Signatures, Heuristics and Machine-Learned Suspicion

The oldest trick: knowing what a cheat looks like

The first generation of anti-cheat worked like early antivirus software. PunkBuster, released by Even Balance in 2000, and Valve Anti-Cheat, introduced in 2002, scanned a player's memory and running processes for byte patterns that matched known cheat programs. If a signature appeared, the account was flagged. The method is cheap, precise and easy to explain: a match either exists or it does not.¹

Its weakness is equally simple. A signature only exists after someone has obtained and analysed a cheat. Private cheats sold to a few hundred customers can stay unknown for months, and polymorphic loaders rewrite themselves so that each copy looks different. Signature scanning therefore rewards cheat makers who keep their audience small, which is exactly how the premium cheat market is now organised.

Valve chose an approach that remains instructive: delayed bans. VAC does not necessarily ban the moment it detects a cheat. Bans arrive in waves, which denies developers a clean feedback loop. They cannot easily tell which update or which customer behaviour triggered detection. The cost is that cheaters keep playing, and ruining matches, during the delay.

Heuristics: looking for the shape of cheating

Heuristic detection stops asking "is this a known cheat?" and asks "is this behaviour plausible?" On the client, that means watching for tell-tale techniques rather than specific programs: a process opening a handle to the game's memory, an injected DLL, a hooked graphics function, a debugger attached where none should be. On the server, it means looking at outcomes, such as a player whose crosshair snaps to heads hidden behind walls more often than chance allows.

Heuristics generalise better than signatures, but they blur the line between cheating software and ordinary software. Overlay tools, macro utilities shipped with peripherals, accessibility programs and streaming software all touch the same interfaces cheats use. Every heuristic is a policy decision disguised as a technical one: the lab is deciding which legitimate tools it is willing to inconvenience.

Machine-learned suspicion

In 2018, Valve engineer John McDonald presented VACnet at the Game Developers Conference. The system feeds sequences of player view angles and shot events into a deep-learning model trained on cases that human reviewers had already judged. Suspicious players were sent to Counter-Strike's Overwatch, a community review system, rather than banned automatically.² That design detail matters more than the model architecture. The machine produces suspicion; people produce verdicts.

Behavioural models have a strategic advantage: they evaluate what a player does, not what software they run, so they work even when the cheat lives on a second computer or a hardware device. That matters because direct memory access (DMA) cheats, which read game memory through a PCIe card controlled by another machine, leave little for client scanners to find.

The limits are real. Models trained on yesterday's cheaters can mistake an unusually gifted player for a bot, and "closet" cheaters who tune their tools to stay within human ranges are hard to separate statistically from good players having a good day. Academic work, including the BotScreen paper presented at USENIX Security 2023, explores detecting aimbots from gameplay data, but published accuracy figures are measured on research datasets, not on adversaries adapting in real time.³

How the major systems combine methods

No serious system relies on one layer. The table below summarises what vendors have publicly described; internal details are not disclosed and we do not speculate beyond the record.

Mitigation instead of detection

A quieter line of research avoids the detection arms race entirely by denying cheats the information they need. If the server never sends the positions of players a client cannot see, a wall-hack has nothing to draw. This is sometimes called fog-of-war culling or server-side visibility. Activision publicly described in-game mitigations within Ricochet that degrade the experience of detected cheaters, rather than banning them instantly. Such approaches cost server resources and engineering time, which is why they are unevenly adopted, but they shift the burden off players' machines.

What to take from this

For organisers, the honest question is not "which system has the best detection rate?", because no vendor publishes comparable figures. It is which combination of layers suits the event, and how appeals are handled when a layer gets it wrong. For players, the useful distinction is between methods that inspect your machine and methods that inspect your play. The second kind asks for less trust. The next essay examines the first.