What is value scoring in behavioral analytics?

Value scoring assigns a monetary potential to each visitor session based on behavioral patterns correlated with past conversions. It considers factors like product page engagement, comparison behavior, and return visit frequency to estimate likely purchase value.

How does anomaly detection work for web analytics?

Anomaly detection uses statistical models to identify sessions that deviate significantly from normal behavioral patterns. This flags potential fraud, bot activity, or unusual user behavior that warrants investigation — all computed at the edge in real time.

Can behavioral anomaly detection catch ad fraud?

Yes. Behavioral anomaly detection identifies non-human patterns like unnaturally consistent click timing, zero scroll depth with page completions, and impossibly fast form submissions — signals that traditional click-fraud tools miss because they only look at IP and device fingerprints.

Value Scoring and Anomaly Detection

What You'll See in the Dashboard

In the Intelligence tab, Value Estimator and Anomaly Detection scores appear as real-time cards. The Value score helps you prioritize high-value visitors; the Anomaly score flags unusual behavior for investigation. Click any card for trend charts and contributing signals.

Business Actions: Set up alerts when Value > 80 to notify sales teams of high-value visitors. Configure Anomaly > 70 alerts to flag potential bot traffic or suspicious behavior for review in the Signals tab.

Model 4: Value Estimator

The value estimator predicts the monetary value a visitor is likely to generate, either in the current session or over their customer lifetime. This score drives prioritization: when support resources are limited, you want to focus on your highest-value visitors.

Value Signal Weights

Signal	Weight	Description
Cart value / plan tier viewed	0.25	Direct monetary signal: items in cart or pricing tier being evaluated
Intent score	0.20	Higher intent = higher expected value (cross-model dependency)
Historical visitor value	0.15	Past purchase amount for returning visitors
Engagement depth	0.12	Deep engagement with high-value content (product specs, pricing)
Referral source quality	0.10	Visitors from high-converting channels score higher
Session page count	0.08	More pages = more consideration = higher potential value
Device and geo signals	0.06	Desktop users and certain geos correlate with higher AOV
Time-of-day pattern	0.04	Business hours vs. off-hours browsing correlates with purchase intent

E-Commerce Scoring Formula

For e-commerce sites, the value estimator uses a weighted combination that emphasizes direct monetary signals:

TypeScript

function estimateEcommerceValue(features: BehavioralFeatures, context: SessionContext): number {
  // Direct value signals
  const cartSignal = Math.min(features.cartValue / siteAvgOrderValue, 2.0) * 25;
  const intentSignal = features.intentScore * 0.20;

  // Historical value (returning visitors only)
  const historySignal = context.isReturning
    ? Math.min(context.historicalLTV / siteAvgLTV, 3.0) * 15
    : 7.5; // neutral for new visitors

  // Engagement and behavior signals
  const engagementSignal = features.engagementScore * 0.12;
  const referralSignal = channelValueMultiplier[context.referrerCategory] * 10;
  const depthSignal = Math.min(features.pageViewCount / 8, 1) * 8;
  const deviceGeoSignal = (context.deviceType === 'desktop' ? 4 : 2)
    + geoValueMultiplier[context.geoRegion] * 2;
  const timeSignal = isBusinessHours(context.localHour) ? 4 : 2;

  return Math.min(100, Math.round(
    cartSignal + intentSignal + historySignal + engagementSignal
    + referralSignal + depthSignal + deviceGeoSignal + timeSignal
  ));
}

SaaS Scoring Formula

For SaaS products, the formula shifts emphasis from cart value to plan tier evaluation and feature exploration:

TypeScript

function estimateSaaSValue(features: BehavioralFeatures, context: SessionContext): number {
  // Plan tier signal: which pricing tier is the user evaluating?
  const tierSignal = planTierValue[features.highestPlanViewed] * 25;
  // e.g., { free: 0.1, starter: 0.3, professional: 0.6, enterprise: 1.0 }

  // Feature exploration: users who explore more features = higher potential
  const featureExploration = Math.min(features.uniqueFeaturesViewed / 10, 1) * 15;

  // Trial engagement (if applicable)
  const trialSignal = features.trialActionsCompleted
    ? Math.min(features.trialActionsCompleted / 5, 1) * 20
    : features.intentScore * 0.15;

  // Company signals (if identifiable from IP/domain)
  const companySignal = context.companySize
    ? companySizeMultiplier[context.companySize] * 12
    : 6;

  return Math.min(100, Math.round(
    tierSignal + featureExploration + trialSignal + companySignal
    + features.engagementScore * 0.10
    + (context.isReturning ? 8 : 3)
  ));
}

Value × Frustration Alert

One of the most actionable combinations in the entire scoring system: a high-value visitor experiencing high frustration. This triggers an immediate alert because the revenue at risk is significant.

TypeScript

function checkValueFrustrationAlert(scores: BehavioralScores): Alert | null {
  if (scores.valueEstimate >= 70 && scores.frustrationScore >= 50) {
    return {
      type: 'high_value_frustration',
      severity: 'critical',
      message: `High-value visitor (${scores.valueEstimate}) frustrated (${scores.frustrationScore})`,
      recommendedAction: 'proactive_chat',
      estimatedRevenue: dollarValueFromScore(scores.valueEstimate)
    };
  }
  return null;
}

Model 5: Anomaly Detection

The anomaly score identifies behavioral patterns that deviate significantly from established baselines. This serves dual purposes: detecting bots and fraud, and identifying genuinely unusual (but human) behaviors that may require attention.

Dual Baseline Comparison

Every behavioral feature is compared against two baselines simultaneously:

Site baseline: The aggregate behavioral distribution across all visitors to this site. This catches behavior that is unusual for your site specifically.
Visitor baseline: The individual visitor's historical behavior (for returning visitors). This catches behavior that is unusual for this particular user.

The anomaly score is the maximum of the two z-scores, normalized to 0–100:

Formula

anomalyScore = sigmoid(max(
  |feature - siteMean| / siteStdDev,
  |feature - visitorMean| / visitorStdDev
)) * 100

Anomaly Types

Anomaly Type	Detection Signal	Typical Cause	Action
Speed anomaly	Event rate > 3σ above site mean	Bot, automated testing, or power user	Bot check or whitelist
Pattern anomaly	Navigation sequence rarely seen in site data	Scraper, vulnerability scanner, or lost user	CAPTCHA or redirect
Temporal anomaly	Activity at unusual hours for visitor's timezone	Account sharing, bot, or international travel	Soft verification
Interaction anomaly	Mouse/scroll patterns outside human norms	Headless browser, automation tool	Challenge page
Volume anomaly	Page views > 3σ in session duration	Scraper or extremely engaged researcher	Rate limit or monitor
Behavioral shift	Returning visitor with drastically different patterns	Account compromise, new user on shared device	Identity verification

Bot Detection Integration

The anomaly model feeds into a dedicated bot detection formula that combines multiple anomaly signals with known bot signatures:

Formula

botProbability = w1 * speedAnomaly
              + w2 * interactionAnomaly
              + w3 * patternAnomaly
              + w4 * (1 - mouseEntropy)
              + w5 * (1 - scrollVariance)
              + w6 * headerSignature

Where:
  w1 = 0.20  // Speed is strong signal
  w2 = 0.25  // Mouse/interaction pattern is strongest
  w3 = 0.15  // Navigation pattern
  w4 = 0.15  // Low entropy = robotic movement
  w5 = 0.10  // Consistent scroll speed = automated
  w6 = 0.15  // Known bot UA strings, missing headers

False Positive Mitigation

Anomaly detection is only useful if the false positive rate is low enough for automated action. ClickStream uses several strategies to minimize false positives:

Warm-up period: No anomaly scores are emitted for the first 5 events in a session. Early interactions are naturally irregular.
Confidence gating: Anomaly alerts are only fired when the model's confidence exceeds 0.85 (calibrated on labeled bot/human data).
Visitor history weighting: Returning visitors with a clean history get a lower anomaly baseline, making it harder to flag them accidentally.
Composite scoring: A single anomalous feature is not enough. The bot detection formula requires anomalies across multiple independent signals.
Human-in-the-loop review: For borderline cases (anomaly score 60–80), events are queued for review rather than triggering automated blocks.

Value × Anomaly Interplay Matrix

The combination of value and anomaly scores creates a prioritization framework for security and customer success teams:

	Low Anomaly (0–30)	Medium Anomaly (31–60)	High Anomaly (61–100)
Low Value (0–30)	Normal traffic. No action needed.	Monitor. Likely bot or scanner.	Block or challenge. Probable bot.
Medium Value (31–60)	Standard visitor. Nurture normally.	Investigate. Could be sophisticated scraper or unusual human.	Challenge carefully. May be power user.
High Value (61–100)	VIP visitor. White-glove treatment.	Soft verify. Too valuable to block incorrectly.	High priority investigation. Could be fraud or account compromise.

The cardinal rule of value-anomaly interplay: never auto-block a high-value session. The cost of a false positive on a whale customer far exceeds the cost of letting a sophisticated bot through. Use soft challenges (invisible CAPTCHAs, behavioral verification) for high-value anomalies.

Storage Schema

Value and anomaly events are stored with full context for post-hoc analysis and model calibration:

SQL

CREATE TABLE clickstream_value_anomaly_events (
  visitor_id        STRING NOT NULL,
  session_id        STRING NOT NULL,
  event_timestamp   TIMESTAMP NOT NULL,

  -- Value fields
  value_score       FLOAT64,
  value_tier        STRING,        -- 'low', 'medium', 'high', 'whale'
  estimated_revenue FLOAT64,

  -- Anomaly fields
  anomaly_score     FLOAT64,
  anomaly_type      STRING,        -- 'speed', 'pattern', 'temporal', etc.
  bot_probability   FLOAT64,
  anomaly_features  JSON,          -- which features triggered the anomaly

  -- Alert metadata
  alert_fired       BOOLEAN,
  alert_type        STRING,
  action_taken      STRING
)
PARTITION BY DATE(event_timestamp)
CLUSTER BY visitor_id;

Value Scoring and Anomaly Detection

What You'll See in the Dashboard

Model 4: Value Estimator

Value Signal Weights

E-Commerce Scoring Formula

SaaS Scoring Formula

Value × Frustration Alert

Model 5: Anomaly Detection

Dual Baseline Comparison

Anomaly Types

Bot Detection Integration

False Positive Mitigation

Value × Anomaly Interplay Matrix

Storage Schema

Spot Your Highest-Value Buyers and Block the Bots