Gaming machine security devices and methods

1. A security support device installed within or affixed to a cabinet of an electronic gaming machine (EGM), the security support device comprising:

a network interface configured to inspect network traffic; and

a security support component communicatively coupled to a network communications path via the network interface and between a game controller of the EGM and a player tracking interface of the EGM, the communicative coupling allowing the network interface to inspect data packets sent between the game controller and the player tracking interface without interfering with packet transmission between the game controller and the player tracking interface, wherein the security support component is configured to:

read, via the network interface, network packets from the network interface, wherein the network packets are transmitted between the game controller and the player tracking interface and are addressed to at least one of the game controller and the player tracking interface;

extract operational data from the network packets, wherein the operational data is related to the operation of the EGM;

detect fraudulent player conduct based on the operational data; and

in response to detecting fraudulent player conduct, perform a mitigating action, wherein the mitigating action comprises at least one of i) automatically disabling the EGM or ii) automatically removing the EGM from participation in a multiplayer electronic game.

2. The security support device of claim 1 , wherein the security support device further comprises a second network interface configured to communicatively couple with a local area network, and wherein the security support component is further configured to, in response to detecting fraudulent player conduct, transmit a security alert on the local area network via the second network interface.

3. The security support device of claim 2 , wherein the security support device is configured to act as a pass-through device, passing network traffic between the game controller and the local area network.

4. The security support device of claim 1 , wherein detecting fraudulent player conduct includes applying the operational data as an input to a machine learned model, wherein an output of the machine learned model identifies fraudulent player conduct.

5. The security support device of claim 1 , wherein the operational data includes wager timing data regarding when a player presses a player input device to place a wager on the EGM, wherein detecting fraudulent player conduct includes evaluating the wager timing data to determine inconsistent wagering by the player.

6. The security support device of claim 1 , wherein the operational data includes game outcome data over a play session of a player, wherein detecting fraudulent player conduct includes determining that the game outcome data for the play session has generated a negative outcome for the EGM over the play session.

7. The security support device of claim 1 , wherein the operational data includes cash-in and cash-out data performed on the EGM, wherein detecting fraudulent player conduct includes determining that a player performs a cash-in action at the same EGM within a pre-determined time after performing a cash-out action.

8. An electronic gaming machine (EGM) comprising:

a display device;

a player input device;

a game controller configured to transmit operational data across a network with a player tracking interface; and

a security support device comprising a network interface connected to the network to allow the network interface to inspect data packets sent between the game controller and the player tracking interface without interrupting packet transmission between the game controller and the player tracking interface, wherein the security support device is configured to:

receive, via the network interface, network packets being transmitted between the game controller and the player tracking interface, wherein the network packets are addressed to at least one of the game controller and the player tracking interface;

extract operational data from the network packets, wherein the operational data is related to the operation of the EGM;

detect fraudulent player conduct based on the operational data; and

in response to detecting fraudulent player conduct, perform a mitigating action, wherein the mitigating action comprises at least one of i) automatically disabling the EGM or ii) automatically removing the EGM from participation in a multiplayer electronic game.

9. The EGM of claim 8 , wherein the security support device further comprises a second network interface configured to communicatively couple with a local area network, and wherein the security support device is further configured to, in response to detecting fraudulent player conduct, transmit a security alert on the local area network via the second network interface.

10. The EGM of claim 9 , wherein the security support device is further configured to act as a pass-through device, passing network traffic between the game controller and the local area network.

11. The EGM of claim 8 , wherein detecting fraudulent player conduct includes applying the operational data as inputs to a machine learned model, wherein an output of the machine learned model identifies fraudulent player conduct.

12. The EGM of claim 8 , wherein the operational data includes wager timing data regarding when a player presses a player input device to place a wager on the EGM, wherein detecting fraudulent player conduct includes evaluating the wager timing data to determine inconsistent wagering by the player.

13. The EGM of claim 8 , wherein the operational data includes game outcome data over a play session of a player, wherein detecting fraudulent player conduct includes determining that the game outcome data for the play session has generated a negative outcome for the EGM over the play session.

14. The EGM of claim 8 , wherein the operational data include cash-in and cash-out data performed on the EGM, wherein detecting fraudulent player conduct includes determining that a player performs a cash-in action at the same EGM within a pre-determined time after performing a cash-out action.

15. A method for detecting fraudulent player conduct at an electronic gaming machine (EGM), the method comprising:

reading, by a security support device installed within or affixed to the EGM and communicatively coupled via a network interface on a network connection between a game controller of the EGM and a player tracking interface, network packets from the network interface, the network packets being transmitted between the game controller and the player tracking interface, wherein the network packets are addressed to at least one of the game controller and the player tracking interface;

extracting, by the security support device, operational data from the network packets, wherein the operational data is related to the operation of the EGM;

detecting fraudulent player conduct based on the operational data; and

in response to detecting fraudulent player conduct, performing, by the security support device, a mitigating action, wherein the mitigating action comprises at least one of i) automatically disabling the EGM or ii) automatically removing the EGM from participation in a multiplayer electronic game.

16. The method of claim 15 , wherein the security support device further comprises a second network interface configured to communicatively couple with a local area network, the method further comprising transmitting, by the security support device, a security alert on the local area network via a second network interface in response to detecting the fraudulent player conduct.

17. The method of claim 15 , wherein detecting fraudulent player conduct includes applying the operational data as inputs to a machine learned model, wherein an output of the machine learned model identifies fraudulent player conduct.

18. The method of claim 15 , wherein the operational data includes wager timing data regarding when a player presses a player input device to place a wager on the EGM, wherein detecting fraudulent player conduct includes evaluating the wager timing data to determine inconsistent wagering by the player.

19. The method of claim 15 , wherein the operational data includes game outcome data over a play session of a player, wherein detecting fraudulent player conduct includes determining that the game outcome data for the play session has generated a negative outcome for the EGM over the play session.

20. The method of claim 15 , wherein the operational data includes cash-in and cash-out data performed on the EGM, wherein detecting fraudulent player conduct includes determining that a player performs a cash-in action at the same EGM within a pre-determined time after performing a cash-out action.