1
$\begingroup$

My data is the usage/playing statistics for players of a specific game. One data point for a user is aggregated statistics for one week.

The goal is:

to detect when the player's account was stolen/hacked/anything else went wrong.

So my idea is:

for each player to have data points that each represent one week and then check whether the latest week is an outlier in the cluster. If it is - something is wrong with the account.

I am well familiar with clustering and things like autoencoders, but this doesn't feel very suited to my problem because:

  • I have a few samples for each user, i.e. we can go 25 weeks back, so only 25 samples of what is 'right'.
  • I don't need outlier detection for all the data. What I need is to tell if the latest sample is an outlier with respect to the other data points.

My question is:

what algorithm/method would be suitable for such a situation?

Currently, I have two ideas:

  • Dixon's Q-test.
  • Simply measure whether the latest sample is further from the cluster center than all the other samples.

They could work, but they both sound a little 'hacky'. I feel like there should be a more elegant solution for such a relatively simple problem, but my mind is just blank. What approach would you recommend?

$\endgroup$

3 Answers 3

0
$\begingroup$

For me it sounds like Time Series Anomaly Detection. You can follow the example here: https://towardsdatascience.com/time-series-anomaly-detection-with-pycaret-706a6e2b2427.

In Pycaret there are over 10 anomaly detection algorithms (wrapper of the pyod library). You should use several of them, play with the fraction (threshold) and check which combination works best for your data. In case that you have some collection of anomalities, you can use a classification (if you have several inputs in your dataset, that could describe the anomalities or if it is possible to generate inputs by yourself).

$\endgroup$
0
$\begingroup$

You could consider using the Holt-Winters time series model. It supports identification of trends (as you describe) and alternatively helps interpret the seasonal component as well. It is part of the statsmodels package.

$\endgroup$
0
$\begingroup$

What excellently works with comparing time series is so-called "dynamic time warp" (you can use the ouptut of this procedure to cluster your data). It is worth to take a look.

What also seems to work well are autoencoders (also GANs). The main idea is to train an autoencoder and use the loss function as an anomaly Score.

Clusters can work well, but you have to choose one clustering method that fits your data. This can be challenging in respect to anomaly detection, because you maybe do not know how your data will cluster. If your data and anomalies cluster in blobs, you can use Euclidean distance applying K-Means or more general distance metrics applying K-Medoid Clusters. You can see here what kind of clusters there are and how they can fail.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.