While we wait for our labeled data, let's work on some unsupervised methods for anomaly detection. If the hackers are conspicuous and distinct from our valid users, unsupervised methods may prove pretty effective. This is a good place to start before we have labeled data, or if the labeled data is difficult to gather or not guaranteed to be representative of the full spectrum we are looking to flag. Note that, in most cases, we won't have labeled data, so it is crucial that we are familiar with some unsupervised methods.
In our initial EDA, we identified the number of usernames with a failed login attempt in a given minute as a feature for anomaly detection. We will now pursue some unsupervised anomaly detection, using this feature as the jumping-off point. Scikit-learn provides a few algorithms for unsupervised anomaly detection. In the
2-unsupervised_anomaly_detection...
