[J_Tanzanite]

Originally Posted by BReeZ Can i run this alongside COWAC? How does it affect performance? Would it ever do false positives?

Yes you can run Lilac alongside CowAC, the two should not interfere at all.

I haven't tested the performance, so I can only go by what other people have told me.
Seems like the load from Lilac is minimal, some people have said there is a load, but not a noticeable one, but I can't verify.
So, no clue.

No Anti-Cheat is 100% false positive free, especially not server-side ones.

The amount of false positives for Lilac should be fairly rare.
With the exception of Bhop, where there is a .2 to 2% chance of a false positive (Only on bans where the Bhop counter is 5... Bhop bans with the Bhop counter being 10 is 0.01 to 0.1% false positives. Which means 98 to 99,9% of Bhop bans are valid).
I am working on version 1.6.0, which has a fix for this, which makes the likelihood of false Bhop ban even lower.

Other cheat detections should be 99,99%(ish) chance of being valid.

[J_Tanzanite]

Originally Posted by Ejziponken What is Delta/TotalDelta? And what does a higher number mean vs a lower number? Also can you explain the difference/meaning between Angle-Repeat, Aim-Snap and Aim-Snap2 [CSGO] Some stats after running the aimbot detecting together with SMAC: Total detected players: 29 SMAC banned: 9/29 (I assume 100% correct detections) Admins banned for aimbot: 3/29 (I assume 100% correct detections) Players that got detected multiple times over several days: 4/29 (I suspect they actually cheat, but no "real" evidence + 3 of them has previous VAC banned accounts linked with IP) Players that havent been verified as cheaters: 17/29 (Possible cheating, but also possible false positive detections + atleast 2 of them has previous VAC bans linked with IP) I do not run SMAC's Eye-Test module and I have lilac_angles_patch 0 and lilac_backtrack_patch 0

Delta is the players highest angle delta 0.5 seconds (half a second) prior to a shot that killed someone.
Lilac does not check this value, whereas SMAC detects angle deltas higher than 45 degrees and counts that as an aimbot.
Delta is only there for logging purposes, so that admins can read the log and get an idea as to what was going on.

Total Delta is how much your angles changed in total 0.5 seconds prior to a shot that killed someone.
Some cheaters will use spinbot or Anti-Aim, and by doing so, may have an insanely high TD (Total Delta).
The maximum TD allowed before it gets flagged as an aimbot is 450 degrees (180 * 2.5).
Meaning you have to do a full 360 and then some.

Angle-Repeat is basically a type of Silentaim (psilent).

Aim-Snap and Aim-Snap2 are similar things, they detect aim-snapping, which is when your aim snaps onto someone.
The reason for the two flags is because there are two similar ways of detecting it. And having two different flags lets me know exactly what kind of snap happened, and if there ever is a bug (which there haven't been any reports of) I can identify which one it is.
Aim-Snap2 is more sensitive than Aim-Snap, meaning it can detect smaller aimsnaps, but is more rare than Aim-Snap.

[J_Tanzanite]

Originally Posted by borzaka First of all, I would like to thank you for your hard work! Fighting against cheaters is a great and noble cause!

Thank you

Originally Posted by borzaka Many of my clients got kicked for having too high ping. Later they reconnect, and stayed with no high ping problems. Could you extend your ping check to 60 seconds (I read somewhere that it's currently 45 seconds)? I believe there would be less kicks, because they ping would normalize by that time.

Hmm, yeah I guess 45 seconds is a little too fast.
Tho perhaps it should be longer than 60 seconds... I'll double it in version 1.6.0 so it takes 90 seconds.
And perhaps I should extend the recently joined protection...
When players first join, they are immune to Ping checks for 100 seconds, I think extending it to 120 seconds might help out a little. Maybe longer?

Originally Posted by borzaka Support for Sourcebans++ natives.

There is already Sourcebans++ support, and most people don't seem to have issues with it.
Tho, the implementation in SMAC seems... I dunno, a little better?
I'm a little unsure if I should change the current method, but it might be worth it?

Originally Posted by borzaka Your plugin catched the aimbot cheater faster than SMAC! 19:58:20 vs 19:57:09

( UwU) *Blush*
...
Yeah I quoted that... Don't bully pls

Originally Posted by borzaka I don't know if it's related to your plugin, but the kick reason is empty

That's odd... I don't think it's Lilac doing that, I can't think of anything that would cause that either...
If you only get that problem with Lilac installed, then something is deeply wrong.

Originally Posted by borzaka If you are interested I can give you the demo and more logs about that aimbotting case.

I wouldn't mind, but I'm not sure what to do with it. ¯\_(ツ)_/¯

[Ejziponken]

Originally Posted by J_Tanzanite Delta is the players highest angle delta 0.5 seconds (half a second) prior to a shot that killed someone. Lilac does not check this value, whereas SMAC detects angle deltas higher than 45 degrees and counts that as an aimbot. Delta is only there for logging purposes, so that admins can read the log and get an idea as to what was going on. Total Delta is how much your angles changed in total 0.5 seconds prior to a shot that killed someone. Some cheaters will use spinbot or Anti-Aim, and by doing so, may have an insanely high TD (Total Delta). The maximum TD allowed before it gets flagged as an aimbot is 450 degrees (180 * 2.5). Meaning you have to do a full 360 and then some. Angle-Repeat is basically a type of Silentaim (psilent). Aim-Snap and Aim-Snap2 are similar things, they detect aim-snapping, which is when your aim snaps onto someone. The reason for the two flags is because there are two similar ways of detecting it. And having two different flags lets me know exactly what kind of snap happened, and if there ever is a bug (which there haven't been any reports of) I can identify which one it is. Aim-Snap2 is more sensitive than Aim-Snap, meaning it can detect smaller aimsnaps, but is more rare than Aim-Snap.

Would it be normal that it detects both kind of aim-snaps at the same time?
Detected: Aim-Snap Aim-Snap2

Also, If you had to rank all these kind of aim detections after how relieable they are, how would you do that?

Like 1 = least amount of false positives and 4 = most false positive.

Example:
1. Aim-Snap
2. Aim-Snap2
3. Angle-Repeat
4. Autoshoot

[J_Tanzanite]

Originally Posted by Ejziponken Would it be normal that it detects both kind of aim-snaps at the same time? Detected: Aim-Snap Aim-Snap2 Also, If you had to rank all these kind of aim detections after how relieable they are, how would you do that? Like 1 = least amount of false positives and 4 = most false positive. Example: 1. Aim-Snap 2. Aim-Snap2 3. Angle-Repeat 4. Autoshoot

Yes, it can detect both at the same time.

As for my ranking... It's not that straight forward.
The chances of any one of them happening is grounds enough to look into a player, especially if it happens multiple times.
In order to get banned you need to get 5 or more aimbot detections within 10 minutes.
And it's not like the "most prone to false positive" flag is all that different from the most stable detection flag; They are all fairly stable and reliable.
So ranking them is... Hard.

[borzaka]

Originally Posted by J_Tanzanite Hmm, yeah I guess 45 seconds is a little too fast. Tho perhaps it should be longer than 60 seconds... I'll double it in version 1.6.0 so it takes 90 seconds. And perhaps I should extend the recently joined protection... When players first join, they are immune to Ping checks for 100 seconds, I think extending it to 120 seconds might help out a little. Maybe longer?

120 seconds recently joined protection and 90 sec check sounds great! Thank you!

Originally Posted by J_Tanzanite There is already Sourcebans++ support, and most people don't seem to have issues with it. Tho, the implementation in SMAC seems... I dunno, a little better? I'm a little unsure if I should change the current method, but it might be worth it?

It looks a better implementation for me, but I'am not a SourceMod coder. I would check other implementation (more recent), and choose a modern, native approach. Sounds like optimization.

Unfortunately today there was a miss in an aimbot detection. SMAC caught it, but LILAC missed one detection to fulfill the ban.
SMAC's default config: 6 detection for a ban.
In LILAC I set to 6 as well (5 was the default).

SMAC:

L 06/09/2020 - 19:36:26: [smac_aimbot.smx | 0.8.7.3] chat (ID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0) is suspected of using an aimbot. (Detection #2 | Deviation: 119° | Weapon: weapon_m4a1)
L 06/09/2020 - 19:36:32: [smac_aimbot.smx | 0.8.7.3] chat (ID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0) is suspected of using an aimbot. (Detection #3 | Deviation: 120° | Weapon: weapon_m4a1)
L 06/09/2020 - 19:36:42: [smac_aimbot.smx | 0.8.7.3] chat (ID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0) is suspected of using an aimbot. (Detection #4 | Deviation: 119° | Weapon: weapon_usp_silencer)
L 06/09/2020 - 19:36:45: [smac_aimbot.smx | 0.8.7.3] chat (ID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0) is suspected of using an aimbot. (Detection #5 | Deviation: 120° | Weapon: weapon_m4a1)
L 06/09/2020 - 19:36:47: [smac_aimbot.smx | 0.8.7.3] chat (ID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0) is suspected of using an aimbot. (Detection #6 | Deviation: 120° | Weapon: weapon_m4a1)
L 06/09/2020 - 19:36:47: [smac_aimbot.smx | 0.8.7.3] chat (ID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0) was banned for using an aimbot.

LILAC

2020/06/09 19:36:27 [Version 1.5.1] {Name: "chat" | SteamID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0} is suspected of using an aimbot (Detection: 2 | Delta: 120 | TotalDelta: 6840 | Detected: Aim-Snap Aim-Snap2 Total-Delta).
        Pos={-1915,-163,6}, Angles={3.62424,56.10117,0.00000}, Map="de_dust2", Team={3}, Weapon="weapon_m4a1", Latency={Inc:0.000003,Out:0.028118}, Loss={Inc:0.000000,Out:0.000000}, Choke={Inc:0.493665,Out:0.000000}, ConnectionTime={31.828126 seconds}, GameTime={863.531250 seconds}
2020/06/09 19:36:33 [Version 1.5.1] {Name: "chat" | SteamID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0} is suspected of using an aimbot (Detection: 3 | Delta: 120 | TotalDelta: 6720 | Detected: Aim-Snap Aim-Snap2 Total-Delta).
        Pos={-1908,-177,10}, Angles={-1.50879,79.81770,0.00000}, Map="de_dust2", Team={3}, Weapon="weapon_m4a1", Latency={Inc:0.000000,Out:0.026923}, Loss={Inc:0.000000,Out:0.000000}, Choke={Inc:0.539155,Out:0.000000}, ConnectionTime={37.726562 seconds}, GameTime={869.429687 seconds}
2020/06/09 19:36:42 [Version 1.5.1] {Name: "chat" | SteamID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0} is suspected of using an aimbot (Detection: 4 | Delta: 147 | TotalDelta: 7080 | Detected: Aim-Snap Aim-Snap2 Angle-Repeat Total-Delta).
        Pos={-1923,1273,31}, Angles={3.00378,47.99258,0.00000}, Map="de_dust2", Team={3}, Weapon="weapon_usp_silencer", Latency={Inc:0.000000,Out:0.028140}, Loss={Inc:0.000000,Out:0.000000}, Choke={Inc:0.516024,Out:0.000000}, ConnectionTime={47.328125 seconds}, GameTime={879.031250 seconds}
2020/06/09 19:36:46 [Version 1.5.1] {Name: "chat" | SteamID: STEAM_1:1:xxxxxxxxx | IP: 0.0.0.0} is suspected of using an aimbot (Detection: 5 | Delta: 120 | TotalDelta: 7200 | Detected: Aim-Snap Aim-Snap2 Angle-Repeat Total-Delta).
        Pos={-1698,1289,37}, Angles={2.16541,-37.30033,0.00000}, Map="de_dust2", Team={3}, Weapon="weapon_m4a1", Latency={Inc:0.000004,Out:0.026620}, Loss={Inc:0.000000,Out:0.000000}, Choke={Inc:0.531661,Out:0.000000}, ConnectionTime={50.429687 seconds}, GameTime={882.132812 seconds}

Do you need more info? A demo would help? How could I help you to improve?

[Ejziponken]

was detected and banned for Bhop (Jumps Presses: 5 | Bhops: 5)

How do I disable the ban for bhop?

[borzaka]

Originally Posted by Ejziponken was detected and banned for Bhop (Jumps Presses: 5 | Bhops: 5) How do I disable the ban for bhop?

// Detect Bhop.
// 0 = Disabled.
// 1 = Simplistic, ban on 10 Bhops.
// 2 = Advanced, ban on 5 Bhops depending on jump count, defaults to 10 on jump spam.
lilac_bhop "0"

[Ejziponken]

Originally Posted by borzaka // Detect Bhop. // 0 = Disabled. // 1 = Simplistic, ban on 10 Bhops. // 2 = Advanced, ban on 5 Bhops depending on jump count, defaults to 10 on jump spam. lilac_bhop "0"

I still want the detection in the log tho.

[J_Tanzanite]

Originally Posted by Ejziponken I still want the detection in the log tho.

I don't think that's possible in the current version.
Tho... That wound be a neat feature, log only.

Maybe I should add that to version 1.6.0