There are some big issues with the models we have built so far. Unlike the data we worked with in Chapter 9, Getting Started with Machine Learning in Python, and Chapter 10, Making Better Predictions – Optimizing Models, we wouldn't expect the hacker behavior to be static over time. There is also a limit to how much data we can hold in memory, which limits how much data we can train our model on. Therefore, we will now build an online learning model to flag anomalies in usernames with failures per minute. An online learning model is constantly getting updated (in near real time via streaming, or in batches). This allows us to learn from new data as it comes and then get rid of it (to keep space in memory).
In addition, the model can evolve over time and adapt to changes in the underlying distribution of the data. We will also be providing our model...