What is value scoring in behavioral analytics?

Value scoring assigns a monetary potential to each visitor session based on behavioral patterns correlated with past conversions. It considers factors like product page engagement, comparison behavior, and return visit frequency to estimate likely purchase value.

How does anomaly detection work for web analytics?

Anomaly detection uses statistical models to identify sessions that deviate significantly from normal behavioral patterns. This flags potential fraud, bot activity, or unusual user behavior that warrants investigation — all computed at the edge in real time.

Can behavioral anomaly detection catch ad fraud?

Yes. Behavioral anomaly detection identifies non-human patterns like unnaturally consistent click timing, zero scroll depth with page completions, and impossibly fast form submissions — signals that traditional click-fraud tools miss because they only look at IP and device fingerprints.

Value Scoring and Anomaly Detection

What You'll See in the Dashboard

Value Estimator and Anomaly Detection scores are surfaced in the dashboard in real time. The Value score helps you prioritize high-value visitors; the Anomaly score flags unusual behavior for investigation.

Business Actions: Treat a Value score above 80 as a cue to loop in your sales team, and an Anomaly score above 70 as a cue to review the session for potential bot traffic or suspicious behavior.

Model 4: Value Estimator

The value estimator predicts the monetary value a visitor is likely to generate, either in the current session or over their customer lifetime. This score drives prioritization: when support resources are limited, you want to focus on your highest-value visitors.

Value Signal Weights

The signal names and weights below are illustrative of how the model combines evidence — in production the weights are tunable per site, not fixed global constants.

Signal	Weight	Description
Cart value / plan tier viewed	0.25	Direct monetary signal: items in cart or pricing tier being evaluated
Intent score	0.20	Higher intent = higher expected value (cross-model dependency)
Historical visitor value	0.15	Past purchase amount for returning visitors
Engagement depth	0.12	Deep engagement with high-value content (product specs, pricing)
Referral source quality	0.10	Visitors from high-converting channels score higher
Session page count	0.08	More pages = more consideration = higher potential value
Device and geo signals	0.06	Desktop users and certain geos correlate with higher AOV
Time-of-day pattern	0.04	Business hours vs. off-hours browsing correlates with purchase intent

E-Commerce Scoring Formula

For e-commerce sites, the value estimator uses a weighted combination that emphasizes direct monetary signals. The pseudocode below is illustrative — not the shipped implementation:

Illustrative pseudocode (TypeScript)

function estimateEcommerceValue(features: BehavioralFeatures, context: SessionContext): number {
  // Direct value signals
  const cartSignal = Math.min(features.cartValue / siteAvgOrderValue, 2.0) * 25;
  const intentSignal = visitor.scores.intent * 0.20; // intent 0-100 from the Signals snapshot

  // Historical value (returning visitors only)
  const historySignal = context.isReturning
    ? Math.min(context.historicalLTV / siteAvgLTV, 3.0) * 15
    : 7.5; // neutral for new visitors

  // Engagement and behavior signals
  const engagementSignal = features.engagementScore * 0.12;
  const referralSignal = channelValueMultiplier[context.referrerCategory] * 10;
  const depthSignal = Math.min(features.pageViewCount / 8, 1) * 8;
  const deviceGeoSignal = (context.deviceType === 'desktop' ? 4 : 2)
    + geoValueMultiplier[context.geoRegion] * 2;
  const timeSignal = isBusinessHours(context.localHour) ? 4 : 2;

  return Math.min(100, Math.round(
    cartSignal + intentSignal + historySignal + engagementSignal
    + referralSignal + depthSignal + deviceGeoSignal + timeSignal
  ));
}

SaaS Scoring Formula

For SaaS products, the formula shifts emphasis from cart value to plan tier evaluation and feature exploration. Again, illustrative pseudocode rather than the shipped implementation:

Illustrative pseudocode (TypeScript)

function estimateSaaSValue(features: BehavioralFeatures, context: SessionContext): number {
  // Plan tier signal: which pricing tier is the user evaluating?
  const tierSignal = planTierValue[features.highestPlanViewed] * 25;
  // e.g., { free: 0.1, starter: 0.3, professional: 0.6, enterprise: 1.0 }

  // Feature exploration: users who explore more features = higher potential
  const featureExploration = Math.min(features.uniqueFeaturesViewed / 10, 1) * 15;

  // Trial engagement (if applicable)
  const trialSignal = features.trialActionsCompleted
    ? Math.min(features.trialActionsCompleted / 5, 1) * 20
    : visitor.scores.intent * 0.15; // intent 0-100 from the Signals snapshot

  // Company signals (if identifiable from IP/domain)
  const companySignal = context.companySize
    ? companySizeMultiplier[context.companySize] * 12
    : 6;

  return Math.min(100, Math.round(
    tierSignal + featureExploration + trialSignal + companySignal
    + features.engagementScore * 0.10
    + (context.isReturning ? 8 : 3)
  ));
}

Value × Frustration Alert

One of the most actionable combinations in the entire scoring system: a high-value visitor experiencing high frustration. This triggers an immediate alert because the revenue at risk is significant.

TypeScript

function checkValueFrustrationAlert(scores: BehavioralScores): Alert | null {
  if (scores.valueEstimate >= 70 && scores.frustrationScore >= 50) {
    return {
      type: 'high_value_frustration',
      severity: 'critical',
      message: `High-value visitor (${scores.valueEstimate}) frustrated (${scores.frustrationScore})`,
      recommendedAction: 'proactive_chat',
      estimatedRevenue: dollarValueFromScore(scores.valueEstimate)
    };
  }
  return null;
}

Model 5: Anomaly Detection

The anomaly score identifies behavioral patterns that deviate significantly from established baselines. This serves dual purposes: detecting bots and fraud, and identifying genuinely unusual (but human) behaviors that may require attention.

Dual Baseline Comparison

Every behavioral feature is compared against two baselines simultaneously:

Site baseline: The aggregate behavioral distribution across all visitors to this site. This catches behavior that is unusual for your site specifically.
Visitor baseline: The individual visitor's historical behavior (for returning visitors). This catches behavior that is unusual for this particular user.

Conceptually, the anomaly score is the maximum of the two z-scores, normalized to 0–100:

Conceptual formula

anomalyScore = sigmoid(max(
  |feature - siteMean| / siteStdDev,
  |feature - visitorMean| / visitorStdDev
)) * 100

Anomaly Types

Anomaly Type	Detection Signal	Typical Cause	Action
Speed anomaly	Event rate > 3σ above site mean	Bot, automated testing, or power user	Bot check or whitelist
Pattern anomaly	Navigation sequence rarely seen in site data	Scraper, vulnerability scanner, or lost user	CAPTCHA or redirect
Temporal anomaly	Activity at unusual hours for visitor's timezone	Account sharing, bot, or international travel	Soft verification
Interaction anomaly	Mouse/scroll patterns outside human norms	Headless browser, automation tool	Challenge page
Volume anomaly	Page views > 3σ in session duration	Scraper or extremely engaged researcher	Rate limit or monitor
Behavioral shift	Returning visitor with drastically different patterns	Account compromise, new user on shared device	Identity verification

Bot Detection Integration

The anomaly model feeds into ClickStream's bot detection, which is two-layer in production: a per-request bot score built from Cloudflare Bot Management signals, a named user-agent registry, datacenter-ASN checks, and automation/header-inconsistency checks, reconciled with a per-session behavioral human-confidence score. The single weighted formula below is an illustrative simplification of how those signals combine:

Illustrative formula

botProbability = w1 * speedAnomaly
              + w2 * interactionAnomaly
              + w3 * patternAnomaly
              + w4 * (1 - mouseEntropy)
              + w5 * (1 - scrollVariance)
              + w6 * headerSignature

Where:
  w1 = 0.20  // Speed is strong signal
  w2 = 0.25  // Mouse/interaction pattern is strongest
  w3 = 0.15  // Navigation pattern
  w4 = 0.15  // Low entropy = robotic movement
  w5 = 0.10  // Consistent scroll speed = automated
  w6 = 0.15  // Known bot UA strings, missing headers

False Positive Mitigation

Anomaly detection is only useful if the false positive rate is low enough for automated action. ClickStream uses several strategies to minimize false positives:

Warm-up period: No anomaly scores are emitted for the first few events in a session. Early interactions are naturally irregular.
Confidence gating: Anomaly signals only escalate when multiple independent heuristics agree — ClickStream's bot detection is deterministic heuristics plus Cloudflare Bot Management signals, not a model trained on customer traffic.
Visitor history weighting: Returning visitors with a clean history get a lower anomaly baseline, making it harder to flag them accidentally.
Composite scoring: A single anomalous feature is not enough. The bot detection formula requires anomalies across multiple independent signals.
Human-in-the-loop override: Operators can mark a flagged visitor as human, and that override sticks for 90 days — borderline cases get a human decision rather than a silent automated block.

Value × Anomaly Interplay Matrix

The combination of value and anomaly scores creates a prioritization framework for security and customer success teams:

	Low Anomaly (0–30)	Medium Anomaly (31–60)	High Anomaly (61–100)
Low Value (0–30)	Normal traffic. No action needed.	Monitor. Likely bot or scanner.	Block or challenge. Probable bot.
Medium Value (31–60)	Standard visitor. Nurture normally.	Investigate. Could be sophisticated scraper or unusual human.	Challenge carefully. May be power user.
High Value (61–100)	VIP visitor. White-glove treatment.	Soft verify. Too valuable to block incorrectly.	High priority investigation. Could be fraud or account compromise.

The cardinal rule of value-anomaly interplay: never auto-block a high-value session. The cost of a false positive on a whale customer far exceeds the cost of letting a sophisticated bot through. Use soft challenges (invisible CAPTCHAs, behavioral verification) for high-value anomalies.

How Scores Are Stored

Every value and anomaly score is written per event to ClickStream's Cloudflare Analytics Engine dataset (clickstream_scores) alongside the other behavioral model outputs, with the visitor and session identifiers needed for post-hoc analysis. Growth+ plans can export campaign-attributed visitor data as CSV.