Botnet Under Siege: Confronting Intrusion Countermeasures

The growth of Ares does not go unchecked - as it grows and becomes more powerful, it will encounter killer ICE which will destroy the botnet unless dealt with appropriately.

In Botnet of Ares, Intrusion Countermeasure Executables, or ICE, are the way that the growth of your botnet is tested. These special Tasks spawn at certain thresholds based on how far Ares has scaled. Unlike many other Tasks, these require a response, or else the game is over.

Behind the design

The purpose of ICE is to provide challenge to the player and ensure that the botnet they are drafting is versatile enough to defeat a variety of challenges under time pressure. This, along side the exploit drafting mechanic (which is now in pretty good shape - will discuss in a future blogpost), pushes the game into a roguelike direction where you are encouraged to experiment, take risks & try again if it doesn't pan out.

This is a break from traditional incremental game design, where there is no real penalty for taking things at your own pace. However, the great thing about this design is that it feels exhilirating: it suddenly increases the tension by forcing the player to reorganize their botnet in order to defeat the new challenge, and the relief once such an ICE is defeated is a marvelous feeling. But rest assured - the ICE are not a total surprise, as there is a warning from Memory several minutes before they spawn.

Warning from Memory, reading 'You've got a tail, you better watch your next step.'

Tier I ICE

Here is a selection of the first tier of ICE. These will be encountered by the player fairly early on, just after the first few upgrades.

Screenshot of Botnet of Ares showing three ICE: DeadlyHydra, Karpatyi dDOS and mOTHEr, which spawns naughty children sub-ICE.

DeadlyHydra splits two child ICE with higher parallelism requirements than the initial thread. It checks whether the botnet has both high single-threaded compute as well as some parallel capacity.

Karpatyi dDOS is a pure parallelism check - at the point in the game where it spawns, the player must have some capacity for highly parallel compute in order to succeed.

Last but not least, _mOTHEr_ is a check on single-threaded compute with some 'cleave' - the children must be dealt with as they spawn, or they risk eliminating the progress of the thread working on _mOTHEr_.

Tier II ICE

This batch is meant to truly challenge the player. All the costs are higher, as we are much later in the game, but the side effects are worse and there are more & stronger sub-ICE.

Screenshot of Botnet of Ares showing another three ICE: Maelstrom, The Gang composed of aLICE, bOB and mALLROY and HiveMind which is able to spawn Drones and Sparks.

Maelstrom is more of a knowledge check than anything else - it can usually be defeated by unassigning Ares from everything & reassigning it to this ICE.

aLICE, bOB & mALLROY, collectively known as The Gang, all spawn at the same time. A spread of single-threaded & parallel compute is needed to defeat them.

The HiveMind spawns sub-ICE which drastically debuff the botnet. It's a test that's very similar to _mOTHER_ from the previous tier, only much more difficult.

When should one fear ICE?

The player will only see a handful of killer ICE per run. When the scaling threshold is reached, a single ICE is spawned from the appropriate tier. However, because this is a random selection, the player must build a botnet that is versatile enough to handle any ICE. For instance, relying on serial scaling alone puts the player at massive risk if something like Karpatyi DDOS or The Gang spawns.

tagged Botnet of Ares