Change Point Detection

The fundamental architectural distinction in change point detection:

• Offline (Retrospective): Analyzes a complete, static dataset to identify all change points after the fact. Uses algorithms like PELT (Pruned Exact Linear Time) or Binary Segmentation to partition the entire time series. Ideal for forensic investigation and model training.
• Online (Sequential): Processes streaming data point-by-point, aiming to detect a change as soon as possible after it occurs. Relies on CUSUM (Cumulative Sum) or Bayesian Online Change Point Detection to minimize detection delay while controlling false alarms. Critical for real-time fraud blocking.
• Trade-off: Online methods trade some statistical accuracy for minimal latency, directly impacting the time-to-detect for an active account takeover.

Change point detectors monitor specific statistical properties of a univariate or multivariate transaction stream for abrupt deviations:

• Mean Shift: A sudden jump or drop in the average transaction amount, signaling a shift from micro-transaction testing to large-value fraud.
• Variance Change: An increase in the volatility of transaction amounts, indicating erratic, scripted behavior distinct from a user's stable spending pattern.
• Frequency/Rate Change: A shift in the transaction velocity, detected by modeling inter-arrival times with a Temporal Point Process or monitoring the rate parameter of a Poisson process.
• Correlation Structure: In multivariate streams, detecting a break in the correlation between features like transaction amount and merchant category, revealing a change in purchasing behavior.

The Cumulative Sum (CUSUM) control chart is a foundational online algorithm designed to detect small, sustained shifts in the mean of a process:

• Mechanism: It accumulates the deviation of each observation from a target mean. The cumulative sum S_t = max(0, S_{t-1} + (x_t - μ_0 - k)), where k is a reference value (often half the shift magnitude to detect).
• Alerting: An alarm triggers when S_t exceeds a decision threshold h, chosen to balance the Average Run Length (ARL) between false positives and true detection.
• Application: Highly effective for detecting a gradual but persistent increase in the dollar value of a compromised account's transactions, where individual transactions may not cross a static threshold.

A probabilistic framework that models the run length—the time since the last change point—as a latent variable, updating its posterior distribution with each new data point:

• Inference: The algorithm recursively computes the probability that the current run length continues versus the probability that a change point just occurred, given the predictive distribution of the data.
• Underlying Model: Often coupled with a Student's t-distribution for robust mean estimation or a Hidden Markov Model to represent distinct behavioral states.
• Advantage: Provides a full posterior distribution over change point locations, enabling a nuanced risk score rather than a binary alarm. This allows a fraud system to act on the probability of a regime shift in user behavior.

The Pruned Exact Linear Time (PELT) algorithm is the gold standard for offline, retrospective change point detection, providing an exact segmentation of a time series with computational efficiency:

• Cost Function: PELT minimizes a penalized cost function, ∑ [C(y_{τ_{i-1}:τ_i})] + β * K, where C is a cost for a segment's fit to a statistical model (e.g., negative log-likelihood), β is a penalty constant, and K is the number of change points.
• Pruning: It achieves linear time complexity by dynamically pruning candidate change points that can never be optimal, avoiding the quadratic cost of naive dynamic programming.
• Use Case: Essential for post-hoc analysis of a compromised account's full transaction history to identify the exact moment of takeover and all subsequent behavioral shifts, providing a timeline for investigators.

It is critical to distinguish between two related but distinct temporal phenomena in production fraud models:

• Change Point: An abrupt, instantaneous shift in the data-generating process of a single entity (e.g., a user's transaction stream). The goal is to detect the exact moment of change.
• Concept Drift: A gradual or incremental evolution of the global statistical relationship between features and the target variable over time (e.g., fraudsters across the network slowly changing their tactics).
• Interaction: Unmitigated concept drift in the global fraud pattern can increase the false positive rate of a change point detector tuned to historical norms, necessitating a continuous model evaluation framework to trigger retraining.