or fewer components and still fall within the scope of various embodiments of the present invention fig4 shows a flow diagram of an exemplary process for identifying illegal network game activity according to some embodiments of the present invention the illegal network game activity may include as discussed herein violation of the rules associated with the network game 104 or any other cheating activity by the network game users at optional step 402 network game play is monitored monitoring of game play may in some embodiments only be implemented in passive validation architecture notwithstanding the monitoring module 306 discussed in fig3 can monitor user activity associated with the network game 104 as discussed herein any type of monitoring observation and so forth may be employed at optional step 404 a determination whether there is anything unusual about a particular player 39 s actions in the network game 104 step 404 may like step 402 be most appropriate in passive validation architecture if no unusual activity is detected the monitoring module 306 continues to monitor the network game user 39 s activities in the network game 104 if unusual activity is detected e g in passive or hybrid validation architecture or as might otherwise be scheduled or in response to a scheduled or randomized and asynchronous implementation of the query engine 310 e g in active validation architecture the query engine 310 sends a query to a client 102 e g one that might be associated with unusual activity at step 406 based on the response to the query the analysis engine 308 determines whether the unusual activity is illegal at step 408 if the node e g client 102 is validated the present query response interaction comes to an end in the case of active validation architecture in.