Server-side verification of client behavior in online games

Abstract

Online gaming is a lucrative and growing industry but one that is slowed by cheating that compromises the gaming experience and hence drives away players (and revenue). In this paper we develop a technique by which game developers can enable game operators to validate the behavior of game clients as being consistent with valid execution of the sanctioned client software. Our technique employs symbolic execution of the client software to extract constraints on clientside state implied by each client-to-server message, and then uses constraint solving to determine whether the sequence of client-to-server messages can be "explained" by any possible user inputs, in light of the server-to-client messages already received. The requisite constraints and solving components can be developed either simultaneously with the game or retroactively for existing games. We demonstrate our approach in two case studies: one of the open-source game XPilot, and one of a game similar to Pac-Man of our own design.

WAVES: Automatic Synthesis of Client-Side Validation Code for Web Applications

“…WAVES avoids these inconsistencies for applications where the server validation code is correct by simply replicating that code for the client. Two related works also avoid these inconsistencies but for applications where the client validation is correct: Ripley [21] and [22]. These two classes of work are therefore complementary for legacy applications.…”

“…The most germane work, Ripley [21] and [22], could seemingly be used to meet the same objective: write validation code once (on the client) and allow the system to automatically replicate it elsewhere (on the server). However, there is a crucial benefit to writing validation code on the server instead of the client: all constraints, whether static (not dependent on the server's database, file system, etc.)…”

Development of Embedded CAPTCHA Elements for Bot Prevention in Fischer Random Chess

“…Server-side bot detection requires some resources to analyze the data that is collected, however, and could possibly be circumvented by a bot program [12]. Once a bot is removed from the game, the bot creator can easily change the program to avoid the behavior that resulted in detection.…”

Finding protocol manipulation attacks

“…Finally, Bethea et al [2] recently described an approach and associated tool to perform online verification that a sequence of inputs received at the server could have been generated by an honest client. Like MAX, their tool combines the results of symbolic execution with state information derived from concrete execution.…”