Extreme Value Theory (EVT)

The core mechanism of EVT-based anomaly detection involves fitting a Generalized Pareto Distribution to the extreme values exceeding a high threshold. The Pickands-Balkema-de Haan theorem states that, for a sufficiently high threshold, the distribution of excesses converges to a GPD. This allows the system to model the tail behavior of anomaly scores without making assumptions about the overall distribution of the data.

• Shape parameter (ξ): Determines the tail heaviness—positive values indicate heavy tails common in fraud score distributions
• Scale parameter (σ): Controls the spread of the extreme values
• Threshold selection: Typically uses mean residual life plots or the 90th-95th percentile of historical scores

The Peaks-Over-Threshold approach is the primary EVT method for anomaly detection, where all observations exceeding a high threshold are considered extreme. Unlike block maxima methods that partition data into fixed periods, POT uses all exceedances, providing more efficient use of rare event data.

• Threshold calibration: Set using quantile estimation on a clean training set of normal transactions
• Declustering: Removes temporal dependence by filtering exceedances within a fixed window, ensuring independence assumptions hold
• Return level estimation: Computes the value expected to be exceeded once every m observations, directly mapping to a desired false positive rate

Unlike static thresholds that fail under concept drift, EVT enables adaptive thresholding by periodically refitting the GPD to a rolling window of recent anomaly scores. This accounts for evolving transaction patterns, seasonal effects, and changing fraud tactics without manual recalibration.

• Rolling window size: Typically 30-90 days of anomaly scores to balance responsiveness and stability
• Automatic recalibration: Triggers when the Kolmogorov-Smirnov test detects significant distribution shift
• Quantile regression: EVT-derived thresholds can be expressed as high quantiles (e.g., 99.9th percentile) with confidence intervals, providing statistical guarantees on the false positive rate

Traditional anomaly detection often assumes anomaly scores follow a Gaussian distribution, using standard deviations to set thresholds (e.g., 3σ rule). This fails catastrophically for financial data, where score distributions are typically heavy-tailed and asymmetric. EVT makes no distributional assumptions about the bulk of the data, focusing exclusively on the tail.

• Gaussian 3σ rule: Assumes 0.27% false positive rate, but actual rate can be orders of magnitude higher with heavy tails
• EVT advantage: Directly models the tail, providing accurate false positive control even for distributions with infinite variance
• Empirical validation: Backtesting on historical fraud events shows EVT thresholds reduce false positives by 40-60% compared to Gaussian methods while maintaining recall

When multiple anomaly scoring models operate in parallel, their outputs exhibit tail dependence—extreme values tend to co-occur. Multivariate EVT extends the univariate framework using copulas or multivariate GPDs to model joint extreme behavior, preventing redundant alerts and improving detection of coordinated fraud patterns.

• Tail dependence coefficient: Measures the probability that one score is extreme given another is extreme
• Angular measure: Decomposes multivariate extremes into a radial component (magnitude) and angular component (type of anomaly)
• Application: Combining scores from graph-based, temporal, and behavioral models into a single EVT-calibrated alerting framework

A practical limitation of pure EVT is the arbitrary choice of threshold. Extreme value mixture models solve this by modeling the entire distribution: a parametric distribution (e.g., Gaussian or Gamma) for the bulk below the threshold, and a GPD for the tail above it, with the threshold treated as a parameter to be estimated.

• Seamless transition: Ensures smooth density at the threshold point
• Bayesian inference: Allows incorporation of prior knowledge about expected fraud rates
• Implementation: Packages like evmix in R or custom PyMC models provide full posterior distributions over thresholds and GPD parameters