Machine Learning Research for CS2 Demo Review

Surface unusual CS2 demo behavior for review, not verdicts.

NullCS parses Counter-Strike 2 .dem files into tick-level encounter windows, computes 449 player-demo signals, and ranks review-worthy players with evidence attached. The current public benchmark uses 894 demos and 281,792 encounter windows.

Dataset

894 demos and 281,792 encounter windows in the current public benchmark

Features

35 temporal CNN channels plus 449 player-demo ranking features

Output

Ranked review signals with reasons, not verdicts or ban decisions

Current direction

Parse the match, rank the standouts, inspect the evidence

The model is tuned for review priority: top-ranked players, supporting rows, and benchmark context. It is not an anti-cheat or an automated ban system.

Read the project background

Review Pipeline

From demo file to review queue.

NullCS turns CS2 demos into structured behavior evidence, then ranks the players and moments that deserve closer inspection.

Output

Ranked signals, evidence rows, and failure-aware scores.

A high score means inspect this player first. It does not mean the match is settled.

Step 01

Parse tick-level telemetry

Raw .dem files become event tables, player state, visibility markers, shots, damage, kills, and round context.

Step 02

Build encounter windows

Each engagement is represented as a 32-tick temporal sequence with aim, mouse, visibility, movement, shot, and damage channels.

Step 03

Rank players for review

CNN encounter scores and 449 player-demo features feed a grouped XGBoost model that ranks players inside the match.

What It Actually Finds

Concrete signals from the demo telemetry.

Aim Correction

Positive rows show cleaner pre-shot stabilization in several aim-process summaries, including lower pre-shot aim-error variance.

Visibility Timing

Prefire-like rifle timing and long-range fast-reaction rates separate a subset of suspicious rows from the negative baseline.

Encounter Clusters

51.5% of positive encounter windows score at or above 0.75, compared with 3.6% of negative windows.

These are review signals. They point to behavior worth inspecting; they do not identify a cheat type by themselves.

Benchmarks

Current benchmark readout.

Grouped out-of-fold evaluation is split by demo_id. The metrics below describe review ranking, not enforcement accuracy.

Player-level ROC-AUC

0.956

Player-level PR-AUC

0.796

Suspicious player top-1

92.8%

Suspicious player top-3

97.3%

Granular example

Some signals are lower-noise process measurements, not dramatic snaps.

Positive rows show lower medians on several stabilization features, including pre-shot aim-error variance and early snap-jerk summaries. That does not prove a cheat type. It tells a reviewer where the engagement process looks unusually clean for the surrounding context.

The useful output is an inspectable reason to review the demo, not a final label.

Some signals are lower-noise process measurements, not dramatic snaps.

Benchmark slices

Grouped player-level evaluation reaches ROC-AUC 0.956 and PR-AUC 0.796

The current CS2CD player-level readout covers 860 demos after filtering, with 992 positive and 5,894 negative player-demo rows.

Per-demo surface

The labeled suspicious player ranks top-1 in 92.8% of suspicious demos

Top-3 retrieval is 97.3% across 293 demos with a suspicious player label, which is the core review-triage metric.

Control path

Encounter-model scores separate positive windows from negative windows

Median CNN score is 0.769 for positive windows and 0.188 for negative windows. The model is seeing repeatable encounter-level structure.

Control features

Fast rifle timing, prefire-like rates, and headshot concentration are visible but insufficient alone

Feature separation is strongest when timing, aim process, input stability, visibility, and encounter-model summaries are combined.

Training scale

A single match expands into many encounter windows and player-level aggregates

The benchmark contains 281,792 encounter windows and 6,886 evaluated player-demo rows after filtering.

Technical Credibility

Inspect the current work.

The repository carries the pipeline, benchmark artifacts, and model work behind the public site.

Repository

Open the technical source

Use the repo to inspect how demos are parsed, how features are built, and how benchmark reports are generated.

Grouped evaluation uses demo_id splits so one match does not leak across train and validation folds.

The model still produces false positives, especially in headshot-heavy high-support matches.

Scores are review priority, not enforcement probability.

Loading NullCS