We have data that shows usernames and their IP addresses when they connect to a particular server. The data also contains IP address to geolocation mappings. So our data also contains fields that show the city, state and country pertaining to an IP address that a user signed in from.

We wish to be able to determine a pattern in users signing in from particular locations. We think it might help to focus on 'State' field for checking whether a user has moved locations (focusing on the 'city' field might create problems since users often move to nearby cities during weekends etc).

We wish to employ machine learning logic to determine whether a user constantly changes locations. For example, user xyz's job requires him to move around all the time and so his 'State' location changes all the time. This is normal. However, user 'abc' usually signs in from state 'amazing_state' and so her signing in from state 'not_so_amazing_state' will be an anomaly and generate an alert for us. We are thinking like Google asks you to verify your identity once it notices a change in your machine address.

What machine learning techniques or tools or software (preferably 'R' packages?) would allow us to do this?


1 Answer 1


One-class classification might be appropriate. This technique is often used for anomaly detection (you'll also find other useful techniques by searching for this keyword). In this setting, you have a system that's typically in a 'normal operating regime', and you'd like to detect deviations. In the more common binary classification problem, you have labeled training examples from each class, and the goal is to learn a function that predicts the class given the input. The one-class case has a couple important differences. 1) The goal is to learn a pattern representing a single class, and anomalies are detected as 'anything that's different'. 2) The one-class classifier is only trained using examples of the single, known class (i.e. normal operating regime). This is beneficial because examples of anomalous cases might not even be available. Even if such examples exist, they might be rare, or might not cover all possible types of anomaly. One-class support vector machines are a popular implementation.

Whether you use one-class classification or another anomaly detection technique, a challenge in your application will be deciding what data to train on. The issue is that these techniques try to learn a pattern/distribution representing the 'normal' case. If any anomalous cases are included in the training data, they'll bias the method toward treating them as normal. If anomalous cases are extremely rare (and probably subject to other conditions as well), you might be able to ignore them and hope that their influence is drowned out by the overwhelming majority of normal cases. But, if your data contains a more heterogeneous mix of normal and anomalous cases, then you may have to filter out the anomalous cases before training. This would require that you already have some external criteria for identifying them.

  • $\begingroup$ I do understand the concept of 1-class classification. However, what I'm looking for is more like how to pre-process my data such that a user signing in from a particular location several times becomes the normal trend for that user, and another user signing in from different locations every time also is 'normal' for that user. Any deviations from this 'normal' behavior will generate alerts. Right now, I have 'region' or 'state' names. How do I convert them to numeric data that can be processed by the machine learning logic? $\endgroup$
    – learnerX
    Jun 27, 2016 at 17:15
  • $\begingroup$ Hmm, ok. Sounded to me like the question was more about learning algorithms than preprocessing. In terms of numeric representation of categorical data, it depends on the downstream algorithm and what you want to do. Some algorithms work well with integer encoding. Some with 'one hot'/'one-of-n' encoding. If you want to take advantage of physical distances, then geospatial coordinates (e.g. latitude/longitude) could be relevant. $\endgroup$
    – user20160
    Jun 27, 2016 at 22:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.