Dynamic Thresholding

Dynamic thresholds are computed over a sliding window of recent anomaly scores rather than the entire historical dataset. This window captures the most recent behavioral patterns and naturally adapts to concept drift. Common window configurations include:

• Time-based windows: Last 7 days, 30 days, or 90 days of scores
• Count-based windows: Most recent 10,000 transactions or events
• Exponentially weighted windows: Recent observations weighted more heavily using decay factors

The window size represents a critical hyperparameter—too short and thresholds become volatile, too long and they fail to adapt to genuine shifts in the data distribution.

Thresholds are derived from the central tendency and dispersion of the rolling score distribution. Common statistical approaches include:

• Median Absolute Deviation (MAD): Robust to outliers, threshold = median + k × MAD, where k is typically 3-5
• Interquartile Range (IQR): Threshold = Q3 + 1.5 × IQR, resistant to extreme values
• Z-score with rolling statistics: Threshold = rolling_mean + n × rolling_standard_deviation
• Percentile-based: Threshold set at the 95th, 99th, or 99.9th percentile of the rolling distribution

MAD and IQR are preferred over mean and standard deviation because anomaly scores themselves are often heavy-tailed, making robust statistics essential for stable thresholding.

Raw anomaly scores often contain cyclical patterns tied to business rhythms—hourly peaks, weekday/weekend differences, month-end spikes, and holiday effects. Dynamic thresholding incorporates decomposition techniques to avoid false alarms during these predictable fluctuations:

• STL decomposition (Seasonal-Trend decomposition using LOESS) separates the score series into seasonal, trend, and residual components
• Thresholds are applied to the residual component after removing known seasonality
• Seasonal periods are configured based on domain knowledge: 24 hours for daily cycles, 7 days for weekly patterns, 30 days for monthly billing cycles

This prevents the system from flagging a predictable Monday morning transaction surge as anomalous while still detecting genuine deviations from expected seasonal behavior.

For high-stakes applications requiring rigorous false positive control, dynamic thresholding can be combined with Extreme Value Theory (EVT) . Rather than assuming a Gaussian distribution of scores, EVT fits a Generalized Pareto Distribution (GPD) to the tail of the rolling score distribution using the Peaks-Over-Threshold method:

• Only observations exceeding a high initial threshold are modeled
• The fitted GPD provides a probability for any given score value
• Thresholds are set to achieve a target exceedance probability (e.g., 0.1% false positive rate)
• Automatically adapts as the tail behavior of the score distribution shifts over time

This approach provides mathematical guarantees on the expected false positive rate, which is critical for regulated financial environments where every alert triggers a costly investigation.

In production fraud systems, multiple anomaly detection models run simultaneously—each producing independent scores for different fraud typologies. Dynamic thresholding must coordinate across these correlated score streams:

• Holm-Bonferroni correction adjusts individual thresholds to control the family-wise error rate when monitoring multiple independent score streams
• Copula-based dependency modeling captures the joint distribution of scores across models, preventing redundant alerts when multiple models flag the same transaction
• Ensemble threshold fusion combines individual model decisions using logical operators (AND/OR) or weighted voting with dynamic weights based on recent model performance

This coordination prevents alert fatigue by ensuring that a single fraudulent transaction does not generate multiple redundant alerts from correlated detection models.

Dynamic thresholds can be continuously refined using investigator feedback loops. When analysts review alerts and label them as true positives or false positives, this feedback is used to optimize threshold parameters:

• Bayesian optimization tunes the multiplier k (in median + k × MAD) to maximize precision at a target recall level
• Reinforcement learning treats threshold adjustment as a multi-armed bandit problem, balancing exploration of new threshold levels with exploitation of known good settings
• Cost-sensitive optimization incorporates the asymmetric costs of false positives (investigator time) versus false negatives (financial loss) to set economically optimal thresholds

This closed-loop system ensures that thresholds not only adapt to data patterns but also to the operational realities of the fraud investigation team.

The raw numerical output from a detection model quantifying the degree of abnormality for a transaction. Dynamic thresholding operates directly on a rolling window of these scores.

• Source: Generated by algorithms like Isolation Forest, Autoencoder reconstruction error, or Local Outlier Factor.
• Nature: A continuous value, not a binary label. A higher score indicates a stronger deviation from learned normality.
• Role: The threshold is applied to this score to trigger an alert. The statistical distribution of recent scores is the sole input for adaptive threshold calculation.

A statistical framework for modeling the tail of a distribution, providing a mathematically rigorous alternative to simple standard deviation for setting thresholds.

• Peaks-Over-Threshold (POT): A core EVT method that fits a Generalized Pareto Distribution (GPD) to scores exceeding a high initial threshold.
• Advantage: Unlike z-scores, EVT does not assume a Gaussian distribution of anomaly scores, making it robust for the heavy-tailed distributions common in fraud data.
• Dynamic Application: The GPD parameters are re-estimated on each rolling window, allowing the extreme quantile threshold to adapt to shifting data volatility.

Algorithms that identify abrupt shifts in the statistical properties of a time series, often used to trigger a recalibration of the dynamic threshold.

• Function: Detects when the mean or variance of the anomaly score stream has fundamentally changed, signaling a new fraud campaign or a legitimate business shift (e.g., a holiday sales spike).
• Methods: Includes PELT (Pruned Exact Linear Time) and Bayesian Online Change Point Detection.
• Integration: A detected change point can reset the rolling window or force an immediate re-estimation of the threshold model, preventing a surge of false positives from a stale baseline.

The primary operational goal of dynamic thresholding. A static threshold inevitably fails when transaction volumes and patterns exhibit natural cyclicality.

• The Problem: A threshold set during a low-activity period will generate an overwhelming flood of false alerts during a predictable high-volume period.
• The Mechanism: By tracking a rolling z-score or percentile, the threshold automatically rises with the general activity level and falls during quieter periods.
• Business Impact: Directly reduces alert fatigue for fraud analysts and prevents the operational cost of investigating legitimate transactions mistakenly blocked by a rigid system.

The continuous evaluation of a production model's performance, where a divergence in the distribution of anomaly scores is a key indicator of drift.

• Data Drift: A change in the input feature distribution (e.g., new payment methods) will alter the output anomaly score distribution. Dynamic thresholding adapts to this new normal without manual intervention.
• Concept Drift: A change in the fundamental relationship between features and the target 'fraud' label. While dynamic thresholding masks the symptom, dedicated drift monitors must still alert MLOps engineers to retrain the underlying model.
• Metric: The Population Stability Index (PSI) of the anomaly scores is often tracked alongside the dynamic threshold to distinguish between acceptable cyclicality and true model decay.

A robust statistical algorithm for anomaly detection in time series that inherently uses a form of dynamic thresholding by accounting for seasonality and trend.

• Mechanism: Decomposes the time series using STL (Seasonal-Trend decomposition using LOESS) and then applies the Generalized ESD test to the residuals.
• Dynamic Nature: The 'expected value' at any point is a function of the seasonal component and trend, making the threshold for an anomaly relative to the specific time context.
• Use Case: Highly effective for detecting anomalies in aggregate metrics like hourly transaction counts or total dollar volume, where strong daily and weekly seasonality is present.