Dynamic Time Warping (DTW)

Unlike Euclidean distance, which performs a rigid one-to-one comparison, DTW finds an optimal non-linear alignment between two sequences. It computes a warping path that maps indices from one sequence to another, allowing a single point to map to multiple points. This handles local time scaling, where a fraudulent sequence may be a stretched or compressed version of a legitimate pattern, such as a slow-and-low probing attack versus a rapid smash-and-grab.

The algorithm constructs an N x M cumulative cost matrix, where each cell (i, j) represents the minimal alignment cost between the first i elements of sequence A and the first j elements of sequence B. The optimal warping path is the route through this matrix that minimizes total cost, constrained by:

• Monotonicity: The path cannot go backward in time.
• Continuity: The path steps only to adjacent cells.
• Boundary conditions: The path starts at (1,1) and ends at (N,M).

To prevent pathological warpings and reduce computational complexity from O(N²) to O(N*W), a Sakoe-Chiba band or Itakura parallelogram global constraint is applied. This restricts the warping path to a diagonal corridor of width W in the cost matrix. In fraud detection, this prevents a single transaction from being aligned with an entire day's worth of history, enforcing a physically plausible maximum time distortion.

DTW is a meta-algorithm that operates on a user-defined local cost function d(i,j). While Euclidean distance is common for scalar time series like transaction amounts, the framework supports:

• Cosine similarity for high-dimensional feature vectors.
• Edit distance for sequences of discrete merchant category codes.
• Learned metrics from siamese neural networks. This flexibility allows DTW to compare raw dollar amounts, behavioral embeddings, or symbolic sequences with equal rigor.

The local continuity constraints, or step pattern, dictate the allowed transitions in the warping path. Common patterns include symmetric, asymmetric, and slope-weighted variants. Slope weighting penalizes diagonal steps differently from horizontal or vertical ones, controlling the warping path's stiffness. A higher penalty on horizontal moves prevents a short sequence from being stretched to match a long one, which is critical for comparing a brief fraudulent session against a full day of normal activity.

In a fraud context, DTW is often used as a k-nearest neighbors (k-NN) anomaly detector. A user's recent transaction sequence is compared against a library of their own historical sequences or a cluster of normal peer sequences. The DTW distance to the k-th nearest neighbor becomes the anomaly score. A sudden spike in this score indicates a behavioral shift that does not conform to any previously seen temporal pattern, triggering an alert without requiring labeled fraud examples.

A specialized recurrent neural network architecture designed to learn long-range temporal dependencies in sequential data, such as transaction histories. It uses a gating mechanism (input, forget, and output gates) to control the flow of information through a cell state, mitigating the vanishing gradient problem. This makes LSTMs highly effective for modeling normal user behavior over extended periods to detect subtle deviations indicative of fraud.

The process of mapping a variable-length sequence of discrete events, such as merchant category codes or transaction types, into a fixed-length, dense vector representation. This embedding captures the semantic and temporal essence of a user's behavior in a compact form. These vectors can then be used as input to other models or compared directly using distance metrics like cosine similarity to identify accounts with unusual behavioral patterns.

A neural network architecture that uses causal, dilated convolutions to model sequential data. Unlike recurrent models, TCNs offer parallelizable computation and a flexible, exponentially large receptive field for capturing long-term patterns in transaction streams. The causal constraint ensures no information leakage from the future, making it a robust and efficient alternative to RNNs for sequence modeling tasks.

A statistical model that represents a system as a Markov process with unobserved (hidden) states. Each state emits an observable output, such as a transaction amount or type. HMMs are used to model a user's latent behavioral state (e.g., 'normal spending', 'travel mode', 'compromised') from a sequence of transactions. Anomalies are detected when a new sequence has a low probability of being generated by the trained model.

An algorithmic technique for identifying moments in a time series where the statistical properties of the data-generating process shift abruptly. In fraud detection, this can signal a critical event like an account takeover or a change in a fraudster's tactics. Algorithms like PELT or Bayesian Online Change Point Detection can operate in real-time on streaming transaction data to trigger immediate risk reviews.

A probabilistic model for a sequence of discrete events occurring in continuous time. Unlike discrete-time models, TPPs characterize the stochastic timing of transactions directly. A Hawkes Process, a self-exciting TPP, is particularly useful for modeling bursty behavior in financial transactions, where one event (like a failed login) increases the probability of another (like a password reset) in the near term.