Documentation Index

Fetch the complete documentation index at: https://docs.darwinium.com/llms.txt

Use this file to discover all available pages before exploring further.

Time Since Last

  • Published on Jun 7, 2024
  • 1 minute(s) read
  • CG
 Prev Next

Time Since First calculates the amount of time since the selected attributes(s) were last seen in an event (e.g the most recent interaction). Time is measured in milliseconds for compatibility with other time functions.

For Example:

  • In systems where user authentication last for long periods (e.g weeks or months) it can be useful to know how long the user has been logged in for. The longer the authenticated session has been established, the greater potential risk of Account Take Over attacks occurring.
  • Knowing the period that the user has been authenticated for can allow risk assessments to 'green light' users who have recently authenticated and treat users who have been logged in for weeks or months with greater scrutiny.

The diagram below provides a visual representation of how Time Since Last is calculated:
Assuming Time Since First is configured for "Auction Listing" events with a 4 hour window, then it will select the "newest" event occurring at 15:46. A value of 6,240,000 milliseconds (104 minutes) is returned.

image.png

Configuration

  • Feature Name
    The "dictionary" name under which the feature value will be stored.

  • For Events > With The Same

    • Only Identifier and Subject attributes can be used.
Note
  • At least one of the selected attributes must be an Identifier.
Optional Configuration
  • Default Value
    A value that can be assigned to the feature if the attributes to calculate the features are not present.
  • Scope
    Can be used to extend the event search from the local node, to all nodes within the same organization all the way to all across customers (global).
  • For Events
    Provides a way of filtering past events based on their type.
  • Condition
    A Query-Language filter that can be used to refine Features for specific use cases.
  • Time Window
    Can be used to limit the Feature calculation to a specific time period/window. e.g 1 week.
  • Starting ...
    Can be used to remove recent events from Feature calculation.

Use Case 1

Determining how long a device has been logged into an account for.

Implementing In The Feature Editor

image.png

image.png

  - name: dev_acc_session_age
    default_value: 0
    time_window: all
    starting: immediately
    find_the:
      time_since_last:
        events:
          event_type:
            - account_login_success
          include_current_event: false
          with_the_same:
            - device_signature['VER_1'].identifier
            - identity['ACCOUNT'].login.login