LSTM Autoencoder

The architecture consists of an LSTM encoder that reads an input sequence and compresses it into a fixed-length context vector, and an LSTM decoder that reconstructs the sequence from this vector. Unlike feed-forward autoencoders, the LSTM cells maintain an internal hidden state and cell state that capture long-range dependencies across time steps. The encoder processes the sequence step-by-step, updating its hidden state, and the final hidden state serves as the latent representation. The decoder then generates the reconstruction, often using teacher forcing during training to stabilize learning.

The core detection mechanism relies on the principle that a model trained exclusively on normal sequences will learn to reconstruct them with low error. When presented with a fraudulent or anomalous sequence, the model fails to accurately reconstruct it, producing a high reconstruction error. This error is calculated using metrics such as:

• Mean Squared Error (MSE) for continuous features
• Binary Cross-Entropy for binary event sequences
• Dynamic Time Warping (DTW) for sequences with temporal misalignment The raw error is then used as an anomaly score, with a threshold set to flag outliers.

For tasks requiring variable-length output, a Sequence-to-Sequence (Seq2Seq) LSTM Autoencoder is employed. The encoder processes the entire input sequence into a context vector, and the decoder generates a reconstruction one step at a time. This variant is particularly effective for transaction sequence reconstruction where the model must predict the next legitimate action in a session. Anomalies are detected when the predicted next step diverges significantly from the observed step, enabling real-time fraud interception before a transaction completes.

A Bidirectional LSTM (BiLSTM) encoder processes the input sequence in both forward and reverse directions, concatenating the hidden states at each time step. This allows the model to capture context from both past and future events within a sequence, which is critical for understanding transactions where the significance of an event depends on what follows. For example, a small test transaction followed by a large transfer is a classic fraud pattern that a unidirectional LSTM might miss. The bidirectional context enriches the latent representation, improving reconstruction fidelity on normal patterns.

Standard LSTM Autoencoders compress the entire sequence into a single fixed-length vector, which can become a bottleneck for long sequences. Integrating an attention mechanism allows the decoder to access all encoder hidden states at each decoding step, weighting them by relevance. This Luong-style or Bahdanau-style attention creates dynamic skip connections that preserve fine-grained temporal details. The result is sharper reconstructions of normal behavior and a more pronounced reconstruction error gap between normal and anomalous sequences, reducing false positives.

A Variational LSTM Autoencoder replaces the deterministic bottleneck with a probabilistic latent space. The encoder outputs parameters of a Gaussian distribution (mean and variance), and the latent vector is sampled using the reparameterization trick. This forces the latent space to be smooth and continuous. For anomaly detection, the reconstruction probability—computed via Monte Carlo sampling—provides a more principled and stable anomaly score than raw reconstruction error. It quantifies how likely a sequence is under the learned normal distribution, making threshold selection more robust to noise.

The fundamental anomaly score in autoencoder architectures. It quantifies the difference between the original input sequence and the model's attempt to reconstruct it. LSTM Autoencoders specifically measure the mean squared error (MSE) across time steps. A high reconstruction error indicates the temporal pattern deviates significantly from the learned manifold of normal behavior, flagging it as a potential fraud sequence.

A probabilistic sibling to the standard autoencoder. Instead of mapping inputs to a fixed latent vector, a VAE learns the parameters of a probability distribution (mean and variance). For anomaly detection, this allows for the calculation of a reconstruction probability, which is often more principled and stable than raw reconstruction error. It models the stochasticity of normal sequences, making it robust to minor variations in legitimate transaction timing.

The broader discipline of capturing time-dependent dynamics in data. While LSTM Autoencoders learn to compress and reconstruct entire sequences, other temporal models like Sequence-to-Sequence (Seq2Seq) architectures with attention focus on predicting the next event. This group of techniques is critical for modeling evolving behavioral patterns where the order and timing of transactions are the primary indicators of fraud.

The algorithmic process of identifying abrupt shifts in the statistical properties of a time series. While an LSTM Autoencoder flags individual anomalous sequences, change point detection identifies the exact moment a system transitions from a normal state to a fraudulent regime. Combining both allows a system to not only catch a fraudulent sequence but also pinpoint the specific transaction where the behavior shifted.

An adversarial training framework specifically designed for multivariate time series. USAD uses a two-phase game between two autoencoders to amplify the reconstruction error of anomalies while stabilizing the reconstruction of normal data. This adversarial approach often provides superior stability and sensitivity compared to a single LSTM Autoencoder, particularly in noisy financial data streams with complex seasonal patterns.

A transformer architecture adapted for time series that uses an Anomaly-Attention mechanism. It models both prior-association (concentrating on adjacent time points) and series-association (global trend). The discrepancy between these two attention distributions serves as the anomaly criterion. This represents a direct evolution beyond recurrent architectures, capturing long-range dependencies without the sequential bottleneck of LSTMs.