Aegis AntiCheat

2.8-beta — Release (beta)

Release date: 2025-10-28

Highlights:

• Packet-level optional integration:
  • Aegis attempts to detect ProtocolLib at runtime (no compile-time dependency).
  • If ProtocolLib is present, additional packet-level heuristics can be plugged in for better AimAssist/AutoBlock detection (implementation placeholder — operators with ProtocolLib may extend with packet listeners).
• Ping-aware thresholds:
  • Configurable ping-scaling that relaxes thresholds for high-ping players to drastically reduce false positives.
  • Base and max ping and a scale-factor allow operators to tune behavior per network conditions.
• Safety-first defaults:
  • enforcement-mode: monitor|warn|enforce (default: monitor). In monitor mode Aegis only logs and sends soft confirmations; never kicks/bans.
  • Kick and ban are disabled by default; operators must explicitly enable enforcement and tune weighting thresholds.
• False-positive reduction improvements:
  • Larger Timer sample windows, stricter mean/stddev checks.
  • Confirmation streak increases for sensitive detections (AimAssist, Timer, VClip, etc.).
  • Environment filters: skip checks while gliding, in vehicles, in liquids, or when bypass perms are present.
  • Multi-factor confirmation: many detections require multiple complementary signals to escalate.
• New & improved detections:
  • Robust Timer, AimAssist, VelocitySpoof (AntiKB), VClip, AutoBlock (heuristic), AutoTool, AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, Fly, Speed, Spider, Jesus, Phase, Elytra, FastPlace, FastBow, FastConsume.
• Diagnostics:
  • /aegis info , /aegis dumpflags, violations.log
  • Soft violations are recorded in monitor mode with small weights so admins can tune safely.
• Operational guidance:
  • Run in monitor mode on staging for 48–72 hours, gather logs and /aegis info outputs, then tune streaks and weights.
  • For highest precision, integrate packet-level listeners (ProtocolLib or custom NMS hooks).
• Robustness:
  • Null safety, thread-safe collections, all enforcement (kicks/bans) executed on main thread; webhooks async.

Notes for operators:

• ProtocolLib is optional: install it on your server if you want packet-level precision; Aegis will detect it automatically.
• Configure ping-scaling based on your player base network conditions.
• Keep enforcement-mode in monitor until you validate the logs.

If you want, I can:

• Add sample ProtocolLib-based packet listeners (as an optional separate module) to detect packet-level swings/blocks/packets for AimAssist and AutoBlock — this requires adding ProtocolLib plugin on your server.
• Provide a tuning guide with recommended starting adjustments for specific false positives you find in logs.

2.7 — Release (safety-first, major)

Release date: 2025-10-28

Summary:

• This release focuses on being a "bomb" in quality: broad detection coverage while making it virtually impossible for normal players to be kicked or banned by default.
• Default mode is "monitor": no kicks, no bans, only logging and admin alerts. Operators must intentionally switch to "warn" or "enforce" after staging validation.

Key changes and additions:

1. Enforcement modes:

   • enforcement-mode: monitor | warn | enforce
   • Default: monitor (collect data and alerts; NEVER kick)
   • warn: admins alerted strongly; minimal enforcement when clear.
   • enforce: active enforcement according to configured thresholds (use only after staging).

2. New/Enhanced detections:

   • Timer: robust mean/stddev + environment checks + long sample sizes + heavy confirmation streaks.
   • AimAssist: low-variance yaw/pitch analysis around hits; requires multiple confirmations.
   • VelocitySpoof / AntiKB: detects missing/altered knockback reliably with delayed checks.
   • VClip: vertical teleport/clipping detection with confirmation streaks.
   • AutoBlock (heuristic), AutoTool, AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, FastBow, FastConsume, FastPlace, Fly, Speed, Spider, Jesus, Phase, Elytra.
   • Added AutoTool and AutoBlock heuristics; note these are approximations without packet-level integration.

3. False positive reduction:

   • Confirmation streaks per-check (configurable).
   • Multi-factor confirmation (e.g., AimAssist + Reach or CPS).
   • Environment filters (skip checks while gliding, inside vehicles, in liquids, during teleports, or when bypass perms exist).
   • Conservative default thresholds and longer sample windows.
   • Soft monitoring mode: MONITOR adds "soft" weights and only logs/alerts unless mode changed to WARN/ENFORCE.

4. Diagnostics & administration:

   • /aegis info prints score, flags, streaks, client brand, last teleport time.
   • /aegis dumpflags lists currently flagged players.
   • violations.log for persistent audit logging.
   • Optional Discord webhook notifications.

5. Persistence:

   • Kick counts persisted in config; by default bans disabled to avoid accidental permanent bans.

6. Safety and operational guidance:

   • Deploy to a staging server in monitor mode for 48-72 hours.
   • Collect violations.log and use /aegis info to inspect players flagged in monitor mode.
   • Tune streak and weight values before switching to warn/enforce.
   • For highest fidelity (especially AimAssist/AutoBlock), consider packet-level integration (Protocollib or custom NMS hooks).

7. Developer notes:

   • All kicks/bans are executed on the main server thread.
   • Webhook calls are async.
   • Code prioritizes null-safety and thread-safe collections.

Recommended next steps for operators:

• Run in monitor mode for 48–72 hours, exercise typical gameplay (walking, sprinting, parkour, mining, PVP, elytra), and produce logs.
• Share suspicious logs or /aegis info outputs if tuning suggestions are needed.
• Move to warn mode for a trial period before enforce, and keep automated bans disabled unless you have high confidence.

Thank you for using AegisAC. This release aims to be powerful and safe — it is designed so normal players will not be kicked/banned by default.

2.6-alpha — Release (alpha)

Major objectives:

• Expand detection coverage and reduce false positives.
• Provide richer diagnostics for tuning and debugging.
• Keep enforcement conservative by default; require sustained confirmations before punitive actions.

What's new:

• New detections:
  • AimAssist (heuristic using low-variance yaw/pitch changes around hits).
  • VelocitySpoof (detects missing or altered knockback behavior).
  • VClip (suspicious vertical teleport-like movement).
  • AutoBlock and AutoTool (heuristic detection for automated blocking and automatic tool switching).
  • AntiKB (checks for missing expected knockback).
  • AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, Timer, Fly, Speed, Spider, Jesus, Phase, Elytra, FastPlace, FastBow, FastConsume.
• Timer detection redesigned:
  • Uses per-interval mean & standard deviation across multiple samples.
  • Requires environment checks (no gliding, not in vehicle, low horizontal speed).
  • Requires confirmation streaks before marking a violation.
• Confirmation streak system:
  • Each check must be sustained for a configurable number of confirmations (streak.*) before triggering a violation.
  • Streaks decay over time to avoid stale state.
• Diagnostics:
  • /aegis info prints current score, flags, streaks and client brand to help tuning.
• Safety-first enforcement:
  • Raised flag/kick thresholds by default.
  • Kicks and bans require multiple flags; persistent kick-counts are stored in config.
• Logging & webhook:
  • violations.log for auditing; optional Discord webhook support for admin notifications.
• Robustness:
  • Null-safety, thread-safe collections, all kicks/bans run on the main thread.
  • Config-driven weights and thresholds for easy tuning.
• Recommended flow:
  • Deploy to staging with verbose logging for 24–72 hours.
  • Use /aegis info and violations.log to tune per-check streaks and weights.
  • Gradually lower thresholds if you confirm stable detection results.

Notes:

• This is an alpha release: additional tuning will be required for specific server setups, plugins, and playstyles.
• If you need packet-level precision (to reduce false positives further), integrating a protocol-level listener or hooking into a networking library is recommended (not included here to keep compatibility).

2.5-beta — Release (beta)

• Focus: Safety-first anti-cheat improvements to minimize false positives for normal players.
• New detections:
  • AimAssist: heuristic detection using low-variance aim changes during hits; requires multi-confirmation before action.
  • VelocitySpoof: detects inconsistent or missing knockback responses with confirmation streaks.
  • VClip: detects suspicious vertical teleport-like movement not explainable by normal gameplay.
• Timer detection upgraded:
  • Uses per-interval mean + standard deviation.
  • Requires sustained deviation + low variance and environment filters (no gliding, no vehicle, low horizontal speed).
  • Confirmation streaks required before applying full violation.
• Global confirmation-streak system introduced:
  • Many checks now require multiple confirmations (configurable) before committing a violation and adding weight.
  • Decay reduces streaks over time to avoid stale confirmations.
• Conservative enforcement:
  • Raised score thresholds and number of flags required to kick/ban.
  • Default behavior ensures normal players are not kicked/banned; intended for staging validation and tuning.
• Added diagnostics command: /aegis info (shows score, flags, streaks, client).
• Client-brand join alerts retained; webhook integration async and optional.
• Persistence: kick counts saved in config; bans take effect only after multiple kicks as configured.
• Continued hardening: null-safety, thread-safe collections, safe main-thread kicks/bans and async webhook calls.
• Recommended: deploy to staging, gather logs for 24–72 hours, use /aegis info to assist tuning, then adjust streaks/weights.

2.4-alpha — Release (alpha)

• Primary goal: dramatically reduce false positives so normal players will not be kicked or banned.
• Timer detection rewritten:
  • Uses per-interval mean and standard deviation on move events.
  • Flags only when mean deviates from expected tick (50 ms) AND variance is low (consistent timing).
  • Requires multiple confirmation streaks to declare a violation.
  • Skips Timer check in noisy environments (gliding, in vehicle, in liquid, moving fast, bypass perms).
• Global confirmation streak system added:
  • Many checks now require sustained confirmations (configurable per-check 'streak.*') before committing a flag.
  • This reduces single-spike false positives caused by lag, teleport, or normal gameplay.
• Raised conservative thresholds and required more flags/kicks before punitive actions (kicks/bans).
• Added more refined FastBreak / Nuker handling and tuned weights to be conservative.
• Added client-brand join alerts and retained async webhook support for flags, kicks and joins.
• Improved null-safety, thread-safety and persisted kick counts are retained.
• Recommended: run on staging, collect logs for a day, tune streak thresholds and weights before enabling on production.

Notes:

• This is an alpha focused on safety (avoid false positives). It is intended for server operators to test and tune.
• If you want, I will add a /aegis info diagnostics command that prints current score, flags, check streaks and last-detected client to help tuning.