Features Overview

Features Overview

Features are numeric values and can be calculated on any step in real-time, taking past events and performing complex calculations such as Count, Count Distinct, Time, Distance, Specificity etc.
Features are analogous to variables inside a coding language, where Features are the program variables and Rules are the program logic (or code) using the Features to affect the logic path.
Features are used in Rules, Models and Decision Strategy so that past behaviour can be used to as part of the risk assessment. Features are also visible within the Sidebar when viewing an event.

The following screen shot shows Velocity Of features rendered in the Event Sidebar

Feature Editor

Features are files with the extension ".feature.yaml". The Feature Editor is launched by double clicking on a Feature file within Workflows section of the Darwinium portal.
If no Feature file exists, simply create a new file and give it the extension ".feature.yaml".

As the file extension suggests, Features are written in YAML to make them understandable when viewing diffs across different versions.

Feature Configuration

Feature Name

Features have a name to identify them e.g "num_devices_for_login_week". Whilst they are not required to be unique, keeping them unique prevents name collisions that may occur between different Feature files (overwriting each others results at run time).

Feature Results

• The result of User defined features are output to the outcome['CHAMPION'].features.general attribute, which is a name-value pair dictionary (also known as map) attribute. The Feature Name is used as a key to retrieve the Feature value:

outcome['CHAMPION'].features.general['feature_name_here']

• Similarly, the result of Darwinium defined features are output to the outcome['CHAMPION'].features.darwinium attribute, which only differs only by attribute name:

outcome['CHAMPION'].features.darwinium['cnt_scrnres_for_dvcid']

The screenshot below show Darwinium features in the Event Sidebar:

Using Features In Rules and Investigations

Features are stored in a name/value pair attribute (also known as dictionary or associative array data type). They can be referenced by name and compared with a value to form a filter (resulting in a Boolean expression).

The following is an example of searching for events within Investigations Query, where the value of the Feature named "some_other_feature" is above or equal to 34.92.

outcome['CHAMPION'].features.general['some_other_feature'] >= 34.92

The same Query Language syntax can be copied and pasted directly into a new "Named Condition" Rule as follows:

Feature Type

Counting Features

Velocity Of - A count of events with the same attribute value over time.
Distinct Count Of - A count of events with unique attribute values over time.
Specificity Of - A measurement of how unique a particular attribute value is compared to the full population.
Approximate Distinct Count Of - An approx. count of events with unique attribute values over time - not restricted to identifier/subjects.
Approximate Total Count Of- An approx. count of events where attribute value is populated (not null) - not restricted to identifier/subjects.

Statistic Features

Statistic Of Numeric - The value of a numeric attribute across multiple events into common statistics .(sum/min/max/mean/stddev).
Statistic Of Expression - A numeric query language into common statistics (min/max/mean/stddev).
Quantile Of Numeric - The probability distribution for a numeric typed attribute.

Time Features

Time Between - Elapsed time between multiple events into common statistics (min/max/mean/stddev).
Time Since First - Time elapsed from oldest event to now.
Time Since Last - Time elapsed from most recent event to now.

Distance Features

Distance From - Distance between current and multiple past events into common statistics (min/max/mean/stddev).
Distance From First - Distance in km/miles from now to oldest event.
Distance From Last - Distance in km/miles from now to newest event.
Distance Between - Distance between multiple events in km/miles into common statistics (min/max/mean/stddev).
Distance Between Points Within - Distance between 2 points, repeated across multiple events into common statistics (min/max/mean/stddev).

Other Features

Result Of Expression - Result of query language expression - expression may incorporate other features.

Default Value

Features perform calculations on attributes from both the current and past events. A feature may be configured to use a certain attribute, say profiling.device.identifier. In this case, if profiling.device.identifier is not populated within the current event then the feature cannot be computed. A default value can be optionally assigned in this case to make downstream rules, features or analysis easier.

Scope

Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).

Same Node Instance - the event for the Feature will be sourced only from the node where the event is currently being processed. In cases where Production, Staging and Sanbox nodes exist, this option will prevent test data that is sent to the Staging and Sandbox environments from interfering and causing false positives in the Production node.

Same Organization - the events for the Feature will be sourced from all nodes within the current Organization. If Production, Staging and Sandbox nodes exist, then all of these nodes will be searched for matching events.

Global - the events for the Feature will be sourced across all Darwinium customers. This can be useful for checking if an Email Address, Device or other Identifier has been seen by another Darwinium customer to determine the age and other behavioural data.

Same Primary Industry - the events for the Feature will be sourced across all Darwinium customers with the same Primary Industry type. This can be used to eliminate high level conflicts within use cases - for example if a user has performed fraud in online retail, they may not be considered a bad actor in Health Care or Insurance.

Same Primary and Secondary Industry - a more fine grained industry filter using the Secondary Industry type to eliminate cross use-case false positives.

Attributes

Some Feature types, such as Distinct Count Of perform a function on values for a configurable set of attributes. For such Features, the Attributes setting is where this configuration takes place.

For these Feature types, "With The Same" is somewhat analogous to creating a pivot table upon the selected values; In this analogy the Attributes setting is the equivalent of filtering the rows of the pivot table for the conifgured Attributes values.

Most Features with an Attributes configuration allow the use of only Subject and Identifier attributes.

Identifiers and Subjects are special attributes that are stored and accessible in real-time by Darwinium Features. Most Features require at least one Identifier to be specified. Refer to the specific documentation for a particular Feature for more detailed information.

For Events

For Events provides a way of filtering past events based on their type.

• All event Types - is a wildcard matching any event type.
• Same as current - matches events that only have the same type as the current event.
• Specific event types - provides a user configurable list of event type matches.
• Include Current Event - specifies if the current event is included as part of the Feature calculation or excluded from the Feature calculation explicitly.

Condition

Condition is an (optional) Query-Language filter that can be used to refine Features for specific use cases.

The following Condition could be used on a Velocity Of Feature to determine the number of high value purchases have been made from mobile devices:

purchase.amount >= 10000.00 AND profiling.wurfl.is_mobile

With The Same

Is used to specify which attributes from the current event must be present and match the values in the current event when a Feature is being calculated. This is somewhat analgous to creating a pivot table for the configured attributes.

Time Window

Time Windowing is an important facet of behavioral analysis. The behaviour of a user or device can for example be measured over the last hour and compared with past behaviour in another 1 hour window at various points in the past to determine if the behaviour is similar or drastically different.
Most Features have the option to specify a Time Window filter that can be used to restrict the input events to a fixed time period such as 6 hours, 5 days, 2 weeks etc.

The following diagram illustrates a Time Window of 12 days

Starting

For Features that have a Time Window option, the starting point of configured time window can be Immediate (meaning at the time the event occurs) or can be extended further back into the past, as a means of excluding recent behaviour.

The following diagram illustrates a Time Window of 12 days that has been offset to be Starting 7 days in the past

Into Features

Statistics functions are useful for behaviour and risk assessment, often multiple are required on the same criteria. To avoid the overhead of creating one Feature per function, the Into Features configuration is used to define criteria once and simply specify the Feature Name for each function. If a function is not required, simply leave the Feature Name blank.

Statistic Functions

• Average
• Coefficient Of Variation
• Count
• Maximum
• Mean Deviation
• Median
• Minimum
• Mode
• Range
• Sample Standard Deviation
• Sample Variance
• Standard Deviation
• Sum
• Variance
• Z Score