Embodiments of the invention are directed to a computer-implemented method for monitoring game activity of a game system. A non-limiting example of the method includes monitoring, by a processing device, game activity of the game system. The processing device determines characteristics of the game activity, along with expected characteristics of the game activity. The processing device analyzes the characteristics of the game activity and the expected characteristics of the game activity. Based at least in part on analyzing the characteristics of the game activity and the expected characteristics of the game activity, an entity that is controlling the game system is determined.