Researcher Fingerprint CS2 Cheaters via Mouse and Keyboard Input Patterns
A thesis project developed a system that identifies unique players by analyzing their hardware input signals, enabling persistent tracking across multiple accounts.
Key points
- Mouse input fingerprinting achieved 100 percent accuracy in identifying unique players.
- Keyboard input analysis correctly identified players 98 percent of the time.
- Combining both datasets reduces false positives, as correlation between strangers is low.
A master’s student at the Norwegian University of Science and Technology created a fingerprinting technique that identifies Counter-Strike players by their mouse and keyboard usage patterns, according to a report by Tom’s Hardware. The researcher shared these findings on the r/GlobalOffensive subreddit, detailing how the method tracks input signals to link specific individuals to their gaming accounts, including those using multiple smurf accounts.
The study analyzed mouse and keyboard signals from more than a thousand players to correlate their unique input behaviors. By examining these distinct movement metrics, the system can fingerprint individual users and match them to specific accounts. This approach allows for persistent identification of players who attempt to evade bans by creating new profiles, as the method focuses on input habits rather than device identifiers.
Technical Performance and Accuracy
The researcher reported that the technique determined unique players 100 percent of the time using the mouse dataset alone. Keyboard fingerprinting was slightly less precise, picking the correct player 98 percent of the time. Because these metrics measure entirely different physical movements, combining them creates a highly accurate detection system that is difficult for individuals to spoof or replicate intentionally.
The author stated that this method is not merely a proof of concept but a working system designed for continuous operation. It processes game demos to link accounts, building a reference library with every uploaded match. Despite handling massive amounts of data, the system is designed to run on a single 20GB version of an Nvidia A100 GPU, making it feasible for dedicated analysis environments.
Limitations and False Positives
Concerns exist that unrelated people might share similar play styles, potentially leading to false positives given the large player base of Counter-Strike 2, which peaks at over 1.2 million concurrent users. However, the researcher noted that the statistical probability of two strangers having similar habits for both mouse and keyboard is very low.
The correlation between the mouse habits of unrelated pairs and their keyboard habits is just 0.11, where 0 indicates no relation and 1 indicates they always go together. During testing, the system initially returned false positives, but further investigation revealed these accounts were actually related, connecting four different accounts to one person and uncovering unknown account pairs.
What should you do?
Security professionals and game publishers should evaluate input pattern analysis as a potential vector for persistent user identification. Organizations handling large volumes of user data must consider the privacy implications of collecting granular hardware interaction logs. Analysts should monitor for systems that aggregate mouse and keyboard telemetry to build behavioral profiles.
What to do and how to stay safe: Counter-Strike 2
- Review data collection policies to ensure hardware input telemetry is not being stored or aggregated for behavioral profiling without explicit consent.
- Monitor for unauthorized tools or scripts that analyze game demo files to extract and correlate mouse and keyboard input patterns.
- Implement strict access controls on systems that process raw input data, ensuring only authorized personnel can view or export behavioral logs.
- Audit existing ban evasion detection systems to verify they do not rely on probabilistic matching that could result in false positives for legitimate users.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How accurate is the fingerprinting technique?
The method achieved 100 percent accuracy using mouse data and 98 percent accuracy using keyboard data, with higher reliability when both are combined.
Does this system work on a large scale?
The system is designed to process demos continuously and run on a single Nvidia A100 GPU, though the author noted the current test data set is relatively thin.
Can this method mistake one player for another?
While false positives are possible, the low correlation between strangers' combined input habits makes it statistically unlikely for two people to be misidentified as the same user.
