Gaussian Mixture Model (GMM)

Unlike distance-based methods, GMMs output a log-likelihood or probability density for every transaction. Anomalies are not defined by a hard boundary but by residing in regions where the estimated probability density function (PDF) is below a calibrated threshold. This allows for nuanced risk ranking, where a transaction with a log-likelihood of -15 is treated as more suspicious than one at -10, enabling fine-grained alert triage.

Financial behavior is heterogeneous. A GMM models the data as a mixture of k Gaussian components, each representing a distinct behavioral archetype:

• High-value corporate transfers: A component with a high mean and moderate variance.
• Micro-transaction retail: A component with a low mean and high frequency.
• Dormant account activity: A component centered near zero. An anomaly is a point poorly explained by any of these learned normal archetypes.

GMMs capture the covariance matrix for each component, modeling how features like transaction amount and time-of-day correlate. A Mahalanobis distance-based anomaly detector assumes a single global covariance, but a GMM learns local correlations. For example, a large transaction at 3 AM might be normal for a specific corporate component but highly anomalous for a retail consumer component, preventing false positives from rigid global rules.

GMMs are trained via the Expectation-Maximization (EM) algorithm, an iterative two-step process:

• E-Step: Calculate the responsibility (posterior probability) that each component generated each data point.
• M-Step: Update the mean, covariance, and mixing coefficient for each component to maximize the expected log-likelihood. This converges to a local maximum of the likelihood function, fitting the density to the bulk of normal data without requiring labeled fraud examples.

Beyond a single anomaly score, GMMs provide explainability through component assignment. When a transaction is flagged, the model reveals which Gaussian component it was most likely drawn from and its Mahalanobis distance from that component's center. An investigator can see: 'This transaction was assigned to the high-net-worth component but is 4.2 standard deviations away in the time-of-day dimension,' providing a clear, auditable reason for the alert.

Setting an anomaly threshold on a raw log-likelihood can be brittle. A robust architecture fits a Generalized Pareto Distribution (GPD) from Extreme Value Theory to the tail of the log-likelihood scores. Instead of an arbitrary cutoff, the threshold is set using a statistical test on the tail distribution, providing a mathematically rigorous false positive rate control (e.g., 'flag the 0.1% most extreme scores') that adapts to the model's learned density.

The iterative optimization workhorse that estimates GMM parameters when latent cluster assignments are unknown. The E-step computes the posterior probability (responsibility) that each Gaussian component generated each data point. The M-step then re-estimates means, covariances, and mixing coefficients by maximizing the expected log-likelihood given those responsibilities.

• Converges to a local maximum of the likelihood function
• Sensitive to initialization; k-means++ is commonly used for seeding
• Each iteration monotonically increases the log-likelihood, providing a natural convergence check

A variational inference extension of GMM that places prior distributions over model parameters, eliminating the need to pre-specify the number of components. Uses a Dirichlet process prior on mixing weights, allowing the model to automatically prune redundant components by driving their mixing coefficients toward zero.

• Avoids overfitting by integrating over parameter uncertainty
• Weight concentration prior controls the effective number of components
• Particularly useful when the optimal number of fraud clusters is unknown a priori

A multivariate distance metric that measures how many standard deviations a point is from the mean of a distribution, accounting for the covariance structure of the data. In GMM-based anomaly detection, the Mahalanobis distance to the nearest Gaussian component's mean provides a principled outlier score.

• Reduces to Euclidean distance when covariance is the identity matrix
• Elliptical contours follow the natural spread of correlated features
• Computed as: D² = (x - μ)ᵀ Σ⁻¹ (x - μ) for each component

A non-parametric alternative to GMM that estimates the probability density function by placing a kernel (typically Gaussian) on each training data point and summing their contributions. Unlike GMM, KDE makes no assumption about the number of underlying clusters.

• Bandwidth parameter controls smoothness; small bandwidth captures fine structure but risks overfitting
• Computationally expensive at inference time (O(n) per query vs. O(k) for GMM)
• Anomalies identified as points in regions with density below a threshold

Information criteria used to select the optimal number of Gaussian components by balancing model fit against complexity. The Bayesian Information Criterion (BIC) imposes a stronger penalty for additional parameters than the Akaike Information Criterion (AIC).

• BIC = k ln(n) - 2 ln(L̂), where k is free parameters, n is sample size, L̂ is maximized likelihood
• AIC = 2k - 2 ln(L̂)
• Lower values indicate better models; BIC tends to favor simpler models than AIC
• Grid search over component counts evaluated via BIC is standard practice in fraud modeling