Aegis AntiCheat

2.7 — Release (safety-first, major)

Release date: 2025-10-28 Summary: - This release focuses on being a "bomb" in quality: broad detection coverage while making it virtually impossible for normal players to be kicked or banned by default. - Default mode is "monitor": no kicks, no bans, only logging and admin alerts. Operators must intentionally switch to "warn" or "enforce" after staging validation. Key changes and additions: 1. Enforcement modes: - enforcement-mode: monitor | warn | enforce - Default: monitor (collect data and alerts; NEVER kick) - warn: admins alerted strongly; minimal enforcement when clear. - enforce: active enforcement according to configured thresholds (use only after staging). 2. New/Enhanced detections: - Timer: robust mean/stddev + environment checks + long sample sizes + heavy confirmation streaks. - AimAssist: low-variance yaw/pitch analysis around hits; requires multiple confirmations. - VelocitySpoof / AntiKB: detects missing/altered knockback reliably with delayed checks. - VClip: vertical teleport/clipping detection with confirmation streaks. - AutoBlock (heuristic), AutoTool, AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, FastBow, FastConsume, FastPlace, Fly, Speed, Spider, Jesus, Phase, Elytra. - Added AutoTool and AutoBlock heuristics; note these are approximations without packet-level integration. 3. False positive reduction: - Confirmation streaks per-check (configurable). - Multi-factor confirmation (e.g., AimAssist + Reach or CPS). - Environment filters (skip checks while gliding, inside vehicles, in liquids, during teleports, or when bypass perms exist). - Conservative default thresholds and longer sample windows. - Soft monitoring mode: MONITOR adds "soft" weights and only logs/alerts unless mode changed to WARN/ENFORCE. 4. Diagnostics & administration: - /aegis info <player> prints score, flags, streaks, client brand, last teleport time. - /aegis dumpflags lists currently flagged players. - violations.log for persistent audit logging. - Optional Discord webhook notifications. 5. Persistence: - Kick counts persisted in config; by default bans disabled to avoid accidental permanent bans. 6. Safety and operational guidance: - Deploy to a staging server in monitor mode for 48-72 hours. - Collect violations.log and use /aegis info to inspect players flagged in monitor mode. - Tune streak and weight values before switching to warn/enforce. - For highest fidelity (especially AimAssist/AutoBlock), consider packet-level integration (Protocollib or custom NMS hooks). 7. Developer notes: - All kicks/bans are executed on the main server thread. - Webhook calls are async. - Code prioritizes null-safety and thread-safe collections. Recommended next steps for operators: - Run in monitor mode for 48–72 hours, exercise typical gameplay (walking, sprinting, parkour, mining, PVP, elytra), and produce logs. - Share suspicious logs or /aegis info outputs if tuning suggestions are needed. - Move to warn mode for a trial period before enforce, and keep automated bans disabled unless you have high confidence. Thank you for using AegisAC. This release aims to be powerful and safe — it is designed so normal players will not be kicked/banned by default.

2.6-alpha — Release (alpha)

Major objectives: - Expand detection coverage and reduce false positives. - Provide richer diagnostics for tuning and debugging. - Keep enforcement conservative by default; require sustained confirmations before punitive actions. What's new: - New detections: - AimAssist (heuristic using low-variance yaw/pitch changes around hits). - VelocitySpoof (detects missing or altered knockback behavior). - VClip (suspicious vertical teleport-like movement). - AutoBlock and AutoTool (heuristic detection for automated blocking and automatic tool switching). - AntiKB (checks for missing expected knockback). - AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, Timer, Fly, Speed, Spider, Jesus, Phase, Elytra, FastPlace, FastBow, FastConsume. - Timer detection redesigned: - Uses per-interval mean & standard deviation across multiple samples. - Requires environment checks (no gliding, not in vehicle, low horizontal speed). - Requires confirmation streaks before marking a violation. - Confirmation streak system: - Each check must be sustained for a configurable number of confirmations (streak.*) before triggering a violation. - Streaks decay over time to avoid stale state. - Diagnostics: - /aegis info <player> prints current score, flags, streaks and client brand to help tuning. - Safety-first enforcement: - Raised flag/kick thresholds by default. - Kicks and bans require multiple flags; persistent kick-counts are stored in config. - Logging & webhook: - violations.log for auditing; optional Discord webhook support for admin notifications. - Robustness: - Null-safety, thread-safe collections, all kicks/bans run on the main thread. - Config-driven weights and thresholds for easy tuning. - Recommended flow: - Deploy to staging with verbose logging for 24–72 hours. - Use /aegis info and violations.log to tune per-check streaks and weights. - Gradually lower thresholds if you confirm stable detection results. Notes: - This is an alpha release: additional tuning will be required for specific server setups, plugins, and playstyles. - If you need packet-level precision (to reduce false positives further), integrating a protocol-level listener or hooking into a networking library is recommended (not included here to keep compatibility).

2.5-beta — Release (beta)

- Focus: Safety-first anti-cheat improvements to minimize false positives for normal players. - New detections: - AimAssist: heuristic detection using low-variance aim changes during hits; requires multi-confirmation before action. - VelocitySpoof: detects inconsistent or missing knockback responses with confirmation streaks. - VClip: detects suspicious vertical teleport-like movement not explainable by normal gameplay. - Timer detection upgraded: - Uses per-interval mean + standard deviation. - Requires sustained deviation + low variance and environment filters (no gliding, no vehicle, low horizontal speed). - Confirmation streaks required before applying full violation. - Global confirmation-streak system introduced: - Many checks now require multiple confirmations (configurable) before committing a violation and adding weight. - Decay reduces streaks over time to avoid stale confirmations. - Conservative enforcement: - Raised score thresholds and number of flags required to kick/ban. - Default behavior ensures normal players are not kicked/banned; intended for staging validation and tuning. - Added diagnostics command: /aegis info <player> (shows score, flags, streaks, client). - Client-brand join alerts retained; webhook integration async and optional. - Persistence: kick counts saved in config; bans take effect only after multiple kicks as configured. - Continued hardening: null-safety, thread-safe collections, safe main-thread kicks/bans and async webhook calls. - Recommended: deploy to staging, gather logs for 24–72 hours, use /aegis info to assist tuning, then adjust streaks/weights.

2.4-alpha — Release (alpha)

- Primary goal: dramatically reduce false positives so normal players will not be kicked or banned. - Timer detection rewritten: - Uses per-interval mean and standard deviation on move events. - Flags only when mean deviates from expected tick (50 ms) AND variance is low (consistent timing). - Requires multiple confirmation streaks to declare a violation. - Skips Timer check in noisy environments (gliding, in vehicle, in liquid, moving fast, bypass perms). - Global confirmation streak system added: - Many checks now require sustained confirmations (configurable per-check 'streak.*') before committing a flag. - This reduces single-spike false positives caused by lag, teleport, or normal gameplay. - Raised conservative thresholds and required more flags/kicks before punitive actions (kicks/bans). - Added more refined FastBreak / Nuker handling and tuned weights to be conservative. - Added client-brand join alerts and retained async webhook support for flags, kicks and joins. - Improved null-safety, thread-safety and persisted kick counts are retained. - Recommended: run on staging, collect logs for a day, tune streak thresholds and weights before enabling on production. Notes: - This is an alpha focused on safety (avoid false positives). It is intended for server operators to test and tune. - If you want, I will add a /aegis info <player> diagnostics command that prints current score, flags, check streaks and last-detected client to help tuning.

2.3 — Release (full)

- Improved Timer detection to dramatically reduce false positives: - Timer now computes per-interval mean and standard deviation. - Flags only when the mean deviates from 50ms by a configurable threshold AND intervals are consistently low-variance. - Timer check is skipped if the player is gliding, in vehicle, in liquid, moving fast, or has bypass permissions. - Conservative defaults (more samples, larger mean threshold, small stddev threshold) to avoid flagging normal walking. - Consolidated and corrected all detection logic; addressed prior compilation/runtime issues. - Added reliable client-brand detection and admin join alerts (minecraft:brand / MC|Brand). - Implemented FastBreak (short-window) vs Nuker (long-window) distinction. - Weighted, decay-based multi-check flagging system; kicks scheduled on main thread. - Persistent kick counts with configurable automatic bans (default 3 kicks -> 3 days). - Async Discord webhook integration for flags, kicks and joins (configurable). - Conservative default thresholds; strong null-safety, thread-safe collections, safe I/O. - Recommended: deploy to a staging server and tune thresholds before production.

- Consolidated release: merged client-brand join alerts, FastBreak detection, persistent kick-counts and ban policy, and many refined detectors. - Added client-brand detection via plugin channels and configurable admin join alerts (e.g., "[AegisAC] player joined using Fabric"). - FastBreak detection: short-window detection for rapid single-player block breaking, distinct from Nuker (long-window). - Persistent kick counts saved to config and configurable automatic bans after repeated kicks (default: 3 kicks → 3-day ban). - Maintained weighted, decay-based multi-check flagging, conservative defaults, and admin/bypass exemptions. - Discord webhook support for flags, kicks and joins (async, configurable). - Robustness: thread-safe collections, safe file IO, main-thread kicks/bans, and fixes for prior enum/API issues. - Recommended: test on staging and tune thresholds to your server's conditions and player latency profile.

2.1-beta — Release

- Added FastBreak detection to identify rapid single-player block-breaking behavior (short-window detection). - Improved distinction between FastBreak and Nuker (short vs long windows) to reduce false positives. - Tuned weights and conserved multi-check flagging and decay to keep normal players safe. - Persistent kick tracking and ban policy remain (configurable: default 3 kicks -> 3-day ban). - Continued improvements in movement, phase, spider, jesus, autoarmor, autoclicker, fastbow, fastconsume, elytra and timer detections. - Reliable kicks and bans run on the main thread; webhook notifications asynchronous and optional. - Recommended: deploy to staging and tune thresholds based on your server's latency and gameplay.

2.0 — Release

- Implemented persistent kick-count tracking and automatic ban after repeated kicks. - Default policy: 3 kicks => 3-day ban for reason "Unfair Advantage". - Kick counts are persisted in config under kick-counts and survive restarts. - Added administrative command: /aegis resetkicks <player> to reset a player's persistent kick count. - Maintained and improved previous detections (Spider, Jesus, AutoArmor, AutoTotem, NoFall, Nuker, AutoClicker, FastBow, FastConsume, Phase, Timer, Elytra). - Ensured all kicks and bans are executed on the main server thread; respects admin and kick-exempt permissions. - Discord webhook support for flags and kicks remains configurable and asynchronous. - Conservative defaults and multi-check weighted flagging retained to reduce false positives. Tune config.yml on a staging server before production. - General robustness: thread-safe maps, robust null-checks, immediate persistence of kick counts, and safe logging.

1.9-beta — Release

- Expanded detection coverage: Spider (wall-climb), Jesus/Waterwalk, Phase (no-clip), Timer (tickrate manipulation), Elytra speed detection, and improvements to AutoArmor, AutoTotem, NoFall, Nuker, AutoClicker, FastBow, FastConsume. - Hardened movement checks: speed measured as blocks-per-second; fly/airplace logic refined to reduce false positives. - Improved phase/no-clip detection and mitigations to prevent large-scale griefing. - Kicks are reliable and performed on the main thread; admin and kick-exempt permissions respected. - Discord webhook support for flags and kicks (async). - Retained weighted multi-check flagging and decay-based scoring to minimize false positives; conservative default thresholds. - Thread-safe state, separate action-specific tracking maps, robust null-safety, and detailed logging.

1.8-beta — Release

- Added Spider detection (wall-climb) to detect upward movement near walls without climbable blocks. - Added Jesus/Waterwalk detection for players walking on/over water in suspicious patterns. - Added AutoArmor detection (pickup -> immediate equip patterns) with conservative thresholds. - Hardened AutoTotem, NoFall, Nuker, AutoClicker, FastBow, FastConsume, AirPlace, Speed, Reach, Scaffold checks. - Improved separation of per-action state to eliminate cross-check interference (lastPlaceTime, lastAttackTime, lastMoveLocation/time, lastArmorEquipTime). - Reliable kick flow: scheduled on main thread, permission exemptions enforced. - Discord webhook integration for flag and kick notifications (configurable). - Conservative default thresholds and decay-based scoring to reduce false positives; tune config.yml on a staged server. - Thread-safe data structures, robust null checks, and safe logging for production stability.

1.7 — Release

- Fixed kick reliability: all kicks scheduled on main thread and permission exemptions enforced. - Added Discord webhook notifications (configurable) for flags and kicks; webhook calls run asynchronously. - Resolved false positives and cross-check interference by separating action-specific state (lastPlaceTime, lastAttackTime, lastMoveTime). - Improved speed detection using distance-over-time (blocks per second) to reduce spurious speed triggers. - Hardened AirPlace detection to only trigger when truly airborne for configured minimum time. - Maintained conservative thresholds and safe-kick policy; immediate chat blacklist kicks remain enforced when configured. - General robustness: thread-safe tracking, safe logging, and better null/permission handling.

1.7-beta — Release

- Fixed false positives and cross-check interference by separating action-specific state (lastPlaceTime, lastAttackTime, lastMoveTime, etc.). - Improved speed detection using distance-over-time (blocks per second) to avoid spurious triggers. - Hardened AirPlace so block placement is only considered when the player is truly airborne for a configured minimum time and other conservative checks pass. - Ensured FastPlace, Nuker, AutoClicker and other checks use isolated tracking to avoid mutual side effects. - Preserved conservative thresholds and safe-kick policy; immediate chat blacklist kicks remain enforced when configured. - General robustness improvements: thread-safe maps, safe logging, and synchronized kicks when required.

1.6 — Release

- Added Nuker detection (rapid block break prevention) with conservative defaults. - Added chat blacklist enforcement for dupe-related phrases; players attempting prohibited phrases are kicked unless exempt. - Added additional checks: AutoClicker, FastBow, FastConsume improvements. - Strengthened existing checks (AirPlace, Reach, Velocity) and tuned weights. - Retained safe flagging system and decay-based scoring; kicks occur only after repeated/serious confirmed offenses, except for explicit chat blacklist kicks. - Improved logging and admin alerts; thread-safe tracking and robust null/permission checks.

1.5-beta — Added AutoClicker, FastBow, and FastConsume detection; strengthened AirPlace and existing checks; introduced a safe kick policy that only kicks players after repeated flags or excessively high violation scores; improved logging, configurable weights, and false-positive safeguards for more reliable enforcement.

1.4-beta — Added conservative AirPlace detection with configurable thresholds and bypass permission, refined false-positive protections and weights, and improved event handling to cancel suspicious actions for flagged players while preserving the no-auto-kick policy.

1.3 — Introduced a weighted flagging system to avoid false positives and removed all automatic kicks; added decay-based scoring, distinct-check requirements, admin commands (reload/status/unflag), robust logging, and thread-safe collections.

Improved false positive prevention for legit players Added new checks: NoFall, FastPlace, KillAura, Scaffold Added violation counter system before kick Added logging system (plugins/AegisAC/logs/violations.log) General stability and performance improvements

Added core cheat detections: Fly, Speed, Reach, Velocity, Criticals, AutoTotem Added instant kick system for cheaters Added admin alert permission: aegis.alerts Optimized performance and reduced false positives

AegisAC v1.0 — Advanced Anti-Cheat for Paper 1.21 AegisAC detects and blocks common cheats such as Fly, Speed, Reach, FastBreak, Velocity, Criticals, and AutoTotem. Lightweight and configurable, designed for both survival and PvP servers. Commands: /aegis reload — Reloads the plugin configuration (OP only). Permissions: aegis.reload — Allows reloading the plugin. aegis.bypass — Exempts a player from detection. Version: 1.0 (Initial release)