-
Whole session shown
watched ore vein
movement without mining
A session's path is rebuilt from broken block to broken block, in the chronological order of the CoreProtect logs. A step longer than 4 blocks is treated as movement without mining (walking through a cave, falling, teleporting): it breaks continuity but does not count as a turn.
The small grey cubes are the broken rock: they draw the shape of the tunnels. The wire links the blocks in the order they were broken. The coloured cubes are ores, one colour per family; the watched ore is marked with ⭐ in the layers. The layer panel at the top left shows or hides each layer, or all of them at once.
The Display selector switches between cubes and points. Points hide much less of what lies behind: it is the mode to prefer for reading the overall shape of a dense network, or for staying smooth on a very large session.
Hover: hovering a cube gives the block, its coordinates and the time it was broken; hovering the wire, between two cubes, gives the distance travelled and the time elapsed between those two blocks — handy for spotting a movement that is not digging.
Navigation: drag to rotate, wheel to zoom, right click (or Shift + drag) to pan, double-click — or the “Recenter” button — to reframe on the shown window.
The timeline under the scene covers the whole session. The coloured squares mark the breaks of the watched ore, the hatching marks movement without mining (steps longer than 4 blocks). The two handles set the shown window. The session always opens in full; Replay (P key) rebuilds the window block after block, at the chosen speed (as a multiple of real time).
L / S / T: verdict legit / suspect / cheat (annotation mode) · G: cave tag · Space or N: next session · B: previous session · P: start / pause the replay · Esc: close a window.
How many blocks of the watched ore the player finds per 100 blocks dug — only breaks in a digging phase count (≤ 2 blocks between consecutive breaks): ores picked up while walking through a cave, exposed and visible, do not enter this yield. A legitimate strip miner at Y-59 finds about 0.3 to 0.8 diamonds per 100 blocks; above 3, the yield can no longer be explained by luck. The bounds adapt to the chosen ore (finding 5 iron per 100 blocks is ordinary, 5 diamonds is not).
Length of the path actually mined between two successive veins, divided by the straight-line distance. 1× = a perfectly straight line from vein to vein. A legitimate player grids the area and stumbles onto veins by chance (≥ 3×); an x-rayer goes almost straight (≤ 1.4× triggers the alert, ~2.5× in practice because a 2-high tunnel zigzags block by block). Only veins reached by digging count, and a pair crossed by a walking step is ignored: walking straight to a visible ore in a cave is not suspicious.
At each change of direction, does the new direction get closer to the next vein not yet discovered (and reached by digging)? A random turn gets closer about 1 time in 2 (50 %). Aiming right at almost every turn betrays information the player should not have.
Breaks of the target ore are grouped into veins when they are less than 2 blocks apart. “Blocks between veins” counts the blocks mined between the end of one vein and the start of the next: the “how much I dig before I find something”.
Average length (in blocks) of the stretches travelled without changing direction, split into horizontal and vertical. Careful: mining a 2-high tunnel alternates one step forward / one vertical step, which flattens this average for everyone (~1 block) — a metric still to be refined.
Frequency of direction changes per 100 steps, and the share of steps whose main movement is vertical (dives and climbs toward targets).
Each indicator is normalised between 0 and 1 by a bounded ramp (below the low bound: 0, above the high bound: 1 — the panel bars show this normalised value), then combined: 40 % yield, 30 % detour, 30 % turns. Verdicts: ≥ 60 highly suspicious, ≥ 30 to watch, otherwise clean. If an indicator cannot be computed (fewer than two veins for instance), it is dropped and the weights are renormalised.
It is a V1 heuristic calibrated on game knowledge, meant to be replaced by a trained model as soon as a large enough labelled corpus exists. The score always covers the whole session: the time window filters the scene, not the analysis.
A second look, independent from the score: an Isolation Forest (unsupervised model) trained on the sessions of the real database measures how far the session is from a typical session of the corpus, on 13 features at once — including those the V1 score does not use (path shape, dug share…). The gauge is normalised 0-100: 50 = contamination threshold (the mark on the bar); above it, the session is more atypical than the vast majority of the training corpus. “Driven by” gives the feature that contributes most to the deviation.
Atypical does not mean cheater. The model has no labels: it says “this session does not look like the corpus”, nothing more. A session very high on this gauge but clean on the V1 score deserves a visual check, not a sanction. See readmeAnalyse.md for the method (features, imputation, directionality, limits).
Sessions per 5-point bucket — logarithmic vertical scale (the clean mass would flatten everything in linear)
One dot per session, colour = verdict — clicking a dot opens the session in the 3D scene