I have logs of the form (e.g. from a gym login).. the representational case is so:
UserName, Login time, timeSpend_on_weights, time_spent_on_elliptical
Ava, 5jan 12pm, 10 mins, 20 mins,
Bob, 5jan 2pm, 30 min, 20 mins,
Cecila, 6jan 10am, 40min, 0 mins
...
Now I've converted the above time column to HourOfDay and day of month to get:
UserName, DOM, HOD, #weights, #elliptical
Ava, 5, 12, 10, 20
Bob, 5, 14, 30, 20
Cecilia, 6, 10, 40, 0
..
I treat the first 3 columns as categorical data and the last two as numerical, and I run K-Prototypes with N=2 (anomalous or non-anomalous). The final predictions I get can be filtered on each user to find anomalies specific to the username. The anomalous cluster is the one with lesser elements.
However, for some of the users, the cluster partitions on the Login time (HOD/DOM).. E.g. everything before 12am is one cluster and everything after 12am is another one. That doesn't convey any information.
What is the best way to handle these scenarios?
Is there a better way to do anomaly prediction on these kinds of dataset?
Update: Type of anomalies I'm looking for:
- Ava did 20 mins in elliptical, that she never used before. This individually can be done simply by using some form of outlier analysis, or K-means (on dataset filtered by 'Ava')
- Ava did elliptical on Monday morning (Samething as above but filtered on Ava & time of the day).
Individually I can create models for each dataset with reasonable success, but how do I create one model that handles both of them.
If I use an actual clustering algorithm like DBSCAN/HDBSCAN, how do I not have it partition on the time? (or some other categorical variable)