google / exposure-notifications-verification-server

Verification component for COVID-19 Exposure Notifications.

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Anomaly detection for codes claimed and tokens claimed

sethvargo opened this issue · comments

TL;DR

Build anomaly detection for the ratio of codes claimed to codes issued and the ratio of tokens claimed to codes claimed.

Design

Proposal
Leverage the existing modeler component for abuse prevention, but add a different modeler calculation. This can be based purely on the last N days of historical data as a pure average + standard deviation. If the most recent ratio is more than one standard deviation less than the computed historical average, it's considered an anomaly.

Alternatives considered
More complex linear regression models.

Steps

  • Add new modeling calculation
  • Add feature flag
  • Add to system admin UI
  • Add to realm's view
  • Emit metric on anomalies for server operators
  • Add alert for metric