Autoregressive Modeling

The lag order (p) is the most critical hyperparameter, defining how many past time steps the model uses for prediction. In an AR(p) model, the current value is regressed on its p previous values.

• Low p (e.g., AR(1)): Captures only immediate momentum. A transaction depends only on the prior one.
• High p (e.g., AR(7)): Captures weekly seasonality in daily transaction data.
• Selection: Determined by analyzing the Partial Autocorrelation Function (PACF) to identify the direct correlation at each lag, independent of intermediate lags.
• Fraud Context: A user's typical transaction amount might depend on the last 3 transactions (AR(3)), but a fraudster's sequence will break this dependency structure.

AR models require the time series to be stationary—meaning its statistical properties like mean, variance, and autocorrelation are constant over time. A non-stationary series with trends or seasonality will produce spurious regressions.

• Testing: The Augmented Dickey-Fuller (ADF) test statistically checks for the presence of a unit root.
• Transformation: If non-stationary, differencing is applied (calculating the change between consecutive observations) to stabilize the mean.
• Fraud Context: A user's spending might have a gradual upward trend (non-stationary). The model must operate on the differenced series (period-to-period change) to learn a stable pattern, flagging a sudden spike as an anomaly.

The core mechanism is a linear weighted sum. The model coefficient φ (phi) quantifies the influence of a specific past value on the current prediction.

• Equation: X_t = c + φ₁X_{t-1} + φ₂X_{t-2} + ... + φ_pX_{t-p} + ε_t
• c: A constant baseline.
• ε_t: White noise, the random error term assumed to be unpredictable.
• Fraud Context: If a user's AR(2) model has coefficients φ₁=0.7 and φ₂=0.2, a transaction of $500 is expected after a $400 and $300 sequence. A $5,000 transaction generates a large residual ε_t, signaling an anomaly.

The anomaly signal is the residual (ε_t), the difference between the AR model's predicted value and the actual observed transaction. Under normal behavior, residuals should resemble white noise with a zero mean and constant variance.

• Scoring: A normalized residual (e.g., dividing by the standard deviation of historical residuals) creates a z-score. A threshold of |z| > 3 flags a statistically significant deviation.
• Validation: The Ljung-Box test checks if residuals are independently distributed; if not, the model hasn't captured all temporal structure.
• Fraud Context: A fraudster making a large purchase will produce a large positive residual, while an account tester making a tiny micro-transaction might produce a large negative residual.

A pure AR model is rarely used in isolation for financial data. It is typically the AR component of the broader ARIMA (Autoregressive Integrated Moving Average) framework.

• I (Integrated): The differencing order (d) to achieve stationarity, handling trends.
• MA (Moving Average): Models the dependency on past forecast errors, capturing shock effects.
• Fraud Context: A user's transaction amount might be modeled as ARIMA(3,1,1). The AR(3) part captures the habitual spending pattern, the I(1) part handles the account's growing balance, and the MA(1) part corrects for a one-off anomalous spike that shouldn't permanently shift the baseline.

AR models have critical blind spots that must be addressed in a production fraud system.

• Linear Only: Cannot capture non-linear relationships, such as a transaction amount that depends on the product of two past values.
• Univariate: A standard AR model predicts a variable using only its own history, ignoring other rich signals like merchant category or device ID.
• Static Coefficients: The relationship with the past is fixed, failing to adapt to a user's slow behavioral drift without periodic retraining.
• Mitigation: These limitations are why AR models are often used as a baseline feature within a larger ensemble, feeding its residual as one signal into a non-linear model like a Gradient Boosted Tree or a Temporal Convolutional Network.

A specialized recurrent neural network architecture designed to learn long-range temporal dependencies in sequential data. LSTMs use a gating mechanism—comprising input, forget, and output gates—to control information flow through a cell state, preventing the vanishing gradient problem. In fraud detection, LSTMs model entire transaction histories to identify subtle deviations from normal spending patterns over extended time windows.

A deep learning model that relies entirely on self-attention to process sequential data in parallel, eliminating recurrence. Key advantages for fraud detection include:

• Parallel computation for faster training on large transaction datasets
• Long-range dependency capture between any two transactions regardless of temporal distance
• Multi-head attention allowing the model to attend to different behavioral aspects simultaneously

The phenomenon in streaming data where the statistical relationship between input features and the target variable changes over time. In financial fraud, this manifests as:

• Sudden drift: New fraud tactics emerge abruptly
• Incremental drift: Criminal behavior evolves gradually
• Recurring drift: Seasonal fraud patterns reappear

Autoregressive models must incorporate drift detection and adaptive retraining to maintain detection efficacy against evolving threats.

A recursive algorithm that estimates the evolving state of a dynamic system from noisy measurements over time. For transaction monitoring, the Kalman filter provides an optimal prediction of expected transaction amounts by:

• Modeling the user's latent spending state as a dynamic variable
• Updating predictions recursively with each new observation
• Producing a prediction interval against which actual transactions are compared

Deviations beyond the expected variance trigger anomaly alerts.

A scalar value quantifying the degree of abnormality of an entire sequence of events. Derived from:

• Reconstruction error of a sequence autoencoder trained on normal behavior
• Negative log-likelihood assigned by an autoregressive model to an observed sequence
• Mahalanobis distance in the latent space of a sequence embedding

High scores flag entire user sessions for investigation, capturing patterns that individual transaction checks might miss.

A derived feature measuring the rate of transactions over specific time windows. Critical velocity checks include:

• Login attempts per minute — detects credential stuffing
• Payment transfers per hour — flags account takeover
• Card-not-present transactions per session — identifies card testing

Velocity features serve as high-signal inputs to autoregressive models, providing immediate temporal context that complements learned sequence patterns.