Hawkes Process

The defining property of a Hawkes process is that the occurrence of an event elevates the conditional intensity function for a finite period afterward. In fraud detection, a rapid series of small-amount transactions (card testing) excites the model, making it anticipate further fraudulent attempts. The intensity λ(t) is modeled as:

λ(t) = μ + Σ α · g(t - tᵢ)

• μ: Baseline intensity (normal activity rate)
• α: Excitation strength (how much one event triggers others)
• g(t - tᵢ): Decay kernel (how quickly the excitation fades)

This captures the intuitive reality that fraud events are rarely isolated—they cluster in time.

Hawkes processes can be understood through a branching process metaphor, where each event is either an immigrant (arriving independently via the baseline rate μ) or an offspring (triggered by a prior event). This creates a causal, tree-like structure:

• Immigrant events: Represent the background noise of normal, uncorrelated activity
• Offspring events: Represent triggered, correlated activity—the hallmark of coordinated fraud

The branching ratio (n = ∫ g(t) dt) determines whether the process is subcritical (n < 1, dies out), critical (n = 1), or supercritical (n > 1, explodes). Most financial fraud models operate in the subcritical regime, where bursts are self-limiting.

The most common excitation kernel is the exponential decay function: g(t) = α · e^(-βt), where β controls the decay rate. This choice is computationally advantageous because it renders the intensity process Markovian—the future depends only on the current intensity, not the full history.

Key implications for transaction modeling:

• High β: Excitation decays rapidly; only very recent events matter (e.g., velocity checks over seconds)
• Low β: Excitation persists longer; captures slower-burn fraud patterns (e.g., credential stuffing over hours)
• The half-life of excitation is ln(2)/β, providing an interpretable timescale for risk windows

A multivariate Hawkes process extends the framework to multiple interacting event types, where events of type j can excite events of type i through a mutually exciting matrix αᵢⱼ. This is critical for detecting cross-channel fraud:

• A password reset (type A) may excite a beneficiary change (type B)
• A login from a new device (type C) may excite a wire transfer (type D)
• The excitation matrix α captures these causal dependencies between event types

This allows the model to learn that certain sequences of seemingly benign actions are precursors to fraud, even when each action individually appears normal.

Hawkes process parameters (μ, α, β) are typically estimated using maximum likelihood estimation (MLE). The log-likelihood for a Hawkes process over interval [0, T] with events at times t₁, t₂, ..., tₙ is:

L = Σ log λ(tᵢ) - ∫₀ᵀ λ(t) dt

• The first term rewards high intensity at actual event times
• The second term penalizes high intensity everywhere else (preventing trivial solutions)
• Optimization is performed via gradient descent or expectation-maximization

For streaming fraud applications, online Bayesian updating can adapt parameters as new transactions arrive, enabling the model to track evolving fraudster behavior without full retraining.

Validating a fitted Hawkes process relies on the random time change theorem: if the model is correct, transforming event times by the cumulative intensity τᵢ = ∫₀ᵗⁱ λ(s) ds yields a unit-rate Poisson process. The transformed inter-arrival times should be i.i.d. Exponential(1).

Diagnostic checks include:

• QQ-plots of transformed residuals against the exponential distribution
• Kolmogorov-Smirnov tests for uniformity
• Inspection of the compensator for deviations from linearity

These tests ensure the model adequately captures the temporal clustering structure and is not missing systematic patterns in the transaction stream.

The probabilistic framework for modeling event sequences in continuous time. A TPP is defined by its conditional intensity function λ(t), which represents the instantaneous rate of events given the history. The Hawkes process is a specific TPP where λ(t) depends on past events. Key components include:

• Inter-arrival time: The duration between consecutive events
• Counting process N(t): The number of events up to time t
• Marked TPPs: Each event carries auxiliary information (e.g., transaction amount)

The simplest temporal point process and the baseline against which self-exciting behavior is measured. In a homogeneous Poisson process, events occur independently with a constant intensity λ. The inter-arrival times are exponentially distributed. When fraud detection models assume transaction arrivals are memoryless, they miss the bursty clustering that Hawkes processes explicitly capture. The inhomogeneous Poisson process allows λ(t) to vary with time but still lacks self-excitation.

A modern extension where the intensity function is parameterized by a neural network rather than a fixed parametric form. This allows the model to learn complex, non-linear excitation dynamics from data. Architectures include:

• Recurrent Neural Hawkes: Uses an LSTM or GRU to summarize the event history into a hidden state that drives λ(t)
• Transformer Hawkes: Employs self-attention to capture long-range triggering dependencies
• Neural Jump SDEs: Models intensity as a stochastic differential equation with jumps at event times

The core mechanism behind Transformer architectures that computes a weighted representation of each event by attending to all other events in the sequence. For fraud detection, self-attention allows a model to directly connect a current suspicious transaction to a distantly related past event without the gradual information decay of recurrent models. The attention weights can be visualized to explain which historical transactions most influenced a fraud alert.

A TPP where each event carries a mark — additional data beyond the timestamp. In financial fraud, marks include transaction amount, merchant category, device ID, and location. A marked Hawkes process models how the magnitude and type of an event influence future excitation. A large wire transfer may trigger a higher intensity spike than a small purchase, and the mark distribution itself can be anomalous even if the timing is normal.

Algorithms that identify abrupt shifts in the statistical properties of a time series. While Hawkes processes model smooth self-excitation, change point detection flags moments when the entire data-generating process changes — such as an account takeover where the user's transaction rhythm fundamentally shifts. Combining both approaches provides a layered defense: Hawkes for burst detection, change point for regime shifts.