Behavior first
NullCS studies how players behave inside real encounters. The emphasis is on measurable structure around timing, visibility, movement pressure, and shot process.
Loading NullCS
NullCS studies whether suspicious behavior in Counter-Strike 2 demos can be surfaced in a way that stays measurable, reviewable, and honest about uncertainty. The goal is not to act like the problem is solved. The goal is to make serious progress on a difficult review task without hiding behind black-box language.
NullCS studies how players behave inside real encounters. The emphasis is on measurable structure around timing, visibility, movement pressure, and shot process.
Obvious abuse is usually the easy case. The more important challenge is lower-visibility irregular behavior that can sit close to strong legitimate play on first glance.
Outputs are meant to stay understandable enough that a reviewer can inspect the signal instead of trusting a black box, and the project does not present itself as universal detection.
The first three numbers are not cheat probabilities. They summarize how loud the strongest player signal looks inside each benchmark slice. Median top-ranked signal means: for each demo, take the highest-ranked player in the lobby, then look at the middle value across that group of demos.
So a suspicious median of 0.030 versus 0.0031 on held-out normal legit demos means the suspicious slice is surfacing much more strongly, while the legit slice stays almost pinned near zero. The pro value staying at 0.0034 matters for the same reason: strong legitimate players are not being inflated just because they are skilled.
For a review system like NullCS, the shape is more important than the raw magnitude. You want suspicious benchmark demos to be visibly louder, while normal legit and pro stress-test demos stay quiet. If all three slices were high, the system would be noisy. If all three were low, it would not be useful.
The 0.875 top-3 retrieval number answers a different question: how often does a labeled suspicious player appear somewhere in the top three ranked players for a suspicious benchmark demo? That matters because NullCS is framed as triage and review support. The goal is to reliably surface the right players near the top of the lobby, not to claim that one score is a final verdict.
NullCS works from structured Counter-Strike 2 demo data. The current public stack builds 449 player-level engineered features and deeper encounter-level timing and process channels to study how suspicious behavior actually unfolds.
Some demo metrics can make obvious abuse stand out, but that is not enough to settle every case. The harder problem is when strong legitimate play and lower-visibility irregular behavior begin to overlap.
The models are there to rank, organize, and explain match-relative behavioral anomalies. They are useful when they surface the right players near the top of a lobby while staying quieter on strong legitimate and pro-level slices.
NullCS is a review-support system, not a kernel anticheat and not a universal detector. The current work is serious progress, but the research is still ongoing in a difficult and dynamic environment.
NullCS is being built by Gerry Jones, Jr., who holds a B.S. in Applied Mathematics and is currently pursuing a master's degree in Data Science. The project started after returning to Counter-Strike in April 2025 and repeatedly running into obvious abuse, with the practical question of whether post-match demo data could support a more structured review workflow.
That turned into a research problem rather than a complaint. The goal was not to build an anticheat or market a universal detector. The goal was to investigate whether suspicious behavior in demos could be surfaced more systematically, including both obvious cases and harder review cases where abnormal behavior can sit close to strong legitimate play.
Building that required repeated iteration: sourcing demo data, manually pulling and labeling SteamIDs for training, testing different feature and modeling strategies, and studying public discussion around evasion, review thresholds, and common claims about how current systems behave. There is still substantial work ahead, but the current state of NullCS already reflects meaningful progress.
Obvious abuse can be loud in the metrics, but that is only one part of the review problem.
The harder cases are subtle irregular patterns that try to stay close to strong legitimate play.
NullCS is still under active research. The current state reflects real progress, not a claim that the problem has been solved.