Distance Between | Darwinium

Find The: Distance Between

distance_between

Statistics of the distance between the locations of multiple past events matching the criteria, sorted in chronological order.

For example:

The distance travelled by a user within 1 hour. Unusually high results can indicate an account takeover, a proxy or VPN, or other suspicious activity.

Distance Between: one distance per leg of the path between events

Configuration

Feature Name: The "dictionary" name under which the feature value will be stored and referenced by in rules.
Coordinate Attribute: The attribute holding the location to measure between events. It must have the Coordinate data type.
In Units: kilometers or miles. Required.
For Events:
- With The Same: Provides a way of filtering past events based on the attribute values. There must be at least one Identifier and only Identifier and Subject attributes can be used.
Into Features: Distance Between can calculate multiple statistics from a single configuration and output them to the Feature Names given. Fill in the Feature Name for each statistic required and leave the rest blank. Every statistic you want needs its own Feature Name.

Optional Configuration

Default Value: A value that can be assigned to the feature if the attributes to calculate the features are not present.
Scope: Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
For Events:
- All event types: Default, no filter
- Same as current: Filter by event_type of event being processed
- Specific event type: List out the event_type to restrict to, as a list. Example: only consider account_login_success.
Condition: A Query-Language filter that can be used to refine Features for specific use cases.
Time Window: Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week. Default is all ; no time window
Starting: Can be used to remove recent events from Feature calculation. Default is immediately ; no lag.

Count is events, not legs

Count returns the number of events, which is one more than the number of legs measured: three events give two legs and a Count of 3. Every other statistic is calculated over the legs.

Use Case 1

Determine the distance travelled by a user within 1 hour, by summing the distance between all events in the last hour including the current one.

Using the Feature in Rules and Investigations

feature('login_dist_trav_1hr') >= 1000.0

Implementing In The Feature Editor

  - name: login_dist_trav
    default_value: 0
    time_window:
      hours: 1
    starting: immediately
    find_the:
      distance_between:
        events:
          event_type: all
          include_current_event: true
          with_the_same:
            - identity['ACCOUNT'].customer_token.customer_token
        coordinate: profiling.tcp_connection['WEBRTC'].ipdb.coordinate
        in_units: kilometers
        into_features:
          sum: login_dist_trav_1hr
    with_scope: same_node_instance