# Which algorithm suits this type of outlier detection?

Suppose I have gathered the time a certain user takes to input a four digit PIN from his previous logins as follows :

User A : (10,12,11,13,19.1,12.4,12,16)

Now, User A wants to login again to perform a transaction. This time he took 11.03 to input the four digit PIN. As of now, I found Extreme Studentized Deviate that it can be used to detect outliers for univariate data, but am not sure of its performance.

Question:

1. Which method or approach can I use to detect whether 11.03 is an outlier?

2. What others have done?

3. Can I use LOF? If so how? A little light will do. Thanks.

PS: Units of time in this case are not important, they are just random values for demonstrating the concept.

• Is the number of observations (8 in your case) for one user realistic ? Or do you have many more for each user ? – user83346 Oct 27 '15 at 8:05
• @fcop No, its not realistic. I just want to get to know how the method works then I will apply it on real data. – Nation Chirara Oct 27 '15 at 8:29
• @Giovanrich Why are you focused on Mahalanobis distance? Do you think the sequence of the times matters? Or the number of observations that go into the estimate of central tendency around which "outliers" are to be evaluated? – Mike Hunter Oct 27 '15 at 13:06
• When you write "univariate" data, do you mean an outlier relative to User A's past behavior or an outlier formed from an average of many users? – Mike Hunter Oct 27 '15 at 17:03
• @DJohnson Well, I might be lost but by univariate I mean that I am considering one variable - time to imput PIN only. My data is one dimensional. – Nation Chirara Oct 27 '15 at 17:48

Thinking beyond the statistics...

I imagine the goal here is to say: The user took too long to enter the PIN compared to their usual time, so it is likely to be someone else using the password.

But.. Maybe I took longer because I was carrying a baby in my right arm, so had to enter the PIN with my left (non dominant) hand. Or maybe I was outside wearing gloves. Or maybe I got interrupted or was trying to carry on a conversation while entering the PIN. There are lots of reasons why I may enter a PIN slower than usual, so I think it would be a bad way to detect fraud. If you follow this logic, the outlier tests won't be helpful.

In my opinion, if the data is a time series data, forecasting based confidence intervals give a good idea of whether a point is an outlier or not.

For non time series univariate data, multiple methods can be tried out -

1. Z-score based method(this resembles your idea of using points farther from the expected value as outliers)
2. Tukey's Method