PATTERN DETECTION
Anomaly & Pattern Detection
VIRCON's anomaly detection system automatically identifies unusual activity patterns by comparing current behavior against historical baselines. Pattern detection identifies repeat offenders and coordinated rule violations, enabling proactive moderation and early intervention.
Anomaly & Pattern Commands
Commands for triggering scans, viewing alerts, and resolving detected anomalies.
- ,anomaly check - Run immediate anomaly scan
- ,anomaly alerts [days] - View recent anomaly alerts
- ,anomaly baseline - Recalculate normal activity baseline
- ,anomaly resolve <alert_id> <notes> - Mark anomaly as investigated
- ,patterns [days] [min_actions] - Detect repeat offenders
Detection Types
Categories of anomalous behavior automatically flagged by the detection system.
| Type | Threshold | Severity |
|---|---|---|
Moderation Spike Unusually high ban/kick rate in short timeframe | 3x average hourly rate | High |
Staff Outlier Behavior Staff member acting outside normal patterns | 5+ actions in 10 minutes OR unusual severity | Medium |
Repeat Offender Pattern User with multiple violations in rolling window | 3+ incidents in 7 days | Low-Medium |
Coordinated Activity Multiple users exhibiting similar rule violations | 3+ users, same violation type, <1 hour apart | Medium-High |
Join Wave Anomaly Unusual spike in new member joins | 10+ joins in 5 minutes | High (raid indicator) |
Anomaly Detection Workflow
Automated detection cycle from baseline comparison through alert generation and investigation.
- 1. System runs anomaly detection every 15 minutes via scheduled job.
- 2. Current activity compared against rolling 30-day baseline averages.
- 3. Deviations exceeding threshold (2-3 standard deviations) flagged.
- 4. Anomaly alert created with severity, type, affected users/staff.
- 5. Alert sent to admin channel if severity is Medium or higher.
- 6. Staff investigates using ,anomaly alerts to view details.
- 7. Once investigated, staff resolves alert with ,anomaly resolve and notes.
- 8. Resolved anomalies tracked for trend analysis and pattern refinement.
Pattern Detection Process
Daily analysis for identifying repeat offenders and behavioral patterns requiring intervention.
- Daily scan identifies users with 3+ incidents in rolling 7-day window.
- Pattern types: repeat harassment, ban evasion attempts, policy violations.
- Confidence scoring based on incident frequency and severity distribution.
- Auto-flags high-confidence patterns (80%+) for staff review.
- Integration with trust scoring - patterns lower trust score.
- Pattern data feeds into risk forecasting and prediction models.
Anomaly Database Schema
Database structure for storing detected anomalies, deviation scores, and investigation results.
| Field | Description |
|---|---|
| anomaly_id | Unique anomaly alert identifier. |
| detected_at | Timestamp of anomaly detection. |
| anomaly_type | moderation_spike, staff_outlier, join_wave, etc. |
| severity | low, medium, high, critical. |
| description | Auto-generated description of anomaly. |
| affected_users | JSON array of user IDs involved. |
| affected_staff | JSON array of staff IDs involved (if applicable). |
| baseline_value | Normal expected value for comparison. |
| actual_value | Observed value that triggered anomaly. |
| deviation_score | Standard deviations from baseline. |
| status | pending, investigating, resolved, false_positive. |
| resolved_by | Staff who investigated and resolved. |
| resolution_notes | Investigation findings and outcome. |
| resolved_at | Timestamp of resolution. |
Pattern Database Schema
Database structure for tracking repeat offender patterns and confidence scoring.
| Field | Description |
|---|---|
| pattern_id | Unique pattern identifier. |
| user_vrc_id | VRChat user exhibiting pattern. |
| pattern_type | repeat_offender, harassment_cycle, policy_violation. |
| incident_count | Number of incidents in pattern. |
| first_incident_at | Timestamp of earliest incident in pattern. |
| last_incident_at | Timestamp of most recent incident. |
| confidence_score | 0-100 likelihood of intentional pattern. |
| flagged_at | Timestamp when pattern was detected. |
| reviewed | Boolean: has staff reviewed this pattern. |
Automation Features
Scheduled scans, adaptive baselines, and intelligent alerting to reduce manual monitoring.
- Real-time anomaly detection every 15 minutes (configurable interval).
- Auto-alerts to admin channel for high/critical severity only (reduces noise).
- Baseline auto-recalculation weekly to adapt to community growth.
- Pattern detection daily scan at 01:00 UTC with summary report.
- False positive learning - resolved false positives adjust thresholds.
- Integration with incident reports - anomalies can auto-create incidents.
Real-World Use Cases
Practical examples of anomaly detection identifying security threats and unusual patterns.
Case 1
10 new users join within 3 minutes
Detection: Join wave anomaly triggered, severity: high
Action: Auto-alert sent, head admin reviews, determines organic growth spike
Outcome: Resolved as false positive, baseline adjusted
Case 2
Staff member issues 8 bans in 15 minutes
Detection: Staff outlier behavior detected
Action: Admin reviews - staff was responding to coordinated raid
Outcome: Resolved with notes, raid linked to event mode activation
Case 3
User with 5 warnings in 10 days
Detection: Repeat offender pattern flagged, confidence 85%
Action: Staff reviews history, escalates to temporary ban
Outcome: Pattern confirmed, user on moderation watchlist
Best Practices
Guidelines for effective anomaly investigation and pattern analysis workflows.
- Review anomaly alerts within 24 hours - don't let them pile up.
- Mark false positives consistently so system learns and improves.
- Use pattern detection weekly to identify users needing intervention.
- Adjust baseline manually after major community events (prevents noise).
- Cross-reference staff outlier alerts with strike history before acting.
- Document resolution notes thoroughly for trend analysis and audits.