csharpfritz / Fritz.StreamTools

Handy tools for managing my live stream, built with ASP.NET Core
MIT License
151 stars 73 forks source link

Add protection against chat ddos attacks or at least mitigate them. #111

Closed asyncawake closed 6 years ago

asyncawake commented 6 years ago

Happened during the 9+h stream on May 18th at about 3 hours and 58 minutes in. The bot could be taught to recognize such patterns and take automatic action. Clean up the chat and maybe temporarily mute the "new follower" soundbyte and gif overlay, as well. image

image

parithon commented 6 years ago

How would this be accomplished? Do we have Fritzbot monitor the timespan between the time somebody enters the chat room and begins to chat?

asyncawake commented 6 years ago

Sounds good! Of course if that happens once or twice that could just be normal behavior. Or even 3-4 times, e.g., if the chat gets raided by a friendly streamer and his viewers. But If we detect the pattern you mentioned and it repeats 5, 6 or more times in quick succession, that could be a pretty solid indicator for an attack. We could add in additional checks, like comparing the user name to a database of followers. If we have 8 never seen before "people" entering the chat within seconds and spamming the chat repeatedly then we have a pattern. Another pattern to watch for would be (as in the screenshots above) different "people" repeating the same message. But regular followers are likely to "interrupt" the attackers with messages like (see screenshot) "uh oh, spammers" etc. So the bot, once becoming suspicious of an attack, could scan for the repeating pattern by filtering out all messages of known/regular followers for a certain time while it is running its analysis.

There could be a "threat meter" and the more of our pattern checks are positive the higher the likelihood of it being an actual attack.

As far as reactions I think -instantly muting the "follow" jingle in order to keep the audio of the stream uninterrupted would be the most important countermeasure.

parithon commented 6 years ago

This is an interesting option, I wonder if @csharpfritz uses the following setting found at How to Manage Harassment in Chat

Require Chatters to be Email-Verified There is also an option to require all chatters in your chatroom to be email verified on Twitch. This means that anyone that would like to send messages to your chat room must first verify their email address. Enabling this can help to lower the likelihood that someone creates a "throwaway" account just to harass you or your viewers.

Here is another option too:

Enable R9K Mode The Robot9000 feature (R9K for short) is a special filter designed to disallow repeated messages. This is a great tool to use if multiple users repeatedly send the exact same message in chat. R9K can be turned on by typing: /r9kbeta and turned off by typing /r9kbetaoff

csharpfritz commented 6 years ago

I did not have this setting turned on, and I have just now required email verification.

Thanks for picking up on that setting!

parithon commented 6 years ago

Awesome! I'm thrilled that I was able to provide value :)

asyncawake commented 6 years ago

Should we close this issue, then? @parithon's suggestion sounds like a good enough solution for now.

csharpfritz commented 6 years ago

With a second confirmation on this. I can agree with that... let's close it for now. If we see something more dastardly happen, we'll revisit the issue.

Thanks team!