System and method for outlier detection in gaming

A method for detecting anomalies in online gaming patterns, the method comprising:

• extracting by a processor, event features from a time series data related to events of online gaming activities;
• calculating by the processor, a normalized density estimation for each of the events;
• assigning by the processor, outlier probability for each of the events based on the normalized density estimation of the event;
• determining by the processor, that an event is an outlier event if the outlier probability of the event is above an outlier threshold;
• calculating by the processor, for a window of the time series data, a set of window features based on the outlier events in the window;
• modeling by the processor, the window features by a generative model;
• assigning by the processor, outlier confidence value for each of the suspected windows based on the distribution of the window features relatively to the generative model;
• determining by the processor, that a window is a suspected window if the outlier confidence value of the window is above a confidence threshold;
• finding by the processor, unique players inside the suspected windows based on player attributes;
• generating by the processor, a unique player count histogram by counting the number of outlier events associated with each of the unique players inside each of the suspected windows;
• calculating by the processor, a distribution metric of the unique players count histogram;
• determining by the processor, that the outlier events in the suspected window originate from the fraudulent event if the distribution metric is above a unique players threshold and that the outlier events in the suspected window originate from the operational problem otherwise;
• and
• providing by the processor, a notification to an operator of the online gaming activities in case the outlier events in the suspected window originate from one of the fraudulent event and the operational problem, wherein the notification comprises details of a suspected player if the outlier events in the suspected window originate from a fraudulent event.

A system for detecting anomalies in time series data related to online gaming patterns, the system comprising:

• a memory;
• and
• a processor configured to:
• obtain a time series data related to events of online gaming activities;
• extract event features of the events wherein the event features comprise statistics on the time series data;
• detect outlier events in the time series data based on the event features;
• calculate, for a window, a set of window features based on the pattern and distribution of outlier events in the window;
• detect a suspected window in the time series data based on distribution of the window features;
• analyze, a distribution of players inside the suspected window;
• determine whether outlier events in the suspected window originate from one of a fraudulent event and an operational problem, based on the distribution of players;
• and
• provide by the processor, a notification to an operator of the online gaming activities in case the outlier events in the suspected window originate from one of the fraudulent event and the operational problem, wherein the notification comprises details of a suspected player if the outlier events in the suspected window originate from a fraudulent event.