1
$\begingroup$

Suppose I have gathered the time a certain user takes to input a four digit PIN from his previous logins as follows :

User A : (10,12,11,13,19.1,12.4,12,16)

Now, User A wants to login again to perform a transaction. This time he took 11.03 to input the four digit PIN. As of now, I found Extreme Studentized Deviate that it can be used to detect outliers for univariate data, but am not sure of its performance.

Question:

  1. Which method or approach can I use to detect whether 11.03 is an outlier?

  2. What others have done?

  3. Can I use LOF? If so how? A little light will do. Thanks.

PS: Units of time in this case are not important, they are just random values for demonstrating the concept.

Improve this question
$\endgroup$
  • $\begingroup$ Is the number of observations (8 in your case) for one user realistic ? Or do you have many more for each user ? $\endgroup$ – user83346 Oct 27 '15 at 8:05
  • $\begingroup$ @fcop No, its not realistic. I just want to get to know how the method works then I will apply it on real data. $\endgroup$ – Nation Chirara Oct 27 '15 at 8:29
  • 1
    $\begingroup$ @Giovanrich Why are you focused on Mahalanobis distance? Do you think the sequence of the times matters? Or the number of observations that go into the estimate of central tendency around which "outliers" are to be evaluated? $\endgroup$ – Mike Hunter Oct 27 '15 at 13:06
  • $\begingroup$ When you write "univariate" data, do you mean an outlier relative to User A's past behavior or an outlier formed from an average of many users? $\endgroup$ – Mike Hunter Oct 27 '15 at 17:03
  • $\begingroup$ @DJohnson Well, I might be lost but by univariate I mean that I am considering one variable - time to imput PIN only. My data is one dimensional. $\endgroup$ – Nation Chirara Oct 27 '15 at 17:48
1
$\begingroup$

Thinking beyond the statistics...

I imagine the goal here is to say: The user took too long to enter the PIN compared to their usual time, so it is likely to be someone else using the password.

But.. Maybe I took longer because I was carrying a baby in my right arm, so had to enter the PIN with my left (non dominant) hand. Or maybe I was outside wearing gloves. Or maybe I got interrupted or was trying to carry on a conversation while entering the PIN. There are lots of reasons why I may enter a PIN slower than usual, so I think it would be a bad way to detect fraud. If you follow this logic, the outlier tests won't be helpful.

Improve this answer
$\endgroup$
0
$\begingroup$

In my opinion, if the data is a time series data, forecasting based confidence intervals give a good idea of whether a point is an outlier or not.

For non time series univariate data, multiple methods can be tried out -

  1. Z-score based method(this resembles your idea of using points farther from the expected value as outliers)
  2. Tukey's Method
  3. MAD(Median Absolute Deviation)

Out of the above methods for univariate data, I would recommend tukey's method because it is relatively robust.

For Multivariate Data, I would recommend methods like LOF, Elliptic Envelope(which uses the Mahalanobis distance internally - implemented in scikit-learn).

Improve this answer
$\endgroup$
-1
$\begingroup$

An outlier can be defined as "an observation point that is distant from other observations" . I prefer "an observation point that is distant from expectatations" . I took one of our "teaching moments series" and used your reference http://www.graphpad.com/quickcalcs/grubbs2/ to obtain enter image description here a conclusion about "normalcy of the last observation". I took your 9 values and found that while the most recent values was "normal" two prior values were deemed exceptional enter image description here and enter image description here . As @forecaster pointed out the work of Tsay and others is often useful.

Improve this answer
$\endgroup$
  • 1
    $\begingroup$ When I give a PIN, the events are usually separated in time and the circumstances pretty much independent. So I don't see how time series analysis enters here at all. (Over a very long period I suppose my reaction time increases with age, but I doubt that's central here.) $\endgroup$ – Nick Cox Oct 27 '15 at 17:14
  • $\begingroup$ Very funny ! Yes even thought this is chronological it definitely may not be even-spaced which would suggest definitely avoiding ARIMA. That being said there is no ARIMA component (i.e.no time series component) in the model just two possible "unusual values" and a most recent values that doesn't appear to be exceptional. $\endgroup$ – IrishStat Oct 27 '15 at 17:44
  • $\begingroup$ There is something broken about any outlier detection method that would identify 16 as an outlier relative to a seven-number sequence spanning 10 through 19. That is probably because it incorporates strong implicit assumptions. As @NickCox notes, it is not plausible that all those assumptions apply here. $\endgroup$ – whuber♦ Oct 27 '15 at 17:57
  • $\begingroup$ What is broken is that after 19 has been detected as anomaly 16 is certainly one .there are no implicit assumptions just a test for a value falling within expectations much like a winsorisiing. 19 is inconsistent with the history and if this is so then 16 is also inconsistent $\endgroup$ – IrishStat Oct 28 '15 at 1:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.