Thwarting a macro, part 5: Finding macros using the power of the internet

In previous parts we spent a lot of :effort: to thwart some macros and discovered that we don't actually care that much. Now I'll show you how to find them without having to undock, then without even logging in.

While I was searching for the bots the first time they moved I found that using the 'pilots in space' map overlay ingame you can see which systems have people in them, and using dotlan's regional map it's easy to check those systems for suspicious NPC kill patterns. It's easy to tell the difference between a system where players rat and run anomalies and ones with macros because the former have strong usage spikes while the latter are much more steady, often with downright inhuman ratting runs. Try it in your (0.0) region today!

Bot examples:

W0X-MG


JI-1UQ


T-K10W


7D-PAT

Human pve examples:


3-QYVE
(actually looks suspicious -- maybe a bot in addition to human players)


A1RR-M


R-YWID
(EDIT: Also looks suspicious, with no zero values for two 18+ hour intervals. R-Y is the capital system of our alliance though, and it's possible that it's the first choice for running anomalies, with people basing out of r-y and going to other systems when r-y is saturated with pve-ers; three systems adjacent to r-y have anomaly upgrades, two by jump bridges and one by gates)

Since I can tell the difference between a bot and humans doing pve, I'll bet a computer can do it too. The spikiness found in human pve systems makes them distinct from macros, which have a very steady rate of NPC kills, and this suggests a method for distinguishing them. I don't know what the word means in real math but I'm calling the way I found to measure this "entropy." The measurement is made by taking the NPC kills in the first hour and comparing them to the NPC kills in the second hour. The difference in the two values is recorded. Then the second hour is compared to the third, and the difference is added to the difference from the first hour. Repeat for all 48 hours.

The 4 bots above have entropy values ranging from 400 to 800. A1RR, the human ratting system above with the lowest entropy, has 70% more entropy than the highest-entropy botting system despite having half the number of NPC kills so we're probably on to something. The bots' kills in the previous 48 hours range from 1500 to 2700, and we will use this information as well to help avoid false positives.

With these numbers as a guide I wrote a python program which takes the (full and correctly spelled) name of a system, gets NPC kills data from dotlan and processes it, returning a positive if the number of NPC kills are between 1200 and 3300 AND the entropy is less than 950.

This is strictly a proof of concept tool. It did correctly identify whether bots were being used in 18 out of 19 active pve systems in tenal, but pointing it at some regions with different types of NPCs (stain, drone lands) it produces a lot of false positives. Clearly there are better ways to do it -- looking for long low entropy runs rather than just taking the sum, for example. It is also completely useless for finding bots that operate in the same system as humans ratting or doing anomalies.

Once the program was working, such as it is, I grabbed a partial list of 0.0 systems from eve-wiki and made a new version of the program that would automatically run through the list looking for bots. Running it against systems in 7 guristas regions returned 47 hits, including 19 false positives.

Bot finder finds bots

Anyway, I'm done with this angsting-about-bots shit now. CCP doesn't care, my 53 line toy program is smarter than the entire unholy rage team and the whole thing is a waste of time. Anybody who's interested can download the programs, but you'll probably need basic programming skills to make them run.