Granted Patent B2

US 8,974,304 · App. 11/275,280 · Granted Mar 10, 2015

Abstract

Claims (47)

1. A method for detecting abnormal behavior within a gaming network, the network including a set of homogeneous wagering game machines, the network including a behavior monitoring device remote from the set of homogeneous wagering game machines, the method comprising:

receiving, at the behavior monitoring device, a value of an operating characteristic from one or more machines in the set of homogeneous wagering game machines;

determining, by the behavior monitoring device, whether the value of the operating characteristic is within a normal operating range,

statistically verifying, by the behavior monitoring device, the value of the operating characteristic with a confidence factor selected from a plurality of confidence factors;

initially determining, by the behavior monitoring device, that the value of the operating characteristic is outside the normal operating range and selecting

(a) a first fault notification operation from a set of different fault notification operations if the confidence factor is a first confidence factor, or

(b) a second fault notification operation from the set of different fault notification operations if the confidence factor is a second confidence factor;

performing, by the behavior monitoring device, the selected first fault notification operation or second fault notification operation and, subsequently, determining that the value of the operating characteristic is within the normal operating range by

monitoring values of a predetermined data set that determine the normal operating range,

learning that the value of the operating characteristic should be included in the values of the predetermined data set, and

updating the values of the predetermined data set to include the value of the operating characteristic.

2. The method of claim 1 , further comprising increasing the confidence factor after determining that the value of the operating characteristic is within the normal operating range.

3. The method of claim 1 , wherein the set of different fault notification operations includes one or more of notifying casino security, recording a message in a message log, disabling the wagering game machine, or presenting a message to a display device.

4. The method of claim 1 , wherein the operating characteristic includes one or more of processor utilization, memory utilization, absence of a process, presence of a process, sockets opened, ports opened, or message activity.

5. A system comprising:

a set of homogeneous wagering game machines to transmit a value of an operating characteristic;

a data store to store the value of the operating characteristic and a predetermined data set representative of a normal operating range; and

a diagnostic controller remote from the set of homogenous wagering gaming machines and configured to

receive the value of the operating characteristic

determine whether the value of the operating characteristic is within the normal operating range,

statistically verify the value of the operating characteristic with a confidence factor selected from a plurality of confidence factors,

initially determine that the value of the operating characteristic is outside the normal operating range and select

(a) a first fault notification operation from a set of different fault notification operations if the confidence factor is a first confidence factor, or

(b) a second fault notification operation from the set of different fault notification operations if the confidence factor is a second confidence factor,

perform the selected first fault notification operation or second fault notification operation and, subsequently, determine that the value of the operating characteristic is within the normal operating range by

monitoring values of a predetermined data set that determine the normal operating range,

learning that the value of the operating characteristic should be included in the values of the predetermined data set, and

updating the values of the predetermined data set to include the value of the operating characteristic.

6. The system of claim 5 , wherein the diagnostic controller further performs one or more of a statistical analysis, a fuzzy logic, and data mining to determine whether the value of the operating characteristic is within the normal operating range.

7. The system of claim 5 , wherein the operating characteristic is selected from a group consisting of identities of processes executing on a wagering game machine of the set of homogeneous wagering game machines, processor utilization of the processes executing on the wagering game machine, memory utilization of the processes executing on the wagering game machine, and files open for the processes executing on the wagering game machine.

8. The system of claim 5 , wherein, prior to being updated, the values of the predetermined data set were obtained in a testing environment.

9. The system of claim 8 , wherein the testing environment is a secure testing environment, and wherein the values of the predetermined data set are used to build a database of operating characteristic values within a range of normal behavior.

10. The system of claim 8 , wherein the testing environment is a casino environment.

11. A non-transitory machine-readable storage medium including instructions for detecting abnormal behavior within a gaming network including a set of homogeneous wagering game machines, the instructions when executed by a machine, perform operations comprising:

receiving, at a behavior monitoring device, a value of an operating characteristic from one or more machines in the set of homogeneous wagering game machines;

determining, by the behavior monitoring device, whether the value of the operating characteristic is within a normal operating range,

statistically verifying, by the behavior monitoring device, the value of the operating characteristic with a confidence factor selected from a plurality of confidence factors;

initially determining, by the behavior monitoring device, that the value of the operating characteristic is outside the normal operating range and selecting

(a) a first fault notification operation from a set of different fault notification operations if the confidence factor is a first confidence factor, or

(b) a second fault notification operation from the set of different fault notification operations if the confidence factor is a second confidence factor;

performing, by the behavior monitoring device, the selected first fault notification operation or second fault notification operation and, subsequently, determining that the value of the operating characteristic is within the normal operating range by

monitoring values of a predetermined data set that determine the normal operating range,

learning that the value of the operating characteristic should be included in the values of the predetermined data set, and

updating the values of the predetermined data set to include the value of the operating characteristic.

12. The non-transitory machine-readable storage medium of claim 11 , the operations further comprising increasing the confidence factor after determining that the value of the operating characteristic is within the normal operating range.

13. The non-transitory machine-readable storage medium of claim 11 , wherein the set of different fault notification operations includes one or more of notifying casino security, recording a message in a message log, disabling the wagering game machine, or presenting a message to a display device.

14. The non-transitory machine-readable storage medium of claim 11 , wherein the operating characteristic includes one or more of processor utilization, memory utilization, absence of a process, presence of a process, sockets opened, ports opened, or message activity.

Assignments (9)