Riot Vanguard is a kernel-levelanti-cheat developed by Riot Games. Vanguard initially released as the anti-cheat used for Valorant on April 7th, 2020.[1] Originally designed for Windows only alongside Valorant, the console edition of Valorant released in June 2024 has an anti-cheat using the same branding, however this anti-cheat functions very differently.[2] Vanguard has received much criticism because of its intrusive nature. Vanguard was introduced into League of Legends on April 11th, 2024.[3]
Riot's anti-cheat solution has client-side protections that actively observe the game for any suspicious behavior. These protections are essential in identifying game client modifications or efforts to inject code to alter the game. Riot's system operates behind the scenes, actively detecting and preventing cheats like aimbots, wallhacks, and other client-side modifications. The system employs methods for identifying normal player behavior against behavior that constitutes cheating.[4]
On top of client-side protections, Riot introduced a kernel-level anti-cheat to target more advanced cheating techniques. This method runs at a lower system level, which makes it more difficult for cheats to avoid detection. Kernel-level monitoring has been questioned because of its potential security risks.
Critics have stated that providing the anti-cheat system with higher system privileges could be vulnerable since the higher access could be exploited by attackers. Riot justifies kernel-level scanning despite such problems by claiming that this is the way that existing cheating practices can be detected.
Ongoing monitoring and updates
Vanguard is supported by constant monitoring and continuous updates. The anti-cheat team provides patches on a frequent basis to counter new cheating techniques. For example, the Winter 2021 update for Valorant included enhanced anti-cheat capabilities, adding detection and blocking of previously undetectable cheats. Riot's approach emphasizes proactive initiatives, with constant updates to stay ahead of cheaters and reduce the impact of cheating on the game. In a workshop on anti-cheat systems in 2024, Collins et al. discussed Riot's system as a potential means of balancing the demands of cheat prevention and player experience.
Dorner, Christoph; Klausner, Lukas Daniel (2024-07-30). "If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems". Proceedings of the 19th International Conference on Availability, Reliability and Security. ARES '24. New York, NY, USA: Association for Computing Machinery. pp.1–11. arXiv:2408.00500. doi:10.1145/3664476.3670433. ISBN979-8-4007-1718-5.
Collins, Sam; Poulopoulos, Alex; Muench, Marius; Chothia, Tom (2024-11-19). "Anti-Cheat: Attacks and the Effectiveness of Client-Side Defences". Proceedings of the 2024 Workshop on Research on offensive and defensive techniques in the context of Man At The End (MATE) attacks. CheckMATE '24. New York, NY, USA: Association for Computing Machinery. pp.30–43. doi:10.1145/3689934.3690816. ISBN979-8-4007-1230-2.
