Hot to detect bots/copybots with LSL?

I sometimes see messages in the chat like "Copybot protection enabled" or similar. I believe there are some scripts out who (at least try to) detect bots or copybots with scripted objects.

Just out of curiosity, what would be the best way to tell "real" avatars apart from bots? I believe there is no real bullet-proof method to detect bots because they are technically avatars just using a different viewer client.

Does anybody know how these "copybot protection" scripts are trying to detect the bots?

Jim

this has been covered a billion times.

The "Copybot protection" things started as a poorly thought out script dashed off in 10 minutes by a developer who was riding the wave of panic. He made his script available full perms. Not too long thereafter, several other iterations of this script showed up, each person seeing an opportunity to prove thier "street cred" by making (or claiming to have made) a "better" one.

They all started from the idea that the original copybot would log off if you IMed it with the word "!quit". Of course, there's no evidence that it would actually respond if the IM came from an object. But more to the point, it's one line of code in the bot's program, and it's so easy to change that "!quit" command to "!stop" or "!logoff" or "!pizza". Anyone looking to scam content isn't going to be running a copybot that can be shut down by one of these things.

The spammer that's worst of all, the one that keeps changing it's name and claims to be "low spam", was created ENTIRELY as a way to scam people into paying exhorbitent fees to get one, and then making the duped buyer into the bad guy for spamming with it.

They don't work, they never worked. And they won't work.

To date, there is still not one single behaviour or thing you can use to detect with any certainty that an avatar you encounter is a "bot". Some are easy, if you find a skybox full of generic avatars sitting doing nothing, chances are you've found bots. But it's one of those things that takes a human brain to discern.. and humans also make mistakes.

Anti-Bot hysteria is also a big problem. Most bots in SL are harmless. Hopping around, indexing land for sale, checking landmarks, etc. There's a bot in my shop, whose job is to write down the names of people who subscribe to my newsletter. There are bots for good, and bots for bad. But there really are also noobs who crash during teleports, and people who are slow to respond, or can't figure out how the chat system works.. there are text-only clients that don't let you fully rez, and there are ways that "people" can be mistaken for bots.

When it all comes down to the wire, there' no surefire way to tell, especially with a script, if any given avatar is a bot.

Do the grid a favour, and take down your spammer if you have one. If you find them, ask the owners (nicely) to take them down, or file an abuse report and the Lindens will come remove them.

(The current release candidate includes a way to find objects that are sending you IMs... finally.)

Thanks for your detailed explanation. I don't have this kind of script running in my shops, I was just curious how they are supposed to work.

It might be useful to have a reliable method to tell them apart though. I'm developing a web based vistor counter system (low lag, no spamming involved ) that would benefit from an option to show "real" visitors separated from bots. Hopefully LL may include an LSL function in the future to detect the type of viewer that people use (analog to "web browsers" you can see in your web hosting stats) so it would be easier to see if people come in with a text-only viewer or with a graphical viewer. Anyway, I know these can be faked easily (as well as I can tell my Opera browser to identify as IE7), but it might be a good start.

Jim

Eventually we're supposed to get a way to volutarily flag our own bot accounts as bots. Those bots then wouldn't count towards traffic calculations.. of course, then honest people will be penalized for declaring their bots, while those who don't declare will only benefit more.

Number of visitors is really a stupid metric anyways., and it's pretty meaningless really. I'd be more interested in metrics like payment info on file, premium users, english speakers, etc. Being able to tell the client language is an awesome metric that almost no one tracks.

At the end of the day, the only metric that really matters, is sales.

you are right, sales is a good metric, but I want to use my system also for schools and not only for shops

Using all the other metrics is a good idea. I alread thought about that, especially since LL implemented llGetAgentLanguage.

llDetectHeartBeatBehindRemoteScreen

Winter explained it very well.

I cannot stand those damn "copybot protection" things IMing me every time I enter a shop. It makes me wonder how clueless and paranoid the shop owners are. What makes it even more ridiculous is the stupidly long, arbitrary version names I see at the end of the object name. How many versions of a script can there be that simply IMs a useless and embarrassing command? It's a shame because it'd be nice to mute the damn things.

Although one amusing thing about the shops I seem to notice these 'protection' systems on, are usually shops that don't even have anything worth stealing anyway!

On top of all of that, bots only respond to the master avatar assigned when they're logged on. I got into the habit muting those stupid copybot protection scripts, and rarely run into them. It just goes to show how easily non-technical people are duped.

there are parameter that can be checked in the client info that isn't normally seen by the user, which will detect 'blind' bots at least. although I think they'll also pick up the chat only clients.

there is no foolproof way though, because fools are so ingenious.

I guess you could always check if they are logged into voice, otherwise they are a bot or a mute.

heh, I never logg voice... must be a bot =)

me either.

That's it... I knew it.. anyone who puts statements INSIDE of functions... must be a bot.

=) waste not want not.

You can also use the parcel media/audio stream. Bots can't play them... mind you that will give you a huge number of false positives. I'm sure there are other little things too.

the viewer check is good for bots that are interacting with things (like camp chairs) not so go at picking up people standing around randomly (because if they're interacting with a view you know it's scripted action)

I once came up with the idea of a simple intelligent autonomous 'scoring' system, which added up a score of the likelihood someone was a bot and draw the line, where an avatar would definitely be a bot, possibly a bot, probable human, or definite human, it seemed like an absolutely perfect system to very easily detect bots fast as possible, then respond with appropriate actions to dealing with the situation. As well as tracking the general statistics in a neat graph as a side note since it'd be kinda handy data what your audience really is.