It appears that we have a special,
powerful, valuable opportunity for how to
manipulate the data in the OP.

So, the OP has "7 Leading Fraud
Indicators: From Fresh Cookies to Null
Values".

Suppose for those 7 indicators, 4 of them
have just two possible values and the
other three have just 4 possible values or
some such. Then for one connection to the
server from a Web browser, the 7 signals
have jointly just

2^4 * 4^3 = 1,024

possible values. That is, there are only
n = 1,024 possible cases of signal data
from a Web browser from a connection to
the server. And apparently we have good
data on each of the cases.

Or, to be practical, if for some case we
have no data at all, then we just assume
that the reason is that the probability of
that case is so low that we can ignore
that case.

The central problem here is how to detect
"fraudsters". For such detection,
necessarily there are two ways to be
wrong: (1) a false alarm when we say that
a connection is from fraud when it is not
and (2) a missed detection when we say
that a connection is not from fraud when
it is.

Our mission, and we have to accept it, is
essentially to find ways of manipulating
the large amount of relevant data so that
(A) from the false alarm (1), we can
specify the highest probability of a false
alarm f we are willing to tolerate, (B)
get that probability of a false alarm f in
practice, and (C) from the missed
detections in (2), for that probability of
a false alarm f, get the lowest
probability of a missed detection (2) we
can.

Or, for the false alarms we are willing to
tolerate, we want to manipulate the data
to get all the detections we can.

So, for some notation:

P -- probability

n -- positive integer, number of different
possible cases of data from connections,
e.g., as above, n = 1,024

B -- event, connection is bad, fraud

G -- event, connection is good, not fraud

P(B) + P(G) = P(B OR G) = 1

C -- random variable, case of connection,
i = 1, 2, ..., n.

So random variable C takes values in the
set {1, 2, ..., n}.

p(i) = P(C = i)

b(i) = P(B | C = i) = P(B AND C = i)/P(C = i)

= P(B AND C = i)/p(i)

g(i) = P(G | C = i) = P(G AND C = i)/P(C = i)

= P(G AND C = i)/p(i)

B = U_i {B AND C = i}

P(B) = Sum_i P(B AND C = i)

= Sum_i p(i) P(B | C = i)

= Sum_i p(i) b(i)

P(G) = Sum_i p(i) g(i)

b(i) + g(i) = P(B | C = i) + P(G | C = i)

= P(B AND C = i)/P(C = i) + P(G AND C = i)/P(C = i)

= ( P(B AND C = i) + P(G AND C = i) )/P(C = i)

= P( (B AND C = i) OR (G AND C = i) )/P(C = i)

= P(C = i)/P(C = i) = 1

M -- event, a missed detection of a bad
connection, fraud

D -- event, detection of a bad connection, fraud

F -- event, false alarm

Detection Rule:

Suppose for some set I a subset of {1, 2,
..., n} we raise an alarm of a detection
of a bad connection, that is, fraud, when
C in I.

With this detection rule, probability of a
false alarm is

P(F) = Sum_{C in i} P(G AND C = i)

= Sum_{C in i} P(G | C = i) p(i)

= Sum_{C in i} g(i) p(i)

the probability of a detection is

P(D) = Sum_{i in I} P(B AND C = i)

= Sum_{i in I} P(B | C = i) p(i)

= Sum_{i in I} b(i) p(i)

and the probability of a missed detection
is

P(M) = P(B AND C not in I)

= Sum_{j not in I} P(B AND C = j)

= Sum_{j not in I} P(B | C = j) p(j)

= Sum_j P(B | C = j) p(j)

- Sum_{i in I} p(B | C = i) p(i)

= Sum_j P(B | C = j) p(j) - P(D)

= Sum_j P(B AND C = j) - P(D)

= P(B) - P(D)

So, to minimize the probability of a
missed detection P(M) we want to maximize
the probability of a detection P(D). We
guessed this intuitively.

To maximize the probability of a detection
P(D), suppose we have sorted our data on
the n cases so that the ratios b(i)/g(i)
are in descending order, that is, so that

b(1)/g(1) >= b(2)/g(2) >= ... >= b(n)/g(n)

Suppose we pick k in {1, 2, ..., n} and let I
= {1, 2, ..., k}.

Then for our detection rule with this k
and I, the probability of a false alarm is

P(F) = Sum_{i in I} g(i) p(i)

So, note that here really we are just
summing i = 1, 2, ..., k where, as just
above,

b(1)/g(1) >= b(2)/g(2) >= ... >= b(n)/g(n)

So, we just sort these ratios and then sum
the products g(i) p(i) on i until we get
our selected probability of false alarms
f.

As we will prove below, this is just the
thing we should do.

If we pick k too large, then our
probability of false alarms will be larger
than our selected value f. If we pick k
too small, then our probability of
detection will be smaller than we want.

Also for our detection rule with this k
and I, the probability of a detection,
what we want to maximize, is

P(D) = Sum_{i in I} b(i) p(i)

So, suppose we pick k just large enough
that P(F) = f (or close enough for
government work).

Claim: With this selection of k and I, we
get, as in (1), the probability of a false
alarm f we selected and, for that
probability of a false alarm f, get the
probability of a detection P(D) the
largest possible and, as in (2) the
probability of a missed detection the
smallest possible.

To see this claim, we want to select x_1,
x_2, ..., x_n to solve the operations
research applied mathematics resource
allocation optimization problem

Problem 1:

max z = P(D) = Sum_i x_i b(i) p(i)

subject to

P(F) = Sum_i x_i g(i) p(i) <= f

x_i = 0, 1

Yes, from the x_i, I = {i | x_i = 1}.

Problem 2:

Suppose for some L >= 0, x = (x_i) solves

max z = Sum_i x_i b(i) p(i)

- L ( Sum_i x_i g(i) p(i) - f )

subject to

x_i = 0, 1

Then since x = (x_i) solves Problem 2, we
have that for any y = (y_i) that satisfies
the constraints of Problem 1, that is

Sum_i y_i g(i) p(i) <= f

and

y_i = 0, 1

we have that

Sum_i x_i b(i) p(i)

= Sum_i x_i b(i) p(i)

- L ( Sum_i x_i g(i) p(i) - f )

>= Sum_i y_i b(i) p(i)

- L ( Sum_i y_i g(i) p(i) - f )

>= Sum_i y_i b(i) p(i)

so that x = (x_i) solves Problem 1.

For more, in Problem 2, we have

max z = Sum_i x_i b(i) p(i)

- L ( Sum_i x_i g(i) p(i) - f )

= Sum_i ( x_i b(i) p(i) - L x_i g(i) p(i) )

- L f

= Sum_i ( x_i ( b(i) p(i) - L g(i) p(i) ) )

- L f

so that x_i = 1 if and only if

x_i ( b(i) p(i) - L g(i) p(i) ) >= 0

and

b(i)/g(i) >= L

So, the way to solve Problem 1 is to pick
k = 1, 2, ..., n, set I = {1, 2, ..., k},
and set x_i = 1 for i in I and x_i = 0
otherwise so that

Sum_{i in I} x_i g(i) p(i) = f

In particular,

L = b(k)/g(l)

That is, intuitively, we are making
investments in real estate, our
probability of a false alarm

P(F) = Sum_i x_i g(i) p(i) = f

is like money.

We get to invest the money in cases i = 1,
2, ..., n. For case i,

b(i)/g(i) = (b(i)p(i))/(g(i)p(i))

is our return on investment, that is, at
investment i, the probability of detection
we get for the probability of false alarms
we are willing to tolerate.

So, we sort so that the ratios

b(1)/g(1) >= b(2)/g(2) >= ... >= b(n)/g(n)

and make investments in the order i = 1,
2, ... until we have spent all our money.

Then, for the money we have spent, that is
the best return on our investment we can
get.

Thanks to J. Lagrange, K. Pearson, J.
Neyman, and H. Everett.