The biggest issue is that it’s a multi-dimensional supervised pattern-detection problem. And even that, if undesirable changes have a good mix of commonality and entropy, can completely miss them. But if the objective isn’t to build a proactive detection method, making a discovery method for finding more instances of the same action is possible. Say, in this particular case, harmful edits had 0% geometry changes and 100% name=* changes. 100% of the resulting name values were in capital letters and no substring overlaps with the previous value. User names had untypically high entropy of small and capital characters mixed.
Would a vandal be able to change if this pattern was discovered? Likely, yes. But if it’s combined with an effective revert tool allowing to erase the changesets by list completely, the incentive for vandalism would be pretty low.
1 Like