Proximity

GeoAnomaly Detection

Learns where a user "normally" is, then measures how far their current location deviates from that baseline. Unlike distance (gap between two events), proximity builds a running model of typical location over time.

Returns{ distance_to_normal, normal_location, current_location }

When to Use

• Location anomaly scoring: is this user's current location unusual for them specifically?
• Complementing impossible travel detection with a personalized baseline
• Low-friction fraud signals that don't require explicit location permission — just IP geolocation

Configuration

{
  "name": "proximity_to_normal_location_30d",
  "operation": "proximity",
  "group_by": "device_id",
  "window_duration_seconds": 2592000
}

Configuration Options

Option	Default	Description
weighted	false	Use weighted updates for normal location
weight	0.2	Weight for updates when weighted is true
session_threshold_miles	50	Distance threshold for session-based updates

Response

Field	Description
normal_location	The computed "home base" { latitude, longitude }
distance_to_normal	Distance in miles from current location to normal
average_distance	Running average of all distances to normal
visit_count	Number of events processed
distance_sum	Cumulative distance from normal across all events
current_location	Current event's { latitude, longitude }

{
  "behaviors": {
    "proximity_to_normal_location_30d": {
      "normal_location": {
        "latitude": 34.0515,
        "longitude": -84.0713
      },
      "distance_to_normal": 0,
      "average_distance": 0,
      "visit_count": 2,
      "distance_sum": 0,
      "current_location": {
        "latitude": 34.0515,
        "longitude": -84.0713
      },
      "timestamp": "2025-06-12T21:13:49.219Z",
      "remaining_window_seconds": 2591988
    }
  }
}