I just booked my flight to DefCon, and I went through the normal checklist. Two beds, check. Smoking room, check. But wait, I’m guy traveling alone, and I don’t smoke (except for the occasional cigar). Vegas is known for it’s statistics. The statisics that go into making the casinos work, is truely amazing, but what does something like that mean to a Casino? Up until a year or two ago I was going to Vegas once every month and I always got a single queen sized bed, in a non smoking room with the exception of the first weekend of August when I always got two beds and a smoking room.

If I were sitting there, as a statistics weenie working at a Casino, I would be scratching my head. I mean, here is a clear anomaly, that clearly means something, but given the information they have on file for me, it’s meaningless information. Predictable, yes, meaningful, no. So how can a complex system that intends to predict user behavior handle something like that? Well clearly, it just simply must take it as a datapoint and continue to expect it. And if I’m in Vegas at all in the first weekend in August, I’ll be getting the same kind of room.

For anomaly detection, this is actually a useful peice of information. It’s predictable, it’s easy to detect if you extrapolate it out over a multiple year timeframe, and it can be used to target me as a unique individual. It’s really a gold mine of information if you look at it that way, but it also doesn’t mean anything to anyone but me. I asked my girlfriend who really should know, if anyone else in the whole world would, and even she had no idea why I would do that. Yet, year after year, I do the exact same thing. Two beds, in a smoking room (yet, I don’t smoke).

So, the answer is pretty boring, which is that lots of times hackers are down and out and need a place to crash, and I like to have an extra bed, just in case. The smoking part comes in to play because a lot of times I end up with hackers in my room and they smoke and I don’t want to get charged more for them messing up the room. So it has everything to do with an environmental variable that is not exposed through the Casino booking interface, which is that a particular convention is in town the first weekend of August. Tying that in with the other times I’m in Vegas wouldn’t work, but during those times I am getting a normal room.

In this particular scenario I’m actually an advocate for anomaly detection, where most of the time I think it’s really a psuedo science - in the same way I think certain dinosaur’s vision, which tracked only motion is only practical so long as your prey doesn’t stand completely still. All it would take is for my girlfriend to tag along once, and I would end up with a single bed, and a non-smoking room, which would throw them off even more. It’s a strange issue that anomaly detection helps identify, but not to diagnose.

This entry was posted on Thursday, July 20th, 2006 at 8:40 am and is filed under Random Security. You can leave a response as well.