Add behavioral anomaly detection and velocity checks

[PeaStew]

Summary

No behavioral analysis or anomaly detection exists. The system cannot distinguish between a legitimate user making 5 requests/day and a bot making 5000 requests/hour from the same account.

Recommendation

Velocity Checks (Quick Win)

Track per-user action counts in a sliding window and flag/block when thresholds are exceeded:

Action	Reasonable Rate	Flag Threshold	Block Threshold
Object collection	1-2/min	10/min	30/min
Location visits	1/min	5/min	15/min
Point claims	5/min	20/min	50/min
Account creation	1/day	3/day	5/day
Device registration	1/week	3/day	10/day

Implementation: Redis sorted sets with sliding window counters per userId.

Pattern Detection (Medium Term)

• Impossible travel: Flag if same user acts from two geographically distant IPs within a short window
• Session anomalies: Flag if user-agent, timezone, or language changes mid-session
• Time-of-day patterns: Bots often run 24/7 with uniform distribution; humans have sleep cycles
• Action sequencing: Legitimate gameplay has natural sequences (move → find → collect); bots often skip steps or repeat identical sequences

Scoring System

Assign a risk score (0-100) per session based on weighted signals:

score = (
  0.3 * velocity_score +
  0.2 * fingerprint_score +
  0.2 * interaction_score +
  0.15 * geo_score +
  0.15 * pattern_score
)

• Score < 30: Allow
• Score 30-70: Add friction (CAPTCHA challenge)
• Score > 70: Block + flag for review

Infrastructure

• Use Redis for real-time counters and sliding windows
• Store historical behavior data for offline analysis
• Consider a dedicated abuse detection service that consumes event streams