Optimizing anomaly detection based on user clustering, outlier detection, and historical data transfer paths

A system for optimizing anomaly detection determines, based on a confidence score, user clustering information that indicates a cluster to which a user belongs, such that if the confidence score is more than a threshold score, the user clustering information indicates that the user belongs to a first cluster. Otherwise, the user clustering information indicates that the user belongs to a second cluster. The system determines, based on user activities in a virtual environment, user outlier information that indicates whether the user is associated with an unexpected activity. The system determines virtual resource routing information that comprises routings of virtual resources between the avatar and the other avatars within the virtual environment. The system updates the confidence score based at least in part upon at least one of the user clustering information, the user outlier information, or the virtual resource routing information.