A table contains two time points. How to set rules to detect abnormal attendance?

1. If the difference between two time points exceeds a certain limit, it is regarded as abnormal attendance.

2. If the difference between two time points is less than a certain limit, it is considered that attendance is normal. In addition, you can set more restrictions according to the specific requirements of attendance, such as within ten minutes, within half an hour and so on. In order to detect anomalies more accurately.