Ratio

RateProportion

Measures the proportion of one event type relative to another — expressed as a value between 0 and 1. A ratio of 0.9 means 9 out of 10 interactions were the "bad" type.

Returns{ n, d, ratio }

When to Use

• Skip rate: out of all song interactions, how many were skips? (SkipSong / (SkipSong + PauseSong))
• Failure rate: out of all login attempts, how many failed?
• Rejection rate: out of all content actions, how many were negative?

Configuration

{
  "name": "ratio_of_failed_logins_1hr",
  "group_by": "session_id",
  "operation": "ratio",
  "fields": ["Failed Login", "Login"],
  "window_duration_seconds": 3600,
  "operation_config": {
    "allow_intermediate_events": false
  }
}

How fields work:

• First field in fields is the numerator, second is the denominator
• Ratio = numerator / (numerator + denominator)
• Use pipe-separated values for multiple event types: "failed_login|login_error"

Response

A user fails to login 4 times before a successful login:

{
  "behaviors": {
    "ratio_of_failed_logins_1hr": {
      "n": 4,
      "d": 1,
      "ratio": 0.8,
      "timestamp": "2025-06-12T21:25:52.972Z",
      "remaining_window_seconds": 3543
    }
  }
}

---

Use Case: Skip Rate Detection

A music platform wants to identify users with abnormally high skip rates. A real user occasionally skips; a bad actor or bot may be skipping through content at near-100% rates.

{
  "name": "skip_rate_1h",
  "group_by": "identity",
  "operation": "ratio",
  "fields": ["SkipSong", "PauseSong"],
  "window_duration_seconds": 3600
}

{
  "behaviors": {
    "skip_rate_1h": {
      "n": 54,
      "d": 6,
      "ratio": 0.9,
      "timestamp": "2025-06-12T16:52:04.940Z",
      "remaining_window_seconds": 1843
    }
  }
}

Combine with count for stronger signals

A skip ratio of 0.9 is more meaningful if the user has also generated 60+ events in the past hour. A user with skip_rate: 0.9 and song_plays_1h: 3 is probably just having a bad music day. A user with skip_rate: 0.9 and song_plays_1h: 347 is almost certainly a bot. Use both behaviors together in your detection logic.