Aegis AntiCheat

## 2.8-beta — Release (beta) Release date: 2025-10-28 Highlights: - Packet-level optional integration: - Aegis attempts to detect ProtocolLib at runtime (no compile-time dependency). - If ProtocolLib is present, additional packet-level heuristics can be plugged in for better AimAssist/AutoBlock detection (implementation placeholder — operators with ProtocolLib may extend with packet listeners). - Ping-aware thresholds: - Configurable ping-scaling that relaxes thresholds for high-ping players to drastically reduce false positives. - Base and max ping and a scale-factor allow operators to tune behavior per network conditions. - Safety-first defaults: - enforcement-mode: monitor|warn|enforce (default: monitor). In monitor mode Aegis only logs and sends soft confirmations; never kicks/bans. - Kick and ban are disabled by default; operators must explicitly enable enforcement and tune weighting thresholds. - False-positive reduction improvements: - Larger Timer sample windows, stricter mean/stddev checks. - Confirmation streak increases for sensitive detections (AimAssist, Timer, VClip, etc.). - Environment filters: skip checks while gliding, in vehicles, in liquids, or when bypass perms are present. - Multi-factor confirmation: many detections require multiple complementary signals to escalate. - New & improved detections: - Robust Timer, AimAssist, VelocitySpoof (AntiKB), VClip, AutoBlock (heuristic), AutoTool, AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, Fly, Speed, Spider, Jesus, Phase, Elytra, FastPlace, FastBow, FastConsume. - Diagnostics: - /aegis info <player>, /aegis dumpflags, violations.log - Soft violations are recorded in monitor mode with small weights so admins can tune safely. - Operational guidance: - Run in monitor mode on staging for 48–72 hours, gather logs and /aegis info outputs, then tune streaks and weights. - For highest precision, integrate packet-level listeners (ProtocolLib or custom NMS hooks). - Robustness: - Null safety, thread-safe collections, all enforcement (kicks/bans) executed on main thread; webhooks async. Notes for operators: - ProtocolLib is optional: install it on your server if you want packet-level precision; Aegis will detect it automatically. - Configure ping-scaling based on your player base network conditions. - Keep enforcement-mode in monitor until you validate the logs. If you want, I can: - Add sample ProtocolLib-based packet listeners (as an optional separate module) to detect packet-level swings/blocks/packets for AimAssist and AutoBlock — this requires adding ProtocolLib plugin on your server. - Provide a tuning guide with recommended starting adjustments for specific false positives you find in logs.

## 2.7 — Release (safety-first, major) Release date: 2025-10-28 Summary: - This release focuses on being a "bomb" in quality: broad detection coverage while making it virtually impossible for normal players to be kicked or banned by default. - Default mode is "monitor": no kicks, no bans, only logging and admin alerts. Operators must intentionally switch to "warn" or "enforce" after staging validation. Key changes and additions: 1. Enforcement modes: - enforcement-mode: monitor | warn | enforce - Default: monitor (collect data and alerts; NEVER kick) - warn: admins alerted strongly; minimal enforcement when clear. - enforce: active enforcement according to configured thresholds (use only after staging). 2. New/Enhanced detections: - Timer: robust mean/stddev + environment checks + long sample sizes + heavy confirmation streaks. - AimAssist: low-variance yaw/pitch analysis around hits; requires multiple confirmations. - VelocitySpoof / AntiKB: detects missing/altered knockback reliably with delayed checks. - VClip: vertical teleport/clipping detection with confirmation streaks. - AutoBlock (heuristic), AutoTool, AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, FastBow, FastConsume, FastPlace, Fly, Speed, Spider, Jesus, Phase, Elytra. - Added AutoTool and AutoBlock heuristics; note these are approximations without packet-level integration. 3. False positive reduction: - Confirmation streaks per-check (configurable). - Multi-factor confirmation (e.g., AimAssist + Reach or CPS). - Environment filters (skip checks while gliding, inside vehicles, in liquids, during teleports, or when bypass perms exist). - Conservative default thresholds and longer sample windows. - Soft monitoring mode: MONITOR adds "soft" weights and only logs/alerts unless mode changed to WARN/ENFORCE. 4. Diagnostics & administration: - /aegis info <player> prints score, flags, streaks, client brand, last teleport time. - /aegis dumpflags lists currently flagged players. - violations.log for persistent audit logging. - Optional Discord webhook notifications. 5. Persistence: - Kick counts persisted in config; by default bans disabled to avoid accidental permanent bans. 6. Safety and operational guidance: - Deploy to a staging server in monitor mode for 48-72 hours. - Collect violations.log and use /aegis info to inspect players flagged in monitor mode. - Tune streak and weight values before switching to warn/enforce. - For highest fidelity (especially AimAssist/AutoBlock), consider packet-level integration (Protocollib or custom NMS hooks). 7. Developer notes: - All kicks/bans are executed on the main server thread. - Webhook calls are async. - Code prioritizes null-safety and thread-safe collections. Recommended next steps for operators: - Run in monitor mode for 48–72 hours, exercise typical gameplay (walking, sprinting, parkour, mining, PVP, elytra), and produce logs. - Share suspicious logs or /aegis info outputs if tuning suggestions are needed. - Move to warn mode for a trial period before enforce, and keep automated bans disabled unless you have high confidence. Thank you for using AegisAC. This release aims to be powerful and safe — it is designed so normal players will not be kicked/banned by default.

## 2.6-alpha — Release (alpha) Major objectives: - Expand detection coverage and reduce false positives. - Provide richer diagnostics for tuning and debugging. - Keep enforcement conservative by default; require sustained confirmations before punitive actions. What's new: - New detections: - AimAssist (heuristic using low-variance yaw/pitch changes around hits). - VelocitySpoof (detects missing or altered knockback behavior). - VClip (suspicious vertical teleport-like movement). - AutoBlock and AutoTool (heuristic detection for automated blocking and automatic tool switching). - AntiKB (checks for missing expected knockback). - AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, Timer, Fly, Speed, Spider, Jesus, Phase, Elytra, FastPlace, FastBow, FastConsume. - Timer detection redesigned: - Uses per-interval mean & standard deviation across multiple samples. - Requires environment checks (no gliding, not in vehicle, low horizontal speed). - Requires confirmation streaks before marking a violation. - Confirmation streak system: - Each check must be sustained for a configurable number of confirmations (streak.*) before triggering a violation. - Streaks decay over time to avoid stale state. - Diagnostics: - /aegis info <player> prints current score, flags, streaks and client brand to help tuning. - Safety-first enforcement: - Raised flag/kick thresholds by default. - Kicks and bans require multiple flags; persistent kick-counts are stored in config. - Logging & webhook: - violations.log for auditing; optional Discord webhook support for admin notifications. - Robustness: - Null-safety, thread-safe collections, all kicks/bans run on the main thread. - Config-driven weights and thresholds for easy tuning. - Recommended flow: - Deploy to staging with verbose logging for 24–72 hours. - Use /aegis info and violations.log to tune per-check streaks and weights. - Gradually lower thresholds if you confirm stable detection results. Notes: - This is an alpha release: additional tuning will be required for specific server setups, plugins, and playstyles. - If you need packet-level precision (to reduce false positives further), integrating a protocol-level listener or hooking into a networking library is recommended (not included here to keep compatibility).

## 2.5-beta — Release (beta) - Focus: Safety-first anti-cheat improvements to minimize false positives for normal players. - New detections: - AimAssist: heuristic detection using low-variance aim changes during hits; requires multi-confirmation before action. - VelocitySpoof: detects inconsistent or missing knockback responses with confirmation streaks. - VClip: detects suspicious vertical teleport-like movement not explainable by normal gameplay. - Timer detection upgraded: - Uses per-interval mean + standard deviation. - Requires sustained deviation + low variance and environment filters (no gliding, no vehicle, low horizontal speed). - Confirmation streaks required before applying full violation. - Global confirmation-streak system introduced: - Many checks now require multiple confirmations (configurable) before committing a violation and adding weight. - Decay reduces streaks over time to avoid stale confirmations. - Conservative enforcement: - Raised score thresholds and number of flags required to kick/ban. - Default behavior ensures normal players are not kicked/banned; intended for staging validation and tuning. - Added diagnostics command: /aegis info <player> (shows score, flags, streaks, client). - Client-brand join alerts retained; webhook integration async and optional. - Persistence: kick counts saved in config; bans take effect only after multiple kicks as configured. - Continued hardening: null-safety, thread-safe collections, safe main-thread kicks/bans and async webhook calls. - Recommended: deploy to staging, gather logs for 24–72 hours, use /aegis info to assist tuning, then adjust streaks/weights.

## 2.4-alpha — Release (alpha) - Primary goal: dramatically reduce false positives so normal players will not be kicked or banned. - Timer detection rewritten: - Uses per-interval mean and standard deviation on move events. - Flags only when mean deviates from expected tick (50 ms) AND variance is low (consistent timing). - Requires multiple confirmation streaks to declare a violation. - Skips Timer check in noisy environments (gliding, in vehicle, in liquid, moving fast, bypass perms). - Global confirmation streak system added: - Many checks now require sustained confirmations (configurable per-check 'streak.*') before committing a flag. - This reduces single-spike false positives caused by lag, teleport, or normal gameplay. - Raised conservative thresholds and required more flags/kicks before punitive actions (kicks/bans). - Added more refined FastBreak / Nuker handling and tuned weights to be conservative. - Added client-brand join alerts and retained async webhook support for flags, kicks and joins. - Improved null-safety, thread-safety and persisted kick counts are retained. - Recommended: run on staging, collect logs for a day, tune streak thresholds and weights before enabling on production. Notes: - This is an alpha focused on safety (avoid false positives). It is intended for server operators to test and tune. - If you want, I will add a /aegis info <player> diagnostics command that prints current score, flags, check streaks and last-detected client to help tuning.

## 2.3 — Release (full) - Improved Timer detection to dramatically reduce false positives: - Timer now computes per-interval mean and standard deviation. - Flags only when the mean deviates from 50ms by a configurable threshold AND intervals are consistently low-variance. - Timer check is skipped if the player is gliding, in vehicle, in liquid, moving fast, or has bypass permissions. - Conservative defaults (more samples, larger mean threshold, small stddev threshold) to avoid flagging normal walking. - Consolidated and corrected all detection logic; addressed prior compilation/runtime issues. - Added reliable client-brand detection and admin join alerts (minecraft:brand / MC|Brand). - Implemented FastBreak (short-window) vs Nuker (long-window) distinction. - Weighted, decay-based multi-check flagging system; kicks scheduled on main thread. - Persistent kick counts with configurable automatic bans (default 3 kicks -> 3 days). - Async Discord webhook integration for flags, kicks and joins (configurable). - Conservative default thresholds; strong null-safety, thread-safe collections, safe I/O. - Recommended: deploy to a staging server and tune thresholds before production.

- Consolidated release: merged client-brand join alerts, FastBreak detection, persistent kick-counts and ban policy, and many refined detectors. - Added client-brand detection via plugin channels and configurable admin join alerts (e.g., "[AegisAC] player joined using Fabric"). - FastBreak detection: short-window detection for rapid single-player block breaking, distinct from Nuker (long-window). - Persistent kick counts saved to config and configurable automatic bans after repeated kicks (default: 3 kicks → 3-day ban). - Maintained weighted, decay-based multi-check flagging, conservative defaults, and admin/bypass exemptions. - Discord webhook support for flags, kicks and joins (async, configurable). - Robustness: thread-safe collections, safe file IO, main-thread kicks/bans, and fixes for prior enum/API issues. - Recommended: test on staging and tune thresholds to your server's conditions and player latency profile.

## 2.1-beta — Release - Added FastBreak detection to identify rapid single-player block-breaking behavior (short-window detection). - Improved distinction between FastBreak and Nuker (short vs long windows) to reduce false positives. - Tuned weights and conserved multi-check flagging and decay to keep normal players safe. - Persistent kick tracking and ban policy remain (configurable: default 3 kicks -> 3-day ban). - Continued improvements in movement, phase, spider, jesus, autoarmor, autoclicker, fastbow, fastconsume, elytra and timer detections. - Reliable kicks and bans run on the main thread; webhook notifications asynchronous and optional. - Recommended: deploy to staging and tune thresholds based on your server's latency and gameplay.

## 2.0 — Release - Implemented persistent kick-count tracking and automatic ban after repeated kicks. - Default policy: 3 kicks => 3-day ban for reason "Unfair Advantage". - Kick counts are persisted in config under `kick-counts` and survive restarts. - Added administrative command: /aegis resetkicks <player> to reset a player's persistent kick count. - Maintained and improved previous detections (Spider, Jesus, AutoArmor, AutoTotem, NoFall, Nuker, AutoClicker, FastBow, FastConsume, Phase, Timer, Elytra). - Ensured all kicks and bans are executed on the main server thread; respects admin and kick-exempt permissions. - Discord webhook support for flags and kicks remains configurable and asynchronous. - Conservative defaults and multi-check weighted flagging retained to reduce false positives. Tune config.yml on a staging server before production. - General robustness: thread-safe maps, robust null-checks, immediate persistence of kick counts, and safe logging.

## 1.9-beta — Release - Expanded detection coverage: Spider (wall-climb), Jesus/Waterwalk, Phase (no-clip), Timer (tickrate manipulation), Elytra speed detection, and improvements to AutoArmor, AutoTotem, NoFall, Nuker, AutoClicker, FastBow, FastConsume. - Hardened movement checks: speed measured as blocks-per-second; fly/airplace logic refined to reduce false positives. - Improved phase/no-clip detection and mitigations to prevent large-scale griefing. - Kicks are reliable and performed on the main thread; admin and kick-exempt permissions respected. - Discord webhook support for flags and kicks (async). - Retained weighted multi-check flagging and decay-based scoring to minimize false positives; conservative default thresholds. - Thread-safe state, separate action-specific tracking maps, robust null-safety, and detailed logging.