Anti-Cheat System

The Enemy Masses Anti-Cheat System provides server-side protection against common multiplayer cheats in RTS games. This guide covers configuration, integration with Netcode for GameObjects 2.7.0, and building custom admin tools.

Naming Note: The component appears as "Anti-Cheat Manager" in the Unity Inspector and Add Component menu, but the C# class is named AntiCheatComponent. They refer to the same component.

Context	Name
Unity Inspector	Anti-Cheat Manager
Add Component Menu	Enemy Masses/Networking/Anti-Cheat Manager
C# Class	AntiCheatComponent
Namespace	Arawn.EnemyMasses.Runtime.Networking

---

Should You Use It?

✅ When to Use

Scenario	Reason
Competitive Multiplayer	Ranked matches need protection
Authoritative Server	Server validates all actions
PvP Games	Players gain advantage by cheating
Games with Economy	Cheating devalues items/currency
Free-to-Play	Higher cheat motivation

❌ When NOT to Use

Scenario	Reason
Single-Player Only	No cheaters to protect against
Co-op Only	Cheating only affects the cheater
Client-Authoritative	Anti-cheat requires server validation
Prototype/Testing	Adds complexity during development
Trusted LAN Play	Friends rarely cheat

---

Architecture Overview

┌─────────────────────────────────────────────────────────────┐
│                   AntiCheatComponent                        │
│                   (MonoBehaviour)                           │
├─────────────────────────────────────────────────────────────┤
│                                                             │
│  ┌─────────────────┐  ┌─────────────────┐                  │
│  │ DamageValidator │  │CommandValidator │                  │
│  │ - DPS limiting  │  │ - Rate limiting │                  │
│  │ - Range checks  │  │ - Ownership     │                  │
│  └─────────────────┘  └─────────────────┘                  │
│                                                             │
│  ┌─────────────────┐  ┌─────────────────┐                  │
│  │SpeedHackDetector│  │ Reconciliation  │                  │
│  │ - Velocity      │  │ - State sync    │                  │
│  │ - Teleport      │  │ - Corrections   │                  │
│  └─────────────────┘  └─────────────────┘                  │
│                                                             │
│  ┌─────────────────────────────────────────────────────┐   │
│  │              Suspicion Tracking                      │   │
│  │  Per-player suspicion scores with decay              │   │
│  └─────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────┘

What It Detects

Cheat Type	What It Does	How We Detect It
Speed Hack	Move units faster than allowed	Velocity monitoring
Teleport Hack	Instantly move units	Distance-per-frame checks
Damage Hack	Deal more damage than possible	DPS and per-hit limits
God Mode	Take no damage	Health reconciliation
Command Flooding	Send thousands of commands	Rate limiting
Ownership Violation	Control other players' units	Ownership validation
Range Hack	Attack from across the map	Distance calculations

Graduated Response System

The anti-cheat uses a suspicion score instead of instant bans:

Detection → Suspicion +X → Decay over time → Threshold → Flagged

This prevents false positives from network lag or edge cases.

---

Quick Start

1. Add the Component

Option A: Menu

GameObject → Enemy Masses → Anti-Cheat Manager

Option B: Code

var go = new GameObject("AntiCheatManager");
var antiCheat = go.AddComponent<AntiCheatComponent>();

2. Choose a Preset

Preset	Suspicion Threshold	Speed Tolerance	Best For
Default	5.0	1.5x	Most games
Strict	3.0	1.2x	Competitive/ranked
Lenient	10.0	2.0x	Casual/co-op
Custom	Your choice	Your choice	Fine-tuning

3. Access at Runtime

// Singleton access
var antiCheat = AntiCheatComponent.Instance;

// Subscribe to events
var manager = antiCheat.GetRuntimeManager();
manager.OnPlayerFlaggedAsCheater += HandleCheater;

void HandleCheater(int playerId)
{
    Debug.LogWarning($"Player {playerId} flagged!");
    KickPlayer(playerId);
}

---

NGO 2.7.0 Integration

Server-Only Initialization

using Unity.Netcode;
using UnityEngine;
using Arawn.EnemyMasses.Runtime.Networking;

public class ServerAntiCheat : NetworkBehaviour
{
    private AntiCheatComponent _antiCheat;

    public override void OnNetworkSpawn()
    {
        base.OnNetworkSpawn();
        
        // Only enable on server
        _antiCheat = GetComponent<AntiCheatComponent>();
        if (_antiCheat != null)
        {
            _antiCheat.enabled = IsServer;
        }
        
        if (IsServer)
        {
            var manager = _antiCheat.GetRuntimeManager();
            manager.OnPlayerFlaggedAsCheater += OnPlayerFlagged;
            manager.OnCheatDetected += OnCheatDetected;
        }
    }

    private void OnPlayerFlagged(int playerId)
    {
        // Kick the player using NGO 2.7.0 API
        NetworkManager.Singleton.ConnectionManager.DisconnectClient(
            (ulong)playerId, 
            "Suspicious activity detected"
        );
    }

    private void OnCheatDetected(int playerId, CheatType type, string details, float severity)
    {
        Debug.Log($"[AntiCheat] Player {playerId}: {type} ({severity:P0}) - {details}");
    }
}

Validating Damage RPCs

using Unity.Netcode;
using UnityEngine;
using Arawn.EnemyMasses.Runtime.Networking;

public class NetworkDamageHandler : NetworkBehaviour
{
    [Rpc(SendTo.Server)]
    public void RequestDamageRpc(uint attackerId, uint targetId, float damage, 
        Vector3 hitPoint, RpcParams rpcParams = default)
    {
        int playerId = (int)rpcParams.Receive.SenderClientId;
        
        // Validate through anti-cheat
        var validator = AntiCheatComponent.Instance?.DamageValidator;
        if (validator != null)
        {
            var result = validator.ValidateDamage(
                playerId, 
                targetId, 
                damage, 
                hitPoint
            );
            
            if (!result.isValid)
            {
                Debug.LogWarning($"[AntiCheat] Damage rejected from {playerId}: {result.reason}");
                return;
            }
            
            // Use validated damage amount (may be clamped)
            damage = result.validatedDamage;
        }
        
        // Process valid damage
        ApplyDamageRpc(targetId, damage, hitPoint);
    }

    [Rpc(SendTo.NotServer)]
    private void ApplyDamageRpc(uint targetId, float damage, Vector3 hitPoint)
    {
        var controller = FindFirstObjectByType<EnemyMassesCrowdController>();
        var agent = controller?.GetAgentByNetworkId(targetId);
        agent?.TakeDamage(damage);
    }
}

Validating Command RPCs

[Rpc(SendTo.Server)]
public void RequestMoveCommandRpc(uint[] agentIds, Vector3 destination, 
    RpcParams rpcParams = default)
{
    int playerId = (int)rpcParams.Receive.SenderClientId;
    
    // Validate through anti-cheat
    var validator = AntiCheatComponent.Instance?.CommandValidator;
    if (validator != null)
    {
        var result = validator.ValidateMoveCommand(
            playerId,
            agentIds,
            destination,
            ValidateOwnership
        );
        
        if (result != CommandRejectReason.None)
        {
            Debug.LogWarning($"[AntiCheat] Command rejected from {playerId}: {result}");
            return;
        }
    }
    
    // Execute valid command
    BroadcastMoveCommandRpc(agentIds, destination);
}

private bool ValidateOwnership(uint networkId, int playerId)
{
    var controller = FindFirstObjectByType<EnemyMassesCrowdController>();
    var agent = controller?.GetAgentByNetworkId(networkId);
    return agent != null && agent.ownerPlayerId == playerId;
}

[Rpc(SendTo.NotServer)]
private void BroadcastMoveCommandRpc(uint[] agentIds, Vector3 destination)
{
    // Apply movement on all clients
}

---

Configuration Reference

Suspicion Settings

Property	Default	Description
suspicionThreshold	5.0	Score that triggers cheater flag
suspicionDecayRate	0.1	Points decayed per second

Damage Validation

Property	Default	Description
maxDamagePerHit	500	Maximum single-hit damage
maxDPS	300	Maximum damage per second
maxAttackRange	25	Maximum attack distance

Speed Detection

Property	Default	Description
speedTolerance	1.5	Multiplier over max speed
speedViolationThreshold	5	Violations before flagging
teleportThreshold	50	Distance considered a teleport

Command Validation

Property	Default	Description
maxCommandsPerSecond	30	Rate limit per player
maxAgentsPerCommand	200	Max agents in one command

Reconciliation

Property	Default	Description
reconciliationInterval	1.0	Seconds between state snapshots
enableDeltaCompression	true	Only send changed fields

---

API Reference

AntiCheatComponent

Properties

// Singleton instance
public static AntiCheatComponent Instance { get; }

// Is the system initialized?
public bool IsInitialized { get; }

// Current suspicion threshold
public float SuspicionThreshold { get; }

// Access subsystems
public NetworkDamageValidator DamageValidator { get; }
public NetworkCommandValidator CommandValidator { get; }
public SpeedHackDetector SpeedDetector { get; }
public StateReconciliationSystem ReconciliationSystem { get; }

Methods

// Get current statistics
public AntiCheatStatistics GetStatistics();

// Get all player suspicion levels
public Dictionary<int, float> GetAllSuspicionLevels();

// Reset suspicion for a player
public void ResetPlayerSuspicion(int playerId);

// Manually flag a player
public void FlagPlayer(int playerId);

// Reset all statistics
public void ResetStatistics();

// Reset everything (between matches)
public void ResetAll();

Events

var manager = antiCheat.GetRuntimeManager();

// Fired when any cheat is detected
manager.OnCheatDetected += (int playerId, CheatType type, string details, float severity) =>
{
    Debug.Log($"Player {playerId}: {type} - {details}");
};

// Fired when suspicion level changes
manager.OnSuspicionLevelChanged += (int playerId, float newLevel) =>
{
    UpdatePlayerUI(playerId, newLevel);
};

// Fired when a player exceeds the threshold
manager.OnPlayerFlaggedAsCheater += (int playerId) =>
{
    KickPlayer(playerId);
};

AntiCheatStatistics

public struct AntiCheatStatistics
{
    // Summary
    public int totalDetections;
    public int playersFlagged;
    public int playersTracked;
    
    // Per-type breakdown
    public Dictionary<CheatType, int> detectionsByType;
    
    // Damage validation
    public int damageChecks;
    public int damageRejections;
    public float damageRejectRate;
    
    // Command validation
    public int commandChecks;
    public int commandRejections;
    public float commandRejectRate;
    
    // Speed detection
    public int movementChecks;
    public int speedViolations;
    public int teleportDetections;
    
    // State reconciliation
    public int snapshotsSent;
    public int reconciliationsApplied;
    public int urgentReconciliations;
}

CheatType Enum

public enum CheatType
{
    SpeedHack,
    Teleport,
    DamageHack,
    GodMode,
    CommandFlooding,
    OwnershipViolation,
    RangeHack,
    AttackSpeedHack,
    Suspicious,
    Unknown
}

---

Building Admin Panels

In-Game Dashboard Example

using UnityEngine;
using UnityEngine.UI;
using TMPro;
using Unity.Netcode;
using Arawn.EnemyMasses.Runtime.Networking;
using System.Linq;

public class AntiCheatDashboard : NetworkBehaviour
{
    [Header("UI References")]
    public TMP_Text totalDetectionsText;
    public TMP_Text flaggedPlayersText;
    public Transform playerListContainer;
    public GameObject playerRowPrefab;

    [Header("Settings")]
    public float refreshInterval = 1f;

    private AntiCheatComponent _antiCheat;
    private float _lastRefresh;

    public override void OnNetworkSpawn()
    {
        // Only server can view anti-cheat data
        if (!IsServer)
        {
            gameObject.SetActive(false);
            return;
        }

        _antiCheat = AntiCheatComponent.Instance;
        
        if (_antiCheat != null)
        {
            var manager = _antiCheat.GetRuntimeManager();
            manager.OnCheatDetected += OnCheatDetected;
            manager.OnPlayerFlaggedAsCheater += OnPlayerFlagged;
        }
    }

    void Update()
    {
        if (!IsServer || _antiCheat == null) return;

        if (Time.time - _lastRefresh >= refreshInterval)
        {
            _lastRefresh = Time.time;
            RefreshDashboard();
        }
    }

    void RefreshDashboard()
    {
        var stats = _antiCheat.GetStatistics();
        
        totalDetectionsText.text = stats.totalDetections.ToString();
        flaggedPlayersText.text = stats.playersFlagged.ToString();
        
        RefreshPlayerList();
    }

    void RefreshPlayerList()
    {
        foreach (Transform child in playerListContainer)
            Destroy(child.gameObject);

        var suspicionLevels = _antiCheat.GetAllSuspicionLevels();
        float threshold = _antiCheat.SuspicionThreshold;

        foreach (var kvp in suspicionLevels.OrderByDescending(x => x.Value))
        {
            var row = Instantiate(playerRowPrefab, playerListContainer);
            var rowUI = row.GetComponent<PlayerSuspicionRow>();
            
            rowUI.Setup(
                playerId: kvp.Key,
                suspicion: kvp.Value,
                threshold: threshold,
                onKick: () => KickPlayer(kvp.Key),
                onReset: () => _antiCheat.ResetPlayerSuspicion(kvp.Key)
            );
        }
    }

    void KickPlayer(int playerId)
    {
        NetworkManager.Singleton.ConnectionManager.DisconnectClient(
            (ulong)playerId, 
            "Removed by admin"
        );
    }

    void OnCheatDetected(int playerId, CheatType type, string details, float severity)
    {
        RefreshDashboard();
    }

    void OnPlayerFlagged(int playerId)
    {
        // Auto-kick flagged players (optional)
        // KickPlayer(playerId);
    }
}

Player Row UI Component

using UnityEngine;
using UnityEngine.UI;
using TMPro;
using System;

public class PlayerSuspicionRow : MonoBehaviour
{
    public TMP_Text playerIdText;
    public TMP_Text suspicionText;
    public Image suspicionBar;
    public Button kickButton;
    public Button resetButton;

    public void Setup(int playerId, float suspicion, float threshold,
        Action onKick, Action onReset)
    {
        playerIdText.text = $"Player {playerId}";
        suspicionText.text = $"{suspicion:F1} / {threshold:F0}";

        float ratio = Mathf.Clamp01(suspicion / threshold);
        suspicionBar.fillAmount = ratio;
        suspicionBar.color = ratio < 0.5f ? Color.green :
                            ratio < 0.8f ? Color.yellow : Color.red;

        kickButton.onClick.AddListener(() => onKick?.Invoke());
        resetButton.onClick.AddListener(() => onReset?.Invoke());
    }
}

Server Console Commands

using UnityEngine;
using Unity.Netcode;
using Arawn.EnemyMasses.Runtime.Networking;
using System.Linq;

public class AntiCheatCommands : MonoBehaviour
{
    public void HandleCommand(string command, string[] args)
    {
        var antiCheat = AntiCheatComponent.Instance;
        if (antiCheat == null)
        {
            Log("AntiCheat not initialized");
            return;
        }

        switch (command.ToLower())
        {
            case "ac_stats":
                PrintStatistics(antiCheat);
                break;
                
            case "ac_players":
                PrintPlayerList(antiCheat);
                break;
                
            case "ac_kick":
                if (args.Length > 0 && int.TryParse(args[0], out int kickId))
                {
                    NetworkManager.Singleton.ConnectionManager.DisconnectClient(
                        (ulong)kickId, "Kicked by admin");
                    Log($"Kicked player {kickId}");
                }
                break;
                
            case "ac_reset":
                if (args.Length > 0 && int.TryParse(args[0], out int resetId))
                {
                    antiCheat.ResetPlayerSuspicion(resetId);
                    Log($"Reset suspicion for player {resetId}");
                }
                break;
                
            case "ac_clear":
                antiCheat.ResetStatistics();
                Log("Statistics cleared");
                break;
        }
    }

    void PrintStatistics(AntiCheatComponent antiCheat)
    {
        var stats = antiCheat.GetStatistics();
        Log("=== Anti-Cheat Statistics ===");
        Log($"Total Detections: {stats.totalDetections}");
        Log($"Players Flagged: {stats.playersFlagged}");
        Log($"Damage Reject Rate: {stats.damageRejectRate:P1}");
        Log($"Command Reject Rate: {stats.commandRejectRate:P1}");
    }

    void PrintPlayerList(AntiCheatComponent antiCheat)
    {
        var levels = antiCheat.GetAllSuspicionLevels();
        float threshold = antiCheat.SuspicionThreshold;
        
        Log($"=== Player Suspicion (threshold: {threshold}) ===");
        foreach (var kvp in levels.OrderByDescending(x => x.Value))
        {
            string status = kvp.Value >= threshold ? "[FLAGGED]" : "";
            Log($"  Player {kvp.Key}: {kvp.Value:F1} {status}");
        }
    }

    void Log(string message) => Debug.Log($"[AC] {message}");
}

---

Responding to Cheaters

Graduated Response Pattern

var manager = antiCheat.GetRuntimeManager();

manager.OnSuspicionLevelChanged += (playerId, level) =>
{
    float threshold = AntiCheatComponent.Instance.SuspicionThreshold;
    float percentage = level / threshold;
    
    if (percentage > 0.5f && percentage < 0.8f)
    {
        SendWarningRpc(playerId, "Suspicious activity detected");
    }
    else if (percentage >= 0.8f)
    {
        SendWarningRpc(playerId, "Final warning - further violations will result in removal");
    }
};

manager.OnPlayerFlaggedAsCheater += (playerId) =>
{
    LogIncident(playerId);
    NetworkManager.Singleton.ConnectionManager.DisconnectClient(
        (ulong)playerId,
        "Removed for suspicious activity"
    );
};

Logging for Review

manager.OnCheatDetected += (playerId, type, details, severity) =>
{
    var incident = new CheatIncident
    {
        PlayerId = playerId,
        Type = type.ToString(),
        Details = details,
        Severity = severity,
        Timestamp = System.DateTime.UtcNow,
        MatchId = currentMatchId
    };
    
    // Save to your backend
    SaveToDatabase(incident);
    
    // Optional: Send to analytics
    Analytics.CustomEvent("cheat_detected", new Dictionary<string, object>
    {
        { "player_id", playerId },
        { "cheat_type", type.ToString() },
        { "severity", severity }
    });
};

---

Performance Considerations

Validation Overhead

Operation	Overhead
Damage validation	~0.01ms per check
Command validation	~0.02ms per command
Speed detection	~0.01ms per update
State reconciliation	~0.1ms per snapshot

Optimization Tips

// 1. Server-only - disable on clients
public override void OnNetworkSpawn()
{
    if (!IsServer)
    {
        GetComponent<AntiCheatComponent>().enabled = false;
        return;
    }
}

// 2. Disable in development
#if DEVELOPMENT_BUILD || UNITY_EDITOR
    antiCheat.enabled = false;
#endif

// 3. Adjust for large player counts (50+)
// - Use Lenient preset
// - Increase reconciliationInterval to 2.0+

---

Troubleshooting

High False Positive Rate

Symptoms: Legitimate players getting flagged

Solutions:

1. Use Lenient preset

2. Increase speedTolerance to 2.0+

3. Increase suspicionThreshold to 10+

4. Network lag may cause position jumps — increase tolerances

Cheaters Not Detected

Symptoms: Obvious cheaters slip through

Solutions:

1. Use Strict preset

2. Decrease suspicionThreshold to 3

3. Lower speedTolerance to 1.2

4. Verify anti-cheat is enabled on server

Performance Issues

Symptoms: Server lag with anti-cheat enabled

Solutions:

1. Increase reconciliationInterval to 2.0+

2. Ensure anti-cheat is server-only

3. Reduce unit counts or command frequency

---

Best Practices

✅ Do	❌ Don't
Enable only on server	Run validation on clients
Start with Default preset	Jump to Strict without testing
Log incidents before punishing	Auto-ban on first detection
Warn players before kicking	Instantly remove players
Reset between matches	Carry suspicion across sessions
Combine with server authority	Rely solely on anti-cheat
Review logs for false positives	Assume all detections are valid

---

Editor Tools

Anti-Cheat Monitor Window

Access via: Tools → Enemy Masses → Network → Anti-Cheat Monitor

Features:

• Real-time statistics

• Per-player suspicion levels

• Detection log

• Quick actions (reset, flag, kick)

Debug Logging

Enable in Inspector to see detections in Console:

// In AntiCheatComponent Inspector: Enable Logging = true

Test Mode

#if UNITY_EDITOR
var manager = antiCheat.GetRuntimeManager();
manager.RegisterCheatDetection(
    playerId: 1,
    type: CheatType.SpeedHack,
    severity: 0.5f,
    details: "Test detection"
);
#endif

---

See Also

• Networking Overview - How Enemy Masses networking works

• NGO Integration Guide - Full NGO 2.7.0 setup

• Local Network Authority - Testing without real networking