Methods and apparatus for detecting abnormal behavior of a wagering game machine are described herein. In one embodiment, the method includes receiving an operating characteristic value, wherein the operating characteristic value indicates a value of an operating characteristic of a wagering game machine and based on a set of previous operating characteristic values of the operating characteristic, determining whether the operating characteristic value is within a normal operating range. In the embodiment the method also includes performing a fault operation if the operating characteristic value is not within the normal operating range.