Anticheat — methodology
Applied section. Each topic is one automation problem: what the tool does, which protocol fact makes it possible, which observable it leaves behind, and the method that turns the observable into evidence. Built directly on the reference notes — nothing here works without the protocol map.
The one rule
Patterns beat peaks. A human can be the fastest digger on the server for one evening. A human cannot be equally fast, with equal variance, at 03:47, seven days a week, forever. Detection targets the shape of behavior over time, never a single impressive number. Every method below is a variance/consistency test first and a speed test never.
Pipeline (same for every topic)
witness account (officer-owned, in-alliance, read-only) │ sees exactly what any member sees: broadcasts, claims, reactions ▼ collector ── normalizes frames to timed event rows (JSONL, spooled to disk) ▼ daily export ── mailed out for evaluation ▼ analysis pass (AI or script) ── per-player distributions, outlier flags ▼ human-check ── an unautomatable interaction only a real person passes ▼ evidence pack to R4 ── suspicion is never a verdict, nothing goes public
Evidence standards
- Every flag carries a confidence and the rows behind it. No verdict from a single signal.
- Event-burst windows (SVS/KV ±30 min) are excluded — honest hardcore play aliases to bot behavior there.
- One exonerated suspect per few guilty ones is the expected error rate; the human-check exists to catch them, and an apology is part of the process.
- Witness data stays alliance-internal. It is a check on tools, not a weapon on people.
Topics
| Topic | Status | Contents |
|---|---|---|
| 1 · Technical — digs | live | wire loophole · module anatomy (redacted) · rhythm/quantization tells · confrontation protocol · rules the tools can't follow |
| 2 · Non-technical — the short version | live | the member-facing briefing: what auto does and can't do, the two friendly rules, the one-day policy |
| Stations / shop sniping | in collection | rotation-instant burst shapes |
| Rally joins | in collection | millisecond-percentile join spikes without interaction side-channel |
| Kill farming | queued | kill surges without matching march activity |
The two methods
Every topic is worked twice: detect (telemetry → patterns → astronomical probability → friendly replication on camera, never accusation) and displace (rules targeting features no tool offers — today: liking a message, sending a sticker — quick, equal for everyone, judgement-free, one-day penalty). Detection finds them; rules make the tool worthless.
Access
Collector internals stay redacted on purpose — tool vendors read public pages too. Full material goes to alliance management that can vouch for themselves. Same rule as everywhere on this site: prove you're working against automation and the redactions come off.