AI Heuristics Engine

AI Core

Pure Luau in-engine pattern correlation, multi-vector exploit clustering, and real-time security dossier synthesis.

# Overview

Traditional Roblox anti-cheats rely on simplistic binary thresholds: if a player moves $1\text{ stud}$ too fast, they get kicked. This inevitably leads to false positives when players lag or encounter engine physics hitches.

R Anti-Cheat incorporates an In-Game AI-Assisted Heuristics Engine (ServerScriptService/RAC/Services/AIAgent.luau). Built in pure, typed Luau without external API dependencies, it runs directly on the Roblox server to correlate multi-vector incidents, assess confidence scores, evaluate false-positive probability, and generate explainable security intelligence dossiers.

Individual Detectors (Speed, Combat, Remotes, State)
                         │
                         ▼
             DetectionEngine Ingestion
                         │
                         ▼
        ┌───────────────────────────────────┐
        │        AIAgent.AnalyzePlayer      │
        │                                   │
        │  1. Detector & Category Histogram │
        │  2. Behavioral Pattern Matching   │
        │  3. Latency & Ping Dampening      │
        │  4. Confidence Score Calculation  │
        └─────────────────┬─────────────────┘
                          │
                          ▼
            [ AIAnalysisReport Dossier ]
            - Overall Risk: Critical / High / Low
            - Confidence Score: 0 - 100%
            - Suspected Exploit Types
            - False Positive Likelihood
            - Recommended Action: Kick / PermBan

# Analysis Lifecycle

When AIAgent.AnalyzePlayer(player, playerState) is called:

# 1. Telemetry Ingestion & Histogram Indexing

All active violations within the player's session are indexed into a frequency histogram by detector name and category (Movement, Combat, PlayerState, Network).

# 2. Behavioral Fingerprint Correlation

The engine evaluates the histogram against pre-trained exploit signatures (such as the Movement Manipulation Suite or Kill-All / Silent Aim Pattern). If 2 or more related detectors fire within the session window, the cluster matches with high confidence ($85% \dots 95%$).

# 3. Latency Dampening

If the player's round-trip latency exceeds $350\text{ms}$ (playerState.ping > 0.350), the engine flags the incident with "Medium" false-positive likelihood and decreases confidence by $20%$. This ensures players on cellular or unstable connections are never falsely banned.

# AI Dossier Schema (`Types.AIAnalysisReport`)

Every analysis generates a structured, explainable report accessible to administrators via the Bento Dashboard or API:

export type AIAnalysisReport = {
    id: string,                             -- Unique GUID
    userId: number,                         -- Player UserID
    username: string,                       -- Player Username
    timestamp: number,                      -- Unix epoch timestamp
    overallRisk: "Low" | "Medium" | "High" | "Critical",
    riskScore: number,                      -- Normalized 0-150 risk
    patternSummary: string,                 -- High-level human-readable summary
    correlationNotes: string,               -- Detailed algorithmic justification
    confidenceScore: number,                -- 0 to 100% confidence
    suspectedExploitTypes: { string },      -- Matched signature names
    recommendedAction: "None" | "Monitor" | "Warn" | "Kick" | "TempBan" | "PermBan",
    falsePositiveLikelihood: "Very Low" | "Low" | "Medium" | "High",
    detailedAnalysis: string,               -- Comprehensive incident breakdown
}

# Next Steps

View the catalog of exploit signatures in the Exploit Fingerprint Catalog.
Learn about latency dampening in False-Positive Analysis.

Deceptive Honeypots

Exploit Fingerprints