Time Between measures the time elapsed between events matching the configured criteria. Time is measured in milliseconds and many different statistics are available. This is useful for establishing behavioral patterns for accounts, users and devices and comparing with the current behaviour to see if it is irregular or suspicious.
For Example:
- Calculating the standard deviation of the Time Between Account Logins and comparing with the time since the last Login to see how many standard deviations away it is from the established behaviour.
- Detecting BOT or script attacks via bursts of events that are too fast to be humanly possible OR occuring regularly at a precise intervals.
The diagram below provides a visual representation of how Time Between is calculated:
Assuming Time Between was configured for "Auction Listing" events over the last 24 hours, there are three matching events yielding two time spans. In this scenario the Count would be 2, the Minimum would be 2,460,000 milliseconds (41 minutes), Maximum would be 2,760,000 milliseconds (46 minutes) and the Average would be 2,610,000 milliseconds (43.5 minutes).
Configuration
-
Feature Name
The "dictionary" name under which the feature value will be stored. -
For Events > With The Same
- Only Identifier and Subject attributes can be used.
- At least one of the selected attributes must be an Identifier.
- Into Features
- Time Between can calculate multiple statistics from a single configuration and output them to the Feature Names given. Simply fill in the Feature Name for the required statistics, any that are not required can be left blank.
- There are multiple Feature Names generated, a Feature Name must be given to each of the required statistics.
- Default Value
A value that can be assigned to the feature if the attributes to calculate the features are not present. - Scope
Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global). - For Events
Provides a way of filtering past events based on their type. - Condition
A Query-Language filter that can be used to refine Features for specific use cases. - Time Window
Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week. - Starting ...
Can be used to remove recent events from Feature calculation.
Use Case 1
BOT or script attacks that are set to occur at a precise interval (e.g every 10 seconds) can be detected using both the average and standard deviation of the Time Between events. Activity performed by a real human will not be as precise and have a higher standard deviation.
To implement this we compare the standard deviation of the Time Between events with the average Time Between events.
If the standard deviation is lower than 10% of the average then the timing between events has been occured with high accuracy. This is unusual for a human to generate such perfectly timed events and can be an idicator that is has been generated by a script or BOT.
Implementing In The Feature Editor
