Documentation Index

Fetch the complete documentation index at: https://docs.darwinium.com/llms.txt

Use this file to discover all available pages before exploring further.

Features Reference

Prev Next

Feature Types

Note:

  • All features other than approximates require an Identifier attribute to pivot on.

  • All Feature Types are calculated on their last 1,024 events per identifier across the whole Darwinium network, as well as optionally the current event, Except for:

    • Approximate Distinct Count Of

    • Approximate Total Count Of

    • Specificity Of

    • Quantile of Numeric

    • Time Since First, although it only gives you results from outside the last if 1024 if the following conditions are all met:

      • One attribute listed

      • No condition

      • No time window

      • Global scope

Feature Type

Description

Examples

Approximate Distinct Count Of

Highly accurate approximation of the unique values of a set one or more attributes. 
Unlike Distinct Count, any attribute may be used.

  • Number of OS seen with this User Agent String


Approximate Total Count Of

Highly accurate approximation of the total number of times a set of one or more attributes has been set (e.g., non-null).


Distance Between

Distance statistics computed between coordinates in event matching the criteria

See statistical functions for supported statistics.

  • Average distance between points


Distance Between Points Within

Distance statistics computed between coordinates in event matching additional criteria

See statistical functions for supported statistics.

  • Average distance between points


Distance From

Distance statistics computed between this coordinate and others in event matching additional criteria

See statistical functions for supported statistics.

  • Maximum distance from this login IP to any other of their logins


Distance From First

Distance computed between the location coordinate of current event and location coordinate of earliest event matching the criteria

  • Distance of Shipping Address from first order


Distance From Last

Distance computed between the location coordinate of current event and location coordinate of most recent event matching the criteria

  • Distance of Shipping Address from previous order


Distinct Count Of

Count the number of unique values for a set of attributes that occurred over the configured search criteria.

  • Number of unique accounts that this IP attempted to log in to in the last 10 minutes

  • Number of time zones this account has been seen in


Result Of Expression

Returns result of a mathematical expression. Can include numeric attributes, functions and other features. Useful when wanted in multiple rules. See DWN Query Syntax for available functions.

  • Day in millis: 24 * 60 * 60 * 1000

  • Distance:

Quantile Of Numeric

Returns the quantile between 0 - 1 for the value of numeric attribute on this event compared to full population.

  • What quantile value is this payment amount, compared to entire population?

  • Example: The quantile 0.25 would be returned, if current event had the numeric 200 if previous events had: [100, 300, 400, 500]


Specificity Of

A measure of how unique a combination of one or more attributes is.

  • Determining if the value of one or more attributes is an outlier

  • Determining if the value of one or more attributes is normal

Statistic Of Expression

Compute statistical aggregations over values of a numeric attribute using an expression in the criteria.
Statistics won't generate for those with names left empty/null.
See statistical functions for supported statistics.

  • The average (string) length of auction listing description

  • The average and minimum (string) length of a payment reference

Statistic of Numeric

Compute statistical aggregations over values of a numeric attribute in the criteria. Statistics won't generate for those with names left empty/null.
See statistical functions for supported statistics.

  • Average time on page for this user

  • Maximum mouse speed for this user and device

Time Between

Compute statistics on the time between events matching the criteria. Statistics won't generate for those with names left empty/null.
See statistical functions for supported statistics.

  • Avg and Std. Dev of time between purchases or payments

  • Detecting BOTs via repeat events exhibiting non-human precision

Time Since First

Time in milliseconds since earliest event matching the criteria

  • Time since user first used this device

Time Since Last

Time in milliseconds since most recent event matching the criteria

  • Time since fraud was last reported on this IP address

Velocity Of

Count of the number of past events that contain the same attribute values that are present in the current event subject to the search criteria.

  • Number of times this device seen today

  • Number of logins this user made in the last month, excluding today

Example: Feature Definition

  - name: device_logins_in_europe_in_month_before_today
    default_value: 0
    time_window:      
      months: 1
    starting:      
      days_in_the_past: 1
    find_the:      
      velocity_of:
        for_events:
          event_type:
            - account_login_success
          include_current_event: false          
          with_the_same:
          - profiling.device.identifier          
          condition: profiling.javascript.timezone = 'Europe/London'
    with_scope: same_node_instance

Criteria

All features have criteria that defines how and which events are included in the feature computation, along with default value and if any further aggregate features should generate.

Portal Name

Code Path

Type

Available In

Description

Feature Name

name

Text

All

Free-text for what the feature will be referred to as.

Default Value

default_value

Numeric

All

Value returned by feature in case of error or no matching events under criteria

Scope

with_scope

DWN scope_type

All

Extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).

Find The...

find_the.{feature_type}

DWN feature_type

All

Dictates what feature_type should be computed 

Specific Event Types

find_the.{feature_type}. for_events.event_type

List of DWN Event Types

All

Restricts criteria to only look for certain event type

Include Current Event

find_the.{feature_type}. for_events.include_current_event

Boolean

All

When false, will exclude event that feature is being processed on from the criteria

Condition

find_the.{feature_type}. for_events.condition

DWN Search Query

All

Restricts criteria further through open search condition. See DWN Query Structure.

With The Same

find_the.{feature_type}. for_events.with_the_same

List of DWN Identifiers/Attributes


Restricts criteria to just the identifier and attributes seen on the event in process

With Similarity

find_the.{feature_type}.for_events.with_similarity

Numeric: [0.0-100.0]


Percentage similarity to include in criteria (only applies to CONTENT attributes)

Time Window

time_window.{days/weeks/months}

Integer

All

Length of time window to look back and include events in criteria. Time length stays fixed, so earliest time considered will slide back if a starting lag is defined.

Starting

starting.{days/weeks/months}_in_the_past

Integer

All

Defines lag time before criteria window starts looking back over.  Used for excluding a recent portion of time to generate a reference feature not polluted by recent (possibly unusual) observations.

In Units

find_the.{feature_type}.in_units

kilometers or miles

Distance Only


Into Features

find_the.{feature_type}.into_features.{aggregate_function}

Line delimited {aggregate_function}:text pairs

Statistic, Distance Between/From, Time Between

This allows further features to be generated from aggregates on the feature. Useful for purpose of modelling against previous behaviour aggregates.

Attribute

find_the.{feature_type}.attribute

DWN Attribute


Define which attribute to analyse when doing count or statistic aggregations

Normalise into Fraction of Total

find_the.{feature_type}.normalize

Boolean

"Specificity Of" Only


Coordinate Attribute

find_the.{feature_type}.coordinate

DWN Coordinate Attribute

Distance Only


Statistical Functions

These are statistical functions performed by the second order aggregation available to certain features through 'Into Features'

All are computed over the value of the feature when computed for all events in criteria range.

aggregate_function

Description

count

Number of matching events

sum

Result from adding together all values 

minimum

Lowest value

maximum

Greatest value

average

Mean value: sum / count

range

maximum - minimum

mode

Value with the most appearances. Ties are resolved randomly.

median

Value that is in the middle when sorted. Interpolated when criteria has even count.

variance

Spread of values


standard_deviation



average_deviation

Average of the distance each value is from the mean

coefficient_of_variation

standard_deviation / average

sample_variance

More conservative value spread estimate, with knowledge only a sample is being evaluated

sample_standard_deviation

z_score

Normalised measure of how value on event x compares to all in criteria.


For example, assuming normal distribution, z scores indicate
0 = at average, 0.5 = top 30%, 1 = top 16%, 2 = top 2%
(with symmetry for negatives)