Cumulative Sum (CUSUM) Control Chart

An algorithmic technique for identifying moments in a time series where the statistical properties of the data-generating process shift abruptly. While CUSUM excels at detecting small, sustained mean shifts, offline change point detection algorithms like PELT or Binary Segmentation can partition a historical transaction history into distinct behavioral regimes. This is critical for account takeover detection, where a sudden, persistent alteration in spending velocity signals a compromised credential. The combination allows CUSUM to monitor online while change point analysis retrospectively validates the exact moment of hijack.

The phenomenon in streaming data where the underlying statistical relationship between input features and the target variable changes over time. CUSUM's sensitivity to sustained shifts makes it a powerful detector of concept drift in production fraud models. If a CUSUM chart on a model's prediction error or a key feature's mean signals an alarm, it indicates that the data-generating process has fundamentally changed—not just a transient anomaly. This triggers a model retraining or recalibration workflow, ensuring the fraud system adapts to evolving criminal tactics without manual oversight.

A time-series forecasting method that applies decreasing weights to past observations to model the error, trend, and seasonality components. Unlike CUSUM's focus on the raw cumulative deviation from a fixed mean, ETS provides a dynamic, adaptive baseline for expected transaction behavior. A common architecture uses ETS to forecast the next transaction amount and then applies a CUSUM chart to the forecast errors. This dual approach captures both the expected cyclical patterns (via ETS) and subtle, persistent deviations from those expectations (via CUSUM), dramatically reducing false positives from seasonal spending.

A recursive algorithm that estimates the evolving state of a dynamic system from a series of noisy measurements. It provides an optimal, continuously updating prediction of a user's expected transaction amount. The innovation sequence—the difference between the Kalman filter's prediction and the actual observation—is ideally zero-mean white noise. Feeding this innovation sequence into a CUSUM chart creates a highly sensitive detector: any sustained bias in the innovations indicates that the underlying state-space model of user behavior is no longer valid, signaling a potential account takeover or a shift in spending patterns.

A derived feature measuring the rate of transactions over a specific time window, such as the number of login attempts or payment transfers per minute. This is a critical real-time indicator of automated bot attacks or credential stuffing. CUSUM is ideally suited for monitoring velocity because it accumulates small, persistent increases in event frequency that simple threshold checks might miss. A CUSUM chart on a 1-minute transaction count can detect a gradual acceleration of activity characteristic of a scripted attack long before a static rule would trigger, enabling preemptive blocking.

A self-exciting temporal point process where the occurrence of an event increases the probability of future events in the near term. It models bursty behavior in financial transactions or high-frequency trading. While CUSUM monitors the cumulative sum of a continuous metric, a Hawkes process models the stochastic timing of discrete events themselves. The two are complementary: a CUSUM chart can monitor the Hawkes process's estimated intensity parameter over time. A sustained increase in the self-exciting component signals a shift from normal bursty behavior to a coordinated, cascading fraud attack.