We have data that shows usernames and their IP addresses when they connect to a particular server. The data also contains IP address to geolocation mappings. So our data also contains fields that show the city, state and country pertaining to an IP address that a user signed in from.
We wish to be able to determine a pattern in users signing in from particular locations. We think it might help to focus on 'State' field for checking whether a user has moved locations (focusing on the 'city' field might create problems since users often move to nearby cities during weekends etc).
We wish to employ machine learning logic to determine whether a user constantly changes locations. For example, user xyz's job requires him to move around all the time and so his 'State' location changes all the time. This is normal. However, user 'abc' usually signs in from state 'amazing_state' and so her signing in from state 'not_so_amazing_state' will be an anomaly and generate an alert for us. We are thinking like Google asks you to verify your identity once it notices a change in your machine address.
What machine learning techniques or tools or software (preferably 'R' packages?) would allow us to do this?