It appears that we have a special, powerful, valuable opportunity for how to manipulate the data in the OP.

So, the OP has "7 Leading Fraud Indicators: From Fresh Cookies to Null Values".

Suppose for those 7 indicators, 4 of them have just two possible values and the other three have just 4 possible values or some such. Then for one connection to the server from a Web browser, the 7 signals have jointly just

     2^4 * 4^3 = 1,024

possible values. That is, there are only n = 1,024 possible cases of signal data from a Web browser from a connection to the server. And apparently we have good data on each of the cases.

Or, to be practical, if for some case we have no data at all, then we just assume that the reason is that the probability of that case is so low that we can ignore that case.

The central problem here is how to detect "fraudsters". For such detection, necessarily there are two ways to be wrong: (1) a false alarm when we say that a connection is from fraud when it is not and (2) a missed detection when we say that a connection is not from fraud when it is.

Our mission, and we have to accept it, is essentially to find ways of manipulating the large amount of relevant data so that (A) from the false alarm (1), we can specify the highest probability of a false alarm f we are willing to tolerate, (B) get that probability of a false alarm f in practice, and (C) from the missed detections in (2), for that probability of a false alarm f, get the lowest probability of a missed detection (2) we can.

Or, for the false alarms we are willing to tolerate, we want to manipulate the data to get all the detections we can.

So, for some notation:

P -- probability

n -- positive integer, number of different possible cases of data from connections, e.g., as above, n = 1,024

B -- event, connection is bad, fraud

G -- event, connection is good, not fraud

P(B) + P(G) = P(B OR G) = 1

C -- random variable, case of connection, i = 1, 2, ..., n.

So random variable C takes values in the set {1, 2, ..., n}.

p(i) = P(C = i)

b(i) = P(B | C = i) = P(B AND C = i)/P(C = i)

= P(B AND C = i)/p(i)

g(i) = P(G | C = i) = P(G AND C = i)/P(C = i)

= P(G AND C = i)/p(i)

B = U_i {B AND C = i}

P(B) = Sum_i P(B AND C = i)

= Sum_i p(i) P(B | C = i)

= Sum_i p(i) b(i)

P(G) = Sum_i p(i) g(i)

b(i) + g(i) = P(B | C = i) + P(G | C = i)

= P(B AND C = i)/P(C = i) + P(G AND C = i)/P(C = i)

= ( P(B AND C = i) + P(G AND C = i) )/P(C = i)

= P( (B AND C = i) OR (G AND C = i) )/P(C = i)

= P(C = i)/P(C = i) = 1

M -- event, a missed detection of a bad connection, fraud

D -- event, detection of a bad connection, fraud

F -- event, false alarm

Detection Rule:

Suppose for some set I a subset of {1, 2, ..., n} we raise an alarm of a detection of a bad connection, that is, fraud, when C in I.

With this detection rule, probability of a false alarm is

P(F) = Sum_{C in i} P(G AND C = i)

= Sum_{C in i} P(G | C = i) p(i)

= Sum_{C in i} g(i) p(i)

the probability of a detection is

P(D) = Sum_{i in I} P(B AND C = i)

= Sum_{i in I} P(B | C = i) p(i)

= Sum_{i in I} b(i) p(i)

and the probability of a missed detection is

P(M) = P(B AND C not in I)

= Sum_{j not in I} P(B AND C = j)

= Sum_{j not in I} P(B | C = j) p(j)

= Sum_j P(B | C = j) p(j)

- Sum_{i in I} p(B | C = i) p(i)

= Sum_j P(B | C = j) p(j) - P(D)

= Sum_j P(B AND C = j) - P(D)

= P(B) - P(D)

So, to minimize the probability of a missed detection P(M) we want to maximize the probability of a detection P(D). We guessed this intuitively.

To maximize the probability of a detection P(D), suppose we have sorted our data on the n cases so that the ratios b(i)/g(i) are in descending order, that is, so that

b(1)/g(1) >= b(2)/g(2) >= ... >= b(n)/g(n)

Suppose we pick k in {1, 2, ..., n} and let I = {1, 2, ..., k}.

Then for our detection rule with this k and I, the probability of a false alarm is

P(F) = Sum_{i in I} g(i) p(i)

So, note that here really we are just summing i = 1, 2, ..., k where, as just above,

b(1)/g(1) >= b(2)/g(2) >= ... >= b(n)/g(n)

So, we just sort these ratios and then sum the products g(i) p(i) on i until we get our selected probability of false alarms f.

As we will prove below, this is just the thing we should do.

If we pick k too large, then our probability of false alarms will be larger than our selected value f. If we pick k too small, then our probability of detection will be smaller than we want.

Also for our detection rule with this k and I, the probability of a detection, what we want to maximize, is

P(D) = Sum_{i in I} b(i) p(i)

So, suppose we pick k just large enough that P(F) = f (or close enough for government work).

Claim: With this selection of k and I, we get, as in (1), the probability of a false alarm f we selected and, for that probability of a false alarm f, get the probability of a detection P(D) the largest possible and, as in (2) the probability of a missed detection the smallest possible.

To see this claim, we want to select x_1, x_2, ..., x_n to solve the operations research applied mathematics resource allocation optimization problem

Problem 1:

max z = P(D) = Sum_i x_i b(i) p(i)

subject to

P(F) = Sum_i x_i g(i) p(i) <= f

x_i = 0, 1

Yes, from the x_i, I = {i | x_i = 1}.

Problem 2:

Suppose for some L >= 0, x = (x_i) solves

max z = Sum_i x_i b(i) p(i)

- L ( Sum_i x_i g(i) p(i) - f )

subject to

x_i = 0, 1

Then since x = (x_i) solves Problem 2, we have that for any y = (y_i) that satisfies the constraints of Problem 1, that is

Sum_i y_i g(i) p(i) <= f

and

y_i = 0, 1

we have that

Sum_i x_i b(i) p(i)

= Sum_i x_i b(i) p(i)

- L ( Sum_i x_i g(i) p(i) - f )

>= Sum_i y_i b(i) p(i)

- L ( Sum_i y_i g(i) p(i) - f )

>= Sum_i y_i b(i) p(i)

so that x = (x_i) solves Problem 1.

For more, in Problem 2, we have

max z = Sum_i x_i b(i) p(i)

- L ( Sum_i x_i g(i) p(i) - f )

= Sum_i ( x_i b(i) p(i) - L x_i g(i) p(i) )

- L f

= Sum_i ( x_i ( b(i) p(i) - L g(i) p(i) ) )

- L f

so that x_i = 1 if and only if

x_i ( b(i) p(i) - L g(i) p(i) ) >= 0

and

b(i)/g(i) >= L

So, the way to solve Problem 1 is to pick k = 1, 2, ..., n, set I = {1, 2, ..., k}, and set x_i = 1 for i in I and x_i = 0 otherwise so that

Sum_{i in I} x_i g(i) p(i) = f

In particular,

L = b(k)/g(l)

That is, intuitively, we are making investments in real estate, our probability of a false alarm

P(F) = Sum_i x_i g(i) p(i) = f

is like money.

We get to invest the money in cases i = 1, 2, ..., n. For case i,

b(i)/g(i) = (b(i)p(i))/(g(i)p(i))

is our return on investment, that is, at investment i, the probability of detection we get for the probability of false alarms we are willing to tolerate.

So, we sort so that the ratios

b(1)/g(1) >= b(2)/g(2) >= ... >= b(n)/g(n)

and make investments in the order i = 1, 2, ... until we have spent all our money.

Then, for the money we have spent, that is the best return on our investment we can get.

Thanks to J. Lagrange, K. Pearson, J. Neyman, and H. Everett.