Yeah, we do those things.

1) they’re not foolproof

2) there is a delay in aggregating the data

this has annoying effects when the game has a trial period/goes on sale/has lots of cheap CD keys floating around.

3) if you weren’t delayed then the cheaters get better at adjusting to how you catch them.

We actually do a lot of statistical analysis, but it works in tandem with endpoint anti-cheat, and would hardly work at all alone.

I know when I spent a lot of time dealing with fraud in a different market, the most effective tool was to catch and shadowban the accounts rather than banning them.

If we banned them, they just created a new account and kept doing the same things.

When we detected them and the isolated them from all other good standing accounts, only allowing them to interact with other shadowbanned users, it virtually solved the problem. Normal users went about their day and the cheaters/fraudsters wasted a lot of time never getting through to anyone.

In gaming it seems like creating a cheaters purgatory where they are stuck competing against other cheaters forever would probably end up being its own special league after a while. Like when people suggested steroids in pro-baseball should be legal.

And to manage this purgatory and detect the accounts which will end up there, a live-service game needs an active, permanent and competent team of honnest people, period. If a game studio is not ready to do just that for its live-service game, it has to stop developping that game and move to another type of game.

Give this team server side data, user level 'traps' and 'pitfalls' with frequent updates (they do that for dota2 and probably cs2, they don't need a kernel module), and you should end up with a rather sane gaming experience.

Yeah, we actually discussed doing something like that.

That's what GTA5 did (though, they marked you with a dunce cap)...

.. even though it's a good idea (and we nearly implemented it actually), there's probably a reason that GTA5 is still plagued with cheaters.

Scoring ect ... is kind of useless because it's not a proof, basically it means nothing tangible to be able to ban with 100% confidence. That's why ML is not good for detecting cheaters.

It gives a score that is hard to use.

>Are they moving faster than conceivably possible by a real player? Even the most basic (x2-x1)/t > twice the theoretical will catch people teleporting or speed hacking.

This is how I imagine Amazon ended up banning a large amount of players for speedhacking. The players were lagging. I'm guessing their anti-lag features ended up moving them faster than the anti-cheat expected.

But I agree that a combination approach would probably work.