Hidden Markov Model (HMM)

A specialized recurrent neural network designed to learn long-range temporal dependencies in sequential data. Unlike HMMs with discrete hidden states, LSTMs use a continuous cell state regulated by input, forget, and output gates to control information flow across hundreds of time steps.

• Forget gate: Decides what past information to discard
• Input gate: Selects new information to store in the cell state
• Output gate: Controls what parts of the cell state to expose

LSTMs excel at modeling complex, non-linear transaction sequences where the relevant context for detecting fraud may be separated by many legitimate transactions.

A recursive algorithm that estimates the evolving hidden state of a dynamic system from noisy measurements. Like an HMM, it maintains a latent state, but operates in continuous state space with Gaussian noise assumptions.

• Prediction step: Projects the state and uncertainty forward using a linear dynamic model
• Update step: Corrects the prediction using the latest noisy observation

In fraud detection, a Kalman filter provides an optimal, real-time estimate of a user's expected transaction amount, flagging deviations when actual spending falls far outside the predicted uncertainty bounds.

A deep learning model that processes entire sequences in parallel using self-attention rather than recurrence. While HMMs model transitions between discrete hidden states, Transformers compute pairwise attention weights between all elements in a sequence simultaneously.

• Multi-head attention: Allows the model to focus on different aspects of the sequence concurrently
• Positional encoding: Injects temporal order information into the parallel processing

Transformers capture complex, long-range dependencies between any two transactions without the Markov assumption, making them powerful for analyzing entire user histories at once.

A self-exciting temporal point process where each event increases the probability of subsequent events in the near future. Unlike an HMM's discrete time steps, Hawkes processes model events in continuous time.

• Intensity function: λ(t) = μ + Σ g(t - tᵢ), where past events excite future ones
• Kernel g(t): Typically an exponential decay, controlling how quickly excitation fades

This is particularly useful for modeling bursty transaction behavior, such as rapid-fire login attempts or a sudden flurry of high-value transfers characteristic of account takeover attacks.

An unsupervised model that compresses a variable-length transaction history into a fixed-length latent vector using an encoder, then attempts to reconstruct the sequence with a decoder.

• Encoder: Maps the input sequence to a compact latent representation
• Decoder: Regenerates the sequence from the latent vector
• Reconstruction error: High error signals an anomalous sequence

While an HMM learns a probabilistic generative model of sequences, a Seq2Seq AE learns a compressed representation of normal behavior. Sequences that deviate from learned norms produce high reconstruction errors, flagging potential fraud.

An algorithmic technique for identifying moments where the statistical properties of a time series shift abruptly. While HMMs assume stationary transition dynamics between hidden states, change point detection explicitly models when the underlying data-generating process itself changes.

• Bayesian online change point detection: Computes the posterior probability of a change at each time step
• CUSUM: Accumulates deviations from a target mean to detect small, sustained shifts

In fraud contexts, a detected change point may indicate an account takeover, where the legitimate user's behavioral patterns are suddenly replaced by an attacker's distinct transaction signature.