I’m assuming you can’t just look at the active process because the game might be in the foreground but the user is in a lobby. I would look at the bandwidth profile of the game over 30 second windows. I bet it looks way different while playing a game vs. sitting in the lobby, and you can watch the traffic without modifying the binary of the game (at least, you can watch the relative volume of traffic, and the IP addresses it interacts with).