Minecraft anticheat guide
Window Spread Aimbot Checks: Ratios and Outliers
What FairPlay's window-spread aimbot checks measure with ratios, outliers and entropy, why short fights mislead them, and how staff should read these alerts.
What does window spread measure?
These six checks summarize a window of recent rotations with statistics rather than reading one move at a time. They count duplicates, measure spread, look for outliers and compare how consistent the turns are across time. The output is a description of how varied the window is.
The family covers Ratio, Stats Improbable, Consistency, Entropy Signature, Omni Ratio IQR and Z Score Pair. Each uses a different summary. Ratio looks at how many values repeat. Stats Improbable counts duplicates and outliers per axis. Consistency compares short, medium and long windows. Entropy Signature reads how many distinct values appear and how they are arranged.
Because each check summarizes a window, an alert describes a stretch of play, not a single action.
What kind of cheat output do these summaries target?
The family targets output that is too uniform or too repetitive for the amount of combat in the window. Software that reuses a small set of rotations, or that produces values with a fixed spread, can produce a window whose statistics look unlike a human's. The Z Score Pair and Omni Ratio IQR checks read outliers in a different way, looking at how far individual values sit from the spread of their group.
Consistency is worth a specific note. It asks whether the variation in turns stays steady across windows of different length. A player whose variation barely changes between a short and a long window is showing a pattern that the check is written to read. Human play usually varies more across time than that.
Why do short or quiet windows produce misleading numbers?
Every summary needs enough samples to mean something. A short fight or a player standing still gives a window with few meaningful moves, and small samples produce strange ratios and spreads. This is the most common reason to misread the family.
A player who spends most of a window walking, building or mining will also show low variation in the rotations that matter. Hovering over a menu, a long idle period or repeated small adjustments can all fill a window with repeats. The window reflects what the player was doing, which may have nothing to do with combat.
Staff should therefore check the amount of combat in the window before reading any statistic. A window with only a few hits or a few seconds of contact should be treated as too thin to support a conclusion.
What should a reviewer check first?
Start with the window's content. Count the hits, note whether the player was moving or standing, and check the time span. Then compare the alert with the player's other windows from the same session, because a single window is an unusual basis for a decision.
The table below describes the summary behind each check and the first thing to verify.
| Check | Summary it reads | First verification step |
|---|---|---|
| Ratio | How many values in the window repeat | Count the hits and moves in the window |
| Stats Improbable | Duplicate and outlier counts on each axis | Check whether the window contains combat or idle movement |
| Consistency | Variation compared across short, medium and long windows | Confirm the window lengths covered real combat |
| Entropy Signature | Distinct values and their arrangement | Look for a long idle period or repeated menu use inside the window |
| Omni Ratio IQR and Z Score Pair | Spread and outliers in paired values | Compare against the player's other windows from the same session |
What belongs in staging before any change?
Every summary check depends on the window size and on how many samples the check needs before it reads anything. Changing those values changes the shape of every alert. Test any change on a set of recorded sessions that includes long fights, short fights and idle play, and keep the set fixed so the before and after results can be compared.
Pay attention to how the family handles windows that are too small. A tuning change that lowers the minimum sample count will read more thin windows, and that will raise the chance of reviewing a misleading alert.
What does a statistical alert actually say?
A statistical alert says that a window's summary fell in a range the family is written to read. It does not say which action caused the summary, and it does not say why. Read it as a prompt to look at the raw play in that window and at the player's other windows.
Record the window's length, the number of hits, and what the player was doing. A note with those three facts is more useful than the statistic itself, because the statistic is only a summary of them.
FAQ
Why does a window with few hits matter so much?
Summaries need enough samples to describe anything. A window with only a few hits or moves can produce extreme ratios or spreads without reflecting a real pattern, so it should be treated as too thin.
Can idle play in a window create a repetitive summary?
Yes. Standing still, menu use or repeated small adjustments can fill a window with repeated values. Check what the player was doing before reading the statistic.
Which summary is the most useful for a second opinion?
Consistency, because comparing short, medium and long windows shows whether the variation changes with time. A player whose variation barely changes across lengths is worth a closer look, but only alongside the combat record.