an AC/DC: Algorithm for Cheating Detection by Cheating
Stefano Ferretti
Department of Computer Science University of Bologna Mura Anteo Zamboni 7, 40127 Bologna, Italy
Marco Roccetti
Department of Computer Science University of Bologna Mura Anteo Zamboni 7, 40127 Bologna, Italy
[e-mail]
[e-mail]
ABSTRACT
Time cheats represent some of the most crucial issues in online gaming. Since they act on timing properties of generated game events, these malicious schemes are particularly dicult to thwart when distributed games are deployed over peer-to-peer architectures. Indeed, the absence of a global clock shared among peers enables cheaters to see into the future by waiting for events generated by other peers before generating its own ones (lookahead cheat). This may give an unfair advantage to the cheater. We consider a version of lookahead cheat generalized in the context of real-time (i.e., not round-based) games. To face this time cheat, we present AC/DC, an Algorithm for Cheating Detection by Cheating. This algorithm enables to detect cheaters based on monitoring of network latencies. The basic idea is that of conducting against each suspected peer a sort of cheating counterattack, by delaying events before notifying them to the (hypothetic) cheater. This permits to detect whether that peer waits for these events before generating its own ones. Our claim is that an approach based on the monitoring of communication patterns among peers allows cheat detection without aecting the performances of the game.
1.
INTRODUCTION
Categories and Subject Descriptors
K.8.0 [Computing Milieux]: PERSONAL COMPUTING Games
General Terms
Algorithms, Synchronization, Security
Keywords
Cheating, Online Games, Peer-to-Peer This work is nancially supported by the Italian M.I.U.R. and R.E.R. under the Interlink, MOMA, DAMASCO and SWIMM initiatives.
Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for prot or commercial advantage and that copies bear this notice and the full citation on the rst page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specic permission and/or a fee. NOSSDAV 06 Newport, Rhode Island USA Copyright 2006 ACM 1-59593-285-2/06/0005 ...$5.00.
The computer game industry is growing rapidly. Today, these digital forms of entertainment require complex software solutions able to ensure compelling experiences to users. Among the numerous technological novelties introduced in the gaming market, network playing is probably the most revolutionary one. From a user perspective, the Web can be seen as a whole game platform that enables one to discover and play with millions of unknown other players. However, several issues arise when geographically dispersed players interact together through the Internet. Indeed, the highly dynamic conguration of distributed game environments and the anonymity among players bring new security challenges for game developers that need to be addressed. Among these, cheating is certainly one of the most problematic. Cheating is dened as any action that a player accomplishes to obtain an unfair advantage over other players. Cheaters try to alter game rules via deviant program behaviors [9]. There are several types of cheats in online games. Taxonomies have been proposed in [13, 18, 19, 20], where cheating schemes are organized depending whether cheaters try to violate game rules, authentication procedures, private information, timing constraints, etc. Our focus here is on those cheats that allow players to alter timing information of game events (time cheats). Time cheating is rampant in distributed games since players are placed at dierent geographical locations and typically connect to the game thanks to dierent system/networking technologies. This unfairness on players technological capabilities is the rst alibi for cheaters. Indeed, by simulating larger network response times, time cheats can be devised which allow cheaters to see into the future, thus providing them with an unfair advantage with respect to honest players [6]. Moreover, games are particularly vulnerable to time cheats when they are hosted on peer-to-peer platforms which are, instead, one of the most promising game architectures for the support of these kinds of applications [3, 4, 7]. In this work, we face with a particular version of the well-known lookahead cheat, generalized in the context of real-time (i.e., not round-based) games. According to such malicious scheme, the cheater waits to see game events generated by other participants before generating its own game event. Then, the cheater mimics that such event has been generated prior to other ones. Schemes that prevent this specic time cheat have been presented in [1, 6, 13, 16]. The main characteristic common to these approaches is that the event delivery is supposed to be organized in rounds. Nodes are forced to exchange additional information (such as hash
values) before revealing their new generated moves. Unfortunately, these schemes result really expensive in terms of number of additional messages and introduced latencies. In fast paced real-time games, this represents an important limitation. Moreover, forcing the game to proceed in rounds limits the pace of the game evolution, thus jeopardizing responsiveness. Indeed, having a proof cheat protocol that aects the interactivity degree may be useless for a large class of fast paced games. With this in view, we claim that, instead of avoiding cheats, more protable solutions can be devised which are based on detection of cheaters. In essence, a peer may decide to control other suspected peers to assert with a certain condence whether they are cheating or not. The algorithm presented in this work follows this approach. In particular, the proposed scheme works at the game communication level and monitors game event latencies during the game delivery. The scheme is based on the following fundamental assumption: the underlying network over which the game is deployed oers a best-eort service with unpredictable delay latencies and jitters but, on the long run, an average trend of network latencies may be observed. This assumption is in accordance with a plethora of works that model network trac in dierent contexts of networks and applications such as, in the networked gaming literature, [2, 11, 15]. Our scheme is named AC/DC, i.e., an Algorithm for Cheating Detection by Cheating. In substance, cheaters detection is accomplished by deliberately increasing transmission latencies of game events towards a given peer p, once p is suspected for cheating. This enables to notice whether p waits for these delayed game events before generating its own (cheated) game events. Put it in other words, a specic node in the system (i.e., the leader peer that controls others for cheating) performs a sort of cheat towards p, so as to detect if p is a cheater. Detection of cheaters is possible since increasing network latencies will be measured at the leader for subsequent cheated events from p, based on their associated timestamps. According to our model, the game evolution is not forced to proceed in rounds. Moreover, even if game events are delivered to suspected cheaters with increasing latencies, all other nodes in the system are not directly aected by our cheating counterattack. Indeed, it could be the case that a cheating counterattack against a suspected cheater may lead to the introduction of additional delays whose eect may have some impacts on the general game dynamics. To counterbalance this problem, classic hiding approaches may be exploited, such as optimistic synchronization and deadreckoning, to reduce the impact of additional delays. In conclusion, based on our approach, a real-time evolution can be guaranteed. The remainder of this work is organized as follows. Section 2 describes our system model. Section 3 presents in detail AC/DC. Section 4 provides discussions on the devised scheme and on how peers may assume the role of leaders. Finally, Section 5 concludes the work.
Table 1: Notations and Symbols
Symbol pi i i ek WTi STi TiW TiS driftij gapij UB ij (e) ij WTjrec (e) l Denition Set of peers Single peer All peers but pi k -th event generated by pi Wallclock time at pi Simulation time at pi Mapping function from STi to WTi Mapping function from WTi to STi Drift between physical clocks at pi and pj Time between the instants at which pi and pj start the game Upper bound on latencies in the system Time to transmit e from pi to pj Average latency from pi to pj Time of reception of e at pj Additional delay employed during the cheating counterattack Value that accounts for a signicant dierence between two latency estimations Upper bound on the increment of overall delay latencies during the cheating counterattack
peer, i.e., pi . For the sake of a simpler notation, with i we indicate all peers but pi i.e., i = {pi }. Similarly, notations such as i,j indicate all peers but pi , pj i.e., i,j = {pi , pj }. (Notations and symbols employed in the remainder of the work are summarized in Table 1.) Games are often viewed as specic simulations where characters interact each with other and evolve with the passing of time. Time is thus a primary characteristic to be modelled. We consider here a general model where the game advances in real-time using the notions of wallclock time and simulation time. Specically, the so called wallclock time is the time that identies when the game takes place. With WTi , we refer to the wallclock time measured at pi . Simulation time, instead, is the abstraction that is used to model when events have been produced within the virtual game timeline. With STi , we refer to the simulation time measured at pi . Thus, once a game event e is generated at pi , pi associates to e a specic simulation time STi (e), obtained from its wallclock time WTi (e) representing the instant of generation of e, measured at pi . We dene a mapping function TiW that transforms a simulation time s STi into the corresponding wallclock time t WTi at pi i.e., TiW (s) = t. With TiS , instead, we represent TiW s inverse function. A typical equation to map wallclock times into simulation times is as follows: TiS (ti,actual ) = TiS (ti,start ) + k (ti,actual ti,start ), (1)
2.
SYSTEM MODEL
We use a framework for modelling games and related timing constraints based on the seminal work by Fujimoto [12]. As this model is quite general, our approach can be applied to a wide range of dierent gaming contexts. We denote with the set of peers; pi identies a single
where k is a constant that determines the pace of game advancements in the simulated world, ti,actual represents the actual wallclock time at pi , ti,start represents the wallclock time associated to the beginning of the game at pi . The mapping TiS (ti,start ) returns a simulation time value, agreed and shared among all nodes, representing the time at which the beginning of the game plot takes place i.e., TiS (ti,start ) = sstart ST , pi . Using (1), the simulation time of a given game event ek can be characterized as follows STi (ek ) = sstart + k (WTi (ek ) ti,start ). (2)
We assume that it is never the case that peers start the game at the same instant i.e., we have with high probability
that ti,start = tj ,start , pi , pj , i = j . We then assume that at the beginning of the game, each player noties other peers with its own ti,start . Based on this model, each peer pi associates its starting wallclock time ti,start to the agreed constant starting simulation time i.e., TiS (ti,start ) = sstart . Another assumption on which our approach is based is that at the beginning of the game a clock synchronization protocol is exploited, such as one inspired to those presented in literature, e.g., [8, 14, 17]. This allows us to obtain an initial estimation of the average network latencies among peers pi , pj and of the drift among physical clocks at pi and pj (i.e., driftij ). By convention, we suppose that driftij > 0 , if pj reaches a given wallclock time t before pi (simply put, at a given time instant pj has a wallclock time higher than pi , see Figure 1).
pi pj
t* t* WTi WTj
Figure 1: Drift among Physical Clocks of Peers During the game evolution, each peer pi maintains also a value gapij measuring the interval of time (real time) between the instants at which pi and pj , respectively, start the game (see Figure 2). A simple equation to measure gapij , based on the starting point of the beginning time instant (including driftij ) is as follows gapij = driftij + ti,start tj ,start . (3)
With ij , instead, we denote the average latency needed for the transmission of a non specied game event from pi to pj . We realistically assume that typically ij (e) ij . Further, WTjrec (e) identies the (wallclock) time of the reception of a given game event e at pj , i.e., pj receives e at t = WTjrec (e). As already mentioned, our approach requires the existence of a leader peer pl which is in charge of controlling if some other peer nodes cheat. The leader must be a trusted player (pl must not be a cheater). We discuss in Section 4.1 viable choices of a leader. Finally, we assume that the generation of game events by a honest peer is independent of those generated by other peers. In other words, even if certain game events, generated by some peer, may inuence the semantics of subsequent game events generated at other peers, in general, the pace of event generation at a given player is mainly inuenced by autonomous player decisions. This assumption is supported by the typical use of techniques such as dead reckoning and/or optimistic synchronization, exploited to hide latencies on notications and local losses of availability on updated information, thus providing players with the possibility of independently making the game to evolve [5, 10].
3. 3.1
CHEATING DETECTION BY CHEATING The Cheat
In essence, gapij takes into account that a drift among clocks of pi and pj exists and that they started the game at dierent times. Clearly, gapij = gapji as well as driftij = driftji . It is worth mentioning that methods may be devised to minimize the value of gapij . As an example, peers may simply agree to start the game at a certain point in time. Alternatively, a peer pl may be set to broadcast a start message to other ones that begin the game as soon as they receive that message (while pl sleeps for a properly set delay before starting the game).
pi pj tj,start
gapij ti,start WTi WTj
Figure 2: Gap among Peers Sometimes, for the sake of a clearer notation we denote game events with subscripts (e.g., ek ) to characterize game events produced by the same player in dierent time instants, e.g., ej , ek , j = k . Moreover, prime notations (e.g., e l ) denote that the event has been generated by a specic peer (in this case pl ). Game events are notied within messages. Without loss of generality, we assume that employed message transmission procedures for interprocess communication are reliable i.e., transmitted messages can experience dierent latencies and delay jitters but cannot be lost. We assume the existence of an upper bound UB on the latencies among peers in the system. UB is known by peers. Moreover, we assume to be in a fully connected peer-to-peer network. With ij (e) we denote the time needed to transmit a game event e from pi to pj .
A cheater pi typically waits for moves generated by other participants before generating an event. As soon as pi receives these game events, he decides the best action to carry out, and noties others with the new game event e, pretending that e has been generated concurrently with (or before) other ones. This kind of cheat is commonly referred to as lookahead time cheat [1, 6, 16]. To formalize this cheat in a real-time model, we denote with W(e) the set of those game events which pi will be waiting before generating e. A rst issue is concerned with determining which game events belong to W(e). This clearly depends on the specic game. In round-based games, for example, W(e) corresponds to the set of all the game events generated by other players at that round. Dierent alternatives may be in use when the game proceeds in real-time. For example, W(e) may consist of the set of game events generated by other players within a given interval of simulated time s. Alternatively, other possible settings for W(e) exist and it is reasonable to assume that pi knows which game events W(e) is comprised of. In the following, we will consider s as the simulation time value exploited to determine W(e). Upon generation of e, pi may create a cheated simulation time obtained through the use of the following formula: STic (e) = min{STj (ek ) | ek W (e), pj i } , ( ST , > 0). (4)
In essence, STic (e) is chosen so that STic (e) < STj (ek ), ek W (e), i.e., pi pretends that e has been generated before each other game event in W(e). Finally, pi calculates a cheated wallclock time WTic (e) in accord with STic (e), obviously dierent from the real wallclock time of generation of e, WTi (e).
3.2
AC/DC: A Cheating Detection Scheme
To face this cheat, we present an Algorithm for Cheating Detection by Cheating (AC/DC), which is based on the idea
of deliberately increasing the transmission latency of events generated at pl for pi . The goal here is that of detecting whether pi waits for game events generated by pl , before generating its own messages. Thus, as soon as pl decides to control pi for possible cheating, it starts computing a new measure of the average latency for the transmission of game events from pi to pl . This value is obtained by averaging i over time several measurements of il (ek ),
i i i il (ek ) = WTlrec (ek ) + driftli WTic (ek ).
(5)
i i In (5), WTlrec (ek ) represents the time of reception of ek at pl , c i WTi (ek ) is the (possibly cheated) wallclock time at which i (pi claims that) ek has been generated, and driftli is the
Process pl : pi = peer to control; assume li = il ; /*assumption of symmetry*/ l = init value; /*init value > 0*/ ((li while + l ) (pi is not suspected)) set additional delaying time = l ; observe il of received game events; if (il > il + ) suspect pi ; else l = increase(l ); Figure 3: AC/DC Pseudo-Code cic network conditions. Finally, the procedure increase(l ) mentioned in Figure 3 is not specied here. There are different possible implementation choices such as, for example, l = l k , k > 1, or a (less aggressive) linear growth of l = l + k , for some constant k.
drift between physical clocks of the two peers. It is worth noticing that the use of an average computation of experienced latencies is probably a naive proposal. Alternative and more sophisticated approaches could be employed that exploit, for example, a low-pass lter to smooth the aleatory behavior of latencies caused by delay jitter. Equipped with il , pl may begin a sort of cheating counterattack against pi . In essence, for each game event e l generated at pl , pl delays e l for an additional amount of time (say l ) before delivering it to pi . In other words, the time elapsed since the generation of e l at pl to its reception at pi results equal to li (e l ) + l . i Upon delivery of e l to pi , new latency values il (ek ) are collected for a given amount of time whose average il is contrasted with il . Based on this comparison, the leader may take a decision. Let be a time value that accounts for a signicant dierence between il and il , i.e., the hypothesis that the two measured values are equal must be rejected. If il > il + then pl suspects pi for cheating. Otherwise, the value of l is progressively increased and the cheating counterattack mentioned above is iteratively repeated until a maximal value for li + l equal to is exceeded, where = UB + TlW (s) + max {gapjl , pj l }.
il
4.
DISCUSSION
(6)
If the value is reached while rests below il + then pi is not a cheater. The rationale behind the choice of incrementing l , till reaching the bound mentioned above, is as follows. The rst term UB makes sure that no other peer pj has higher latencies to reach pi i.e., li + l > UB ji , pj i,l . Furthermore, cases may arise where some game events e j , i subsequent to e l but still within W (ek ), can be generated by other peers in i,l . With this in view, the second term i TlW (s) accounts for those events e j W (ek ) with simulal tion times higher than e but within a time interval of range s. The third and nal term max {gapjl , pj l }, instead, accounts for for those peers pj with gapjl > 0. Indeed, it may be the case that pl and pj generate events with same simulation times at dierent real times and pj reaches these simulation times after pl (see Figure 2). Summing up, the ini crement of l guarantees that no event in W (ek ) is received l by pi later than e . Thus, in the case that pi is cheating, pi will eventually stop, waiting for game events coming from pl . A general description of our AC/DC, executed by pl , is presented in Figure 3 and behaves as discussed above. It is worth noticing that pl assumes that network latencies are symmetric (i.e., li = il ). Moreover, because of delay jitter, to obtain an accurate value of il a properly tuned number of measurements must be set, based on the spe-
A rst important issue relates to the choice of l . One may argue that a direct use of a value for l such that li + l > could make the algorithm simpler, as no increments on l would be needed during the check phase. However, an approach based on the progressive increment of l may be of help to avoid a too high and unneeded growth of transmission latencies between pl and pi . Note also that we are assuming that the increment of l , bounded as discussed before, may lead new observed latencies from pi to pl to surpass a signicance threshold, i.e., il > il +. In practice, should be properly tuned based on guarantees (in terms of latency and delay jitter) oered by the underlying network over which the game is deployed and on the needed signicance level. In particular, the bound on the increment of l enables to detect cheaters when is set so that < li + l gapil (see Appendix A). Conversely, if a value of is needed that is higher than this last term, higher values for must be taken into account. Needless to say, the higher the larger the introduced additional delays to catch a cheater. Finally, we do not suggest any specic statistical test to infer whether the two measures il , il are dierent. Sophistication of the employed test should be determined on a case by case basis. AC/DC makes pl able to detect if pi is cheating. Indeed, suppose that pi is a cheater. Due to the progressive increment of l , latencies experienced by pi to receive game events generated by pl will increase accordingly. Moreover, pl lets l to grow until the overall latency between pi and pl reaches , if necessary. Thus, during the generation of i cheated events ek at pi , eventually the time for receiving all i events in W (ek ) grows in accordance with li +l . This coni rms that pi will generate successive events ek after increasing waiting times and pl will receive these events with ini creasing measured average delays li (ek ). A detailed discussion on the correctness of AC/DC is reported in Appendix A. When pi is not a cheater, instead, the delays added by pl before the notication of its generated game events will not inuence the event generation activity at pi . This claim is supported by our assumption that the event generation rate at a honest node is independent from other ones. Summing
up, during the cheating counterattack, transmission latencies of events from a honest peer pi , ij (e), will be approximately equal to the average latency ij , i.e., ij (e) ij . Thus, pl will not be able to conclude that pi is cheating. On the other hand, pi will observe progressively increasing latencies for events coming from pl during the checking period. In point of this, however, we already observed that advanced techniques such as dead reckoning and/or optimistic synchronization schemes may be exploited at honest peers. These approaches guarantee a fast paced evolution of the game, even when augmented network latencies slow down the reception of fresh game state updates [5, 10]. Clearly, our cheating counterattack should be activated only when some peer is suspected by another one. In other words, methods are needed to suspect a peer for cheating. In practice, several heuristics that suggest when starting AC/DC against a possible cheater can be devised. It is not the aim of this work to list all possible causes for cheating suspicion. Probably, a combination of diverse factors should be taken into consideration. Examples are factors based on degradation of latencies between pl and pi , anomalies based on the observation (at pl ) that other peers near pi have smaller latencies (than pi ), or, nally, a player presents particularly striking game skills i.e., he always wins, therefore he is very skilled or he is cheating.
successful. Thus, until IPv4 will be used as network protocol for the Internet, distributed cheat proof solutions are required in the context of online gaming. In this work, we have considered a version of the wellknown lookahead cheat, adapted in the context of real-time games, and proposed a countermeasure to face with it. The provided model is very general and can be adopted in a wide range of dierent gaming scenarios. The idea at the basis of our approach is that a scheme that permits to detect cheaters with a certain probability represents a viable solution to face with cheating without aecting game performances. A general analysis has been provided to demonstrate the correctness of the devised approach. Extensions to this study include the introduction of asymmetric delays among peers in the system. This would enable to model variegated existing scenarios in residential networks such as ADSL or wireless networks, for example.
6.
REFERENCES
4.1
On the Choice of a Leader
Our scheme assumes the presence of a leader in charge of controlling whether some other peer nodes cheat. Thus, viable choices for a leader election in a completely decentralized peer-to-peer architecture are needed. In general, the leader should be a peer trusted by all other peers. However, agreement among all peers on the trustworthiness of a single node is often hard to achieve. Furthermore, since the leader delays its generated game events before transmitting them, it results that peers cannot freely assume this role without informing others. Indeed, suppose there are two peers which concurrently elect themselves as leaders, and suppose they decide to control each other. In this case, both peers will delay transmission of game events towards the other one. Thus, both peers may erroneously suspect each other. A possible solution consists in exploiting a token based scheme according to which, every time a process receives the token becomes the leader. When a leader, say pk , suspects another node pi , pk passes the token to another peer pj , j = i, k , informing it of its pi s suspicion. Then, pj will in turn control pi . Once a majority of peers suspects pi , then pi is identied as cheater. This solution enables agreement among honest peers (on cheaters detection). Moreover, such a cooperative approach makes harder for the cheater to detect if some other node is monitoring his behavior. Thus, it results more dicult for the cheater to dynamically switch o its cheat as soon as he detects he is being examined.
5.
CONCLUSIONS
From a game design point of view, the best-eort nature of the Internet may be interpreted as a system inadequacy for the support of fast paced online games. Probably, in a QoS guaranteed network, time cheats would be not possible. However if, on one side, Internet protocols present several limitations for the deployment of these kinds of distributed interactive applications, on the other hand, it is the possibility of playing over the Web that makes online games
[1] N.E. Baughman, B.N. Levine, Cheat-proof Playout for Centralized and Distributed Online Games, in Proc. of INFOCOM 2001, Anchorage (USA), IEEE, April 2001, 104-113. [2] M.S. Borella, Source models for network game trac, in Computer Communications, 23(4):403-410, February 2000. [3] F.R. Cecin, R. Real, R. de Oliveira Jannone, C.F. Resin Geyer, M.G. Martins, J.L. Victoria Barbosa, FreeMMG: A Scalable and Cheat-Resistant Distribution Model for Internet Games, in Proc. of International Symposium on Distributed Simulation and Real-Time Applications, Budapest (Hungary), IEEE, October 2004, 83-90. [4] C. Chambers, W. Feng, D. Saha, Mitigating information exposure to cheaters in real-time strategy games, in Proc. of the International Workshop on Network and Operating Systems Support For Digital Audio and Video, NOSSDAV 05, June 2005, ACM, New York (USA), 7-12. [5] E. Cronin, B. Filstrup, S. Jamin, A.R. Kurc, An ecient sync...