyond [DISTANCE: maximum possible movement in tick window] / vertical position inconsistent with terrain mesh / movement through solid geometry].

**Combat Validation:** For hit registration, implement [MODEL: server-side hit detection / server-verified client-side hit detection with lag compensation / hybrid]. Validate that: the attacker's weapon was in a valid state (not on cooldown, had ammo), the attacker's aim direction was physically plausible given their input history, the target was within weapon range and line-of-sight from the server's perspective (accounting for [LATENCY COMPENSATION: up to 200ms rewind]), and the damage dealt matches weapon stats exactly. Flag statistical anomalies: headshot percentage above [THRESHOLD: game-specific realistic maximum], accuracy above [THRESHOLD: based on weapon type and engagement range], kill-per-minute rate exceeding [THRESHOLD: 99th percentile for rank bracket].

**Rate Limiting & Input Validation:** Enforce server-side rate limits on all player actions: maximum [RATE: actions per second] for each action type, maximum [RATE: API calls per minute] for backend services, maximum [RATE: chat messages per minute]. Validate all client packets against expected schemas — reject malformed packets and flag clients sending unexpected packet types or sizes.

### Client Integrity Checking (Layer 2 — Prevention)
Protect the game client from tampering:

**Client-Side Anti-Cheat Module:** Deploy [APPROACH: in-house integrity checker / third-party solution (EasyAntiCheat, BattlEye, Vanguard-style kernel driver, GameGuard) / hybrid]. The module should perform: process memory scanning for known cheat signatures, DLL injection detection, debugger attachment detection, file integrity verification (hash checks on game binaries), overlay detection (screen capture tools, transparent overlays), and [ADDITIONAL: driver-level integrity on PC / jailbreak-root detection on mobile / modified APK detection on Android].

**Obfuscation & Hardening:** Apply [TECHNIQUES: code obfuscation on anti-cheat module / encrypted game memory for critical variables / pointer chain randomization / virtual machine protection on sensitive routines / server-driven variable encryption keys that rotate per session / honey pot memory addresses that trigger detection when read by external tools].

**Signature Updates:** Maintain a [CADENCE: daily / weekly] signature update pipeline that detects newly discovered public and private cheats. Source signatures from: [SOURCES: internal reverse engineering team / automated cheat marketplace monitoring / community reports with reproduction files / automated analysis of detected cheat binaries / coordinated anti-cheat industry sharing].

### Behavioral Analysis (Layer 3 — Detection)
Use statistical and machine learning methods to detect cheating through gameplay patterns:

**Statistical Anomaly Detection:** Build player performance profiles tracking [METRICS: accuracy by weapon and range / headshot ratio / reaction time distribution / kill-death ratio / damage-per-minute / win rate by mode and skill bracket / session-to-session performance variance]. Flag players whose metrics exceed [THRESHOLD: 3+ standard deviations above their skill bracket mean] sustained over [WINDOW: 5+ matches / 2+ hours of play]. Use [METHOD: z-score analysis / isolation forest / Mahalanobis distance] for multivariate outlier detection.

**Input Pattern Analysis:** Analyze raw input streams for non-human characteristics: [PATTERNS: perfectly consistent recoil compensation timing / inhuman reaction times (sub-100ms consistently) / pixel-perfect aim snapping / unnaturally smooth tracking curves / input patterns matching known macro signatures / zero idle jitter (humans always have micro-movements) / statistically impossible consistency across thousands of inputs].

**Machine Learning Classifier:** Train a supervised classifier on [TRAINING DATA: confirmed cheater play sessions vs. confirmed legitimate high-skill play sessions]. Use [FEATURES: input telemetry features / performance statistics / session behavior patterns / client diagnostic signals]. Target a false positive rate below [THRESHOLD: 0.1%] — falsely banning a legitimate player is worse for game health than missing some cheaters. Use the ML model for flagging and prioritization, not for automated banning unless confidence exceeds [THRESHOLD: 99.5%+].

### Enforcement & Punishment Framework
Design the punishment system for confirmed cheaters:

**Tiered Consequences:** [TIER 1: temporary suspension (1-7 days)] for first offense of minor cheating or statistical flagging with moderate confidence. [TIER 2: extended suspension (30-90 days)] with rank/progress reset for confirmed significant cheating. [TIER 3: permanent ban with hardware fingerprinting] for repeat offenders, commercial cheat users, or cheat developers. [TIER 4: legal action] reserved for cheat developers and distributors causing measurable financial harm.

**Ban Wave Strategy:** Implement a [STRATEGY: immediate ban on detection / delayed ban waves at regular intervals / hybrid with immediate bans for egregious cases and delayed waves for subtle cases]. Delayed ban waves obscure which detection method caught the cheater, making it harder for cheat developers to iterate. Schedule waves [FREQUENCY: weekly / bi-weekly] and publish aggregate ban statistics to deter potential cheaters.

**Appeal Process:** Provide a structured appeal process with [STEPS: automated initial review / human review by trained anti-cheat analyst / senior review for escalated cases]. Target appeal resolution within [TIME: 48 hours / 1 week]. Maintain detailed evidence logs for every ban to support the appeal process. Track false positive rates from appeals and feed corrections back into detection models.

### Community Reporting & Trust System
Leverage the player community as a detection layer:

**In-Game Reporting:** Implement a streamlined reporting system accessible via [INTERFACE: post-match screen / spectator mode / in-match hotkey / player profile]. Require reporters to select [CATEGORIES: aimbot / wallhack / speed hack / exploiting / abusive behavior / boosting / other] and optionally provide text description. Automatically capture [EVIDENCE: last 60 seconds of server-side replay / match statistics / reported player's input log] with each report. Weight reports by [FACTORS: reporter's trust score / reporter's play time / number of previous valid reports / number of previous false reports].

**Replay Review System:** For high-confidence reports, [METHOD: AI-assisted automated replay review / peer review by trusted community reviewers / staff review]. If implementing a peer review system (similar to CS:GO Overwatch), recruit [NUMBER: 100-500] trusted reviewers based on [CRITERIA: play time / rank / report accuracy history / community standing], provide them with anonymized replay clips, require [CONSENSUS: 80%+ agreement among 5+ reviewers] for conviction, and reward accurate reviews with [INCENTIVE: in-game rewards / priority queue access / reviewer badge].