<![CDATA[Web-based attendance systems cannot read the mock location flag of a user device, thus, the coordinates produced by spoofing applications pass geofence validation unnoticed. This study asks whether detection can be moved from the device to the historical pattern, and which unsupervised detector suits the data that result. Eleven composite spatio-temporal-behavioural features were engineered from the attendance log of a corporate human resource information system in Indonesia, three of which measured how often an employee repeated the same coordinate at six-decimal precision. Isolation Forest, a one-class support vector machine, and a long short-term memory autoencoder were compared under twelve-fold walk-forward cross-validation on 249,818 records from 212 employees, evaluated against pseudo-labels derived from seven documented attendance rules. The stored models were then applied to 18,711 later records, and the leading indicator was confirmed with ten employees through a blinded matched case-control interview. The one-class support vector machine led on every accuracy metric, reaching a precision-recall area of 0.5367 and a Matthews correlation coefficient of 0.2541, and its ranking held across three calibration scenarios. Removing the coordinate repetition features cost 74.2 percent of the discriminative margin, while the field confirmation separated flagged from comparison employees completely.]]>
Copyrights © 2026
