Seasonal Hybrid ESD (S-H-ESD)

The foundational statistical test at the heart of S-H-ESD. GESD is an iterative procedure that tests for up to a user-specified number of outliers in a univariate dataset that approximately follows a normal distribution.

• Mechanism: Computes the R-statistic (max deviation from the mean divided by standard deviation) and compares it against a critical value derived from the t-distribution.
• Iterative Masking: After identifying the most extreme point, it is removed and the test is reapplied to the remaining data, preventing the masking effect where one outlier hides another.
• Key Advantage: Unlike Grubbs' Test, GESD does not require the exact number of outliers to be known in advance, only an upper bound.

The preprocessing step that makes GESD applicable to seasonal data. S-H-ESD uses Seasonal-Trend decomposition using LOESS (STL) to break a time series into three additive components:

• Trend (T_t): The long-term, low-frequency variation in the data, such as a gradual increase in transaction volume.
• Seasonal (S_t): The repeating, fixed-period pattern, like increased retail spending on weekends or holidays.
• Residual (R_t): The remaining noise after removing trend and seasonality. Anomaly detection is performed on this residual component, as it represents the deviation from the expected pattern.

A statistical discipline that provides the theoretical justification for setting robust anomaly thresholds. Instead of assuming a full data distribution, EVT focuses on modeling the behavior of the tail of the distribution.

• Peaks Over Threshold (POT): A common EVT method that fits a Generalized Pareto Distribution (GPD) to all data points exceeding a high threshold.
• Relation to S-H-ESD: While S-H-ESD uses the t-distribution for its critical values, EVT offers an alternative, mathematically rigorous way to control the false positive rate by modeling the extreme residuals directly, which is critical for financial risk management.

A complementary analytical task that identifies abrupt shifts in the statistical properties of a time series, such as a sudden change in the mean or variance. While S-H-ESD identifies individual anomalous points, change point detection finds the moment when the system's behavior fundamentally changed.

• PELT Algorithm: A common method that searches for optimal segmentation points by minimizing a cost function with a penalty for over-segmentation.
• Synergy: In fraud systems, a detected change point (e.g., a new fraud campaign starting) can be used to segment the data before applying S-H-ESD, ensuring the model adapts to the new regime rather than flagging the entire new pattern as anomalous.

A strategy for adapting anomaly detection sensitivity over time, moving beyond a single static cutoff. This is essential for financial data where volatility is non-constant (heteroskedasticity).

• Rolling Window Statistics: Thresholds are computed based on the mean and standard deviation of anomaly scores from a recent historical window (e.g., the past 30 days).
• Integration with S-H-ESD: The critical value in the GESD test can be made dynamic by scaling it based on the current volatility regime, reducing false positives during high-variance periods like market holidays and increasing sensitivity during stable, low-activity periods.

A data structure for time series that annotates every subsequence with its distance to its nearest non-self match. It is a powerful, all-in-one tool for discovering discords (anomalies) and motifs.

• Discord Discovery: The subsequence with the largest distance to its nearest neighbor is the top discord, representing the most anomalous pattern in the series.
• Contrast with S-H-ESD: Matrix Profile excels at finding anomalous shapes or motifs in a sequence, while S-H-ESD excels at finding anomalous values relative to a seasonal baseline. They are often used together for comprehensive time series analysis in fraud detection.