A collusion detection system may detect collusion between entities participating in online gaming. The collusion detection system may identify a plurality of entities associated with and opponents within an instance of an online game, determine social data associated with the plurality of entities, determine in-game behavior data associated with the plurality of entities, and determine, for one or more pairings of the plurality of entities, respective pairwise feature sets based at least in part on the social data and the in-game behavior data. The collusion detection system may then perform anomaly detection on the respective pairwise feature sets and, in response to the anomaly detection detecting one or more anomalous pairwise feature sets, output one or more suspect pairings of the plurality of entities corresponding to the one or more anomalous pairwise feature sets as suspected colluding pairings.